syzbot

map[DenialOfService:true Explanation:The bug report indicates a `WARN_ON(!xa_empty(&pool->xa))` in `rxe_pool_cleanup`
for the `pd_pool` (Protection Domain pool). This warning is triggered during
`rxe_dealloc` (called via `ib_unregister_device`), meaning that a Protection
Domain (PD) was not properly deallocated before the RDMA device was unregistered
and destroyed.

### Root Cause & Exploitation
The root cause is a race condition in the `rds` (Reliable Datagram Sockets) RDMA
client.
When an RDMA device is registered, `rds_ib_add_one` allocates a PD
(`ib_alloc_pd`). When the device is unregistered, `rds_ib_remove_one` is called
to clean up. However, `rds_ib_remove_one` defers the actual cleanup (including
`ib_dealloc_pd`) to a workqueue (`rds_ib_dev_free` on `rds_wq`) and returns
immediately without waiting for the work to complete.

The RDMA core (`disable_device`) waits for the device's refcount to reach 0
before freeing it. Since `rds_ib_add_one` does not hold a reference to the
`ib_device`, the refcount drops to 0, and `ib_dealloc_device` proceeds to free
the `ib_device` structure (via `kfree_rcu`).

Later, when the deferred `rds_ib_dev_free` work executes, it calls
`ib_dealloc_pd(rds_ibdev->pd)`. This function accesses
`pd->device->ops.dealloc_pd`. Since `pd->device` (the `ib_device`) has already
been freed, this results in a **Use-After-Free (UAF)**. Because it involves an
indirect function call (`->ops.dealloc_pd`) from a freed structure, it is highly
exploitable for arbitrary code execution and privilege escalation.

### Trigger Vectors
- **Unprivileged / User Namespaces:** Triggering the software RDMA device
creation/deletion (via `RDMA_NLDEV_CMD_NEWLINK` and `RDMA_NLDEV_CMD_DELLINK`
netlink commands) requires `CAP_NET_ADMIN` in the **initial** user namespace
(`init_user_ns`). Therefore, it cannot be triggered by unprivileged users or
from within user namespaces.
- **Peripheral Trigger:** The bug can be triggered by physically hotplugging and
then unplugging a PCIe RDMA device (e.g., via Thunderbolt). The kernel will
automatically probe the device, register it with the RDMA core (triggering
`rds_ib_add_one`), and upon unplug, unregister it (triggering the UAF race
condition). Exploitable:true FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:true RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
	struct usb_endpoint_descriptor desc;
	int handle;
};

struct usb_iface_index {
	struct usb_interface_descriptor* iface;
	uint8_t bInterfaceNumber;
	uint8_t bAlternateSetting;
	uint8_t bInterfaceClass;
	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
	int eps_num;
};

struct usb_device_index {
	struct usb_device_descriptor* dev;
	struct usb_config_descriptor* config;
	uint8_t bDeviceClass;
	uint8_t bMaxPower;
	int config_length;
	struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
	int ifaces_num;
	int iface_cur;
};

struct usb_info {
	int fd;
	struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];

static struct usb_device_index* lookup_usb_index(int fd)
{
	for (int i = 0; i < USB_MAX_FDS; i++) {
		if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
			return &usb_devices[i].index;
	}
	return NULL;
}

static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
	if (length < sizeof(*index->dev) + sizeof(*index->config))
		return false;
	memset(index, 0, sizeof(*index));
	index->dev = (struct usb_device_descriptor*)buffer;
	index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
	index->bDeviceClass = index->dev->bDeviceClass;
	index->bMaxPower = index->config->bMaxPower;
	index->config_length = length - sizeof(*index->dev);
	index->iface_cur = -1;
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
		uint8_t desc_type = buffer[offset + 1];
		if (desc_length <= 2)
			break;
		if (offset + desc_length > length)
			break;
		if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
			struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
			index->ifaces[index->ifaces_num].iface = iface;
			index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
			index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
			index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
			index->ifaces_num++;
		}
		if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
			if (iface->eps_num < USB_MAX_EP_NUM) {
				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
				iface->eps_num++;
			}
		}
		offset += desc_length;
	}
	return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
	int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
	if (i >= USB_MAX_FDS)
		return NULL;
	if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
		return NULL;
	__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
	return &usb_devices[i].index;
}

struct vusb_connect_string_descriptor {
	uint32_t len;
	char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
	uint32_t qual_len;
	char* qual;
	uint32_t bos_len;
	char* bos;
	uint32_t strs_len;
	struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {
    8, USB_DT_STRING,
    's', 0, 'y', 0, 'z', 0
};

static const char default_lang_id[] = {
    4, USB_DT_STRING,
    0x09, 0x04
};

static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
				       const struct usb_ctrlrequest* ctrl,
				       struct usb_qualifier_descriptor* qual,
				       char** response_data, uint32_t* response_length)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	uint8_t str_idx;
	if (!index)
		return false;
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_GET_DESCRIPTOR:
			switch (ctrl->wValue >> 8) {
			case USB_DT_DEVICE:
				*response_data = (char*)index->dev;
				*response_length = sizeof(*index->dev);
				return true;
			case USB_DT_CONFIG:
				*response_data = (char*)index->config;
				*response_length = index->config_length;
				return true;
			case USB_DT_STRING:
				str_idx = (uint8_t)ctrl->wValue;
				if (descs && str_idx < descs->strs_len) {
					*response_data = descs->strs[str_idx].str;
					*response_length = descs->strs[str_idx].len;
					return true;
				}
				if (str_idx == 0) {
					*response_data = (char*)&default_lang_id[0];
					*response_length = default_lang_id[0];
					return true;
				}
				*response_data = (char*)&default_string[0];
				*response_length = default_string[0];
				return true;
			case USB_DT_BOS:
				*response_data = descs->bos;
				*response_length = descs->bos_len;
				return true;
			case USB_DT_DEVICE_QUALIFIER:
				if (!descs->qual) {
					qual->bLength = sizeof(*qual);
					qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
					qual->bcdUSB = index->dev->bcdUSB;
					qual->bDeviceClass = index->dev->bDeviceClass;
					qual->bDeviceSubClass = index->dev->bDeviceSubClass;
					qual->bDeviceProtocol = index->dev->bDeviceProtocol;
					qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
					qual->bNumConfigurations = index->dev->bNumConfigurations;
					qual->bRESERVED = 0;
					*response_data = (char*)qual;
					*response_length = sizeof(*qual);
					return true;
				}
				*response_data = descs->qual;
				*response_length = descs->qual_len;
				return true;
			default:
				break;
			}
			break;
		default:
			break;
		}
		break;
	default:
		break;
	}
	return false;
}

typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
					      const struct usb_ctrlrequest* ctrl, bool* done);

static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
						const struct usb_ctrlrequest* ctrl, bool* done)
{
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_SET_CONFIGURATION:
			*done = true;
			return true;
		default:
			break;
		}
		break;
	}
	return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
	__u8 driver_name[UDC_NAME_LENGTH_MAX];
	__u8 device_name[UDC_NAME_LENGTH_MAX];
	__u8 speed;
};

enum usb_raw_event_type {
	USB_RAW_EVENT_INVALID = 0,
	USB_RAW_EVENT_CONNECT = 1,
	USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
	__u32 type;
	__u32 length;
	__u8 data[0];
};

struct usb_raw_ep_io {
	__u16 ep;
	__u16 flags;
	__u32 length;
	__u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
	__u32 type_control : 1;
	__u32 type_iso : 1;
	__u32 type_bulk : 1;
	__u32 type_int : 1;
	__u32 dir_in : 1;
	__u32 dir_out : 1;
};

struct usb_raw_ep_limits {
	__u16 maxpacket_limit;
	__u16 max_streams;
	__u32 reserved;
};

struct usb_raw_ep_info {
	__u8 name[USB_RAW_EP_NAME_MAX];
	__u32 addr;
	struct usb_raw_ep_caps caps;
	struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
	struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
	return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
	struct usb_raw_init arg;
	strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
	strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
	arg.speed = speed;
	return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_configure(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
	return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
	return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_ep0_stall(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
	struct usb_raw_event inner;
	struct usb_ctrlrequest ctrl;
	char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
	struct usb_raw_ep_io inner;
	char data[USB_MAX_PACKET_SIZE];
};

static void set_interface(int fd, int n)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return;
	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
			if (rv < 0) {
			} else {
			}
		}
	}
	if (n >= 0 && n < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
			if (rv < 0) {
			} else {
				index->ifaces[n].eps[ep].handle = rv;
			}
		}
		index->iface_cur = n;
	}
}

static int configure_device(int fd)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_configure(fd);
	if (rv < 0) {
		return rv;
	}
	set_interface(fd, 0);
	return 0;
}

static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
					  const struct vusb_connect_descriptors* descs,
					  lookup_connect_out_response_t lookup_connect_response_out)
{
	if (!dev) {
		return -1;
	}
	int fd = usb_raw_open();
	if (fd < 0) {
		return fd;
	}
	if (fd >= MAX_FDS) {
		close(fd);
		return -1;
	}
	struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
	if (!index) {
		return -1;
	}
	char device[32];
	sprintf(&device[0], "dummy_udc.%llu", procid);
	int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_run(fd);
	if (rv < 0) {
		return rv;
	}
	bool done = false;
	while (!done) {
		struct usb_raw_control_event event;
		event.inner.type = 0;
		event.inner.length = sizeof(event.ctrl);
		rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
		if (rv < 0) {
			return rv;
		}
		if (event.inner.type != USB_RAW_EVENT_CONTROL)
			continue;
		char* response_data = NULL;
		uint32_t response_length = 0;
		struct usb_qualifier_descriptor qual;
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
		} else {
			if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
			response_data = NULL;
			response_length = event.ctrl.wLength;
		}
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
		    event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
			rv = configure_device(fd);
			if (rv < 0) {
				return rv;
			}
		}
		struct usb_raw_ep_io_data response;
		response.inner.ep = 0;
		response.inner.flags = 0;
		if (response_length > sizeof(response.data))
			response_length = 0;
		if (event.ctrl.wLength < response_length)
			response_length = event.ctrl.wLength;
		response.inner.length = response_length;
		if (response_data)
			memcpy(&response.data[0], response_data, response_length);
		else
			memset(&response.data[0], 0, response_length);
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
		} else {
			rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
		}
		if (rv < 0) {
			return rv;
		}
	}
	sleep_ms(200);
	return fd;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	uint64_t speed = a0;
	uint64_t dev_len = a1;
	const char* dev = (const char*)a2;
	const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
	return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  prlimit64 arguments: [
//    pid: pid (resource)
//    res: rlimit_type = 0xe (8 bytes)
//    new: ptr[in, rlimit] {
//      rlimit {
//        soft: intptr = 0x8 (8 bytes)
//        hard: intptr = 0x8b (8 bytes)
//      }
//    }
//    old: nil
//  ]
*(uint64_t*)0x200000000140 = 8;
*(uint64_t*)0x200000000148 = 0x8b;
	syscall(__NR_prlimit64, /*pid=*/0, /*res=RLIMIT_RTPRIO*/0xeul, /*new=*/0x200000000140ul, /*old=*/0ul);
//  sched_setscheduler arguments: [
//    pid: pid (resource)
//    policy: sched_policy = 0x2 (8 bytes)
//    prio: ptr[in, int32] {
//      int32 = 0x7 (4 bytes)
//    }
//  ]
*(uint32_t*)0x200000000340 = 7;
	syscall(__NR_sched_setscheduler, /*pid=*/0, /*policy=SCHED_RR*/2ul, /*prio=*/0x200000000340ul);
//  socket$nl_rdma arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x14 (4 bytes)
//  ]
//  returns sock_nl_rdma
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x14);
	if (res != -1)
		r[0] = res;
//  sendmsg$RDMA_NLDEV_CMD_NEWLINK arguments: [
//    fd: sock_nl_rdma (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]]] {
//      msghdr_netlink[netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]]] {
//          iovec[in, netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]] {
//            addr: ptr[inout, array[ANYUNION]] {
//              array[ANYUNION] {
//                union ANYUNION {
//                  ANYBLOB: buffer: {38 00 00 00 03 14 01 00 2a bd 70 00 fe db df 25 09 00 02 00 73 79 7a 30 00 00 00 00 08 00 41 00 72 78 65 00 14 00 33 00 62 6f 6e 64 30} (length 0x2d)
//                }
//              }
//            }
//            len: len = 0x38 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x4000840 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x24004000 (8 bytes)
//  ]
*(uint64_t*)0x2000000000c0 = 0;
*(uint32_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0x200000000080;
*(uint64_t*)0x200000000080 = 0x200000000040;
memcpy((void*)0x200000000040, "... [truncated large byte array] ...", 45);
*(uint64_t*)0x200000000088 = 0x38;
*(uint64_t*)0x2000000000d8 = 1;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint32_t*)0x2000000000f0 = 0x4000840;
	syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x2000000000c0ul, /*f=MSG_ZEROCOPY|MSG_FASTOPEN|MSG_NOSIGNAL*/0x24004000ul);
//  socket$nl_rdma arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x14 (4 bytes)
//  ]
//  returns sock_nl_rdma
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x14);
	if (res != -1)
		r[1] = res;
//  syz_usb_connect$hid arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x36 (8 bytes)
//    dev: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//        union ANYUNION {
//          ANYBLOB: buffer: {} (length 0x0)
//        }
//      }
//    }
//    conn_descs: nil
//  ]
//  returns fd_usb_hid
syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0x200000000180, /*conn_descs=*/0);
//  write$RDMA_USER_CM_CMD_CREATE_ID arguments: [
//    fd: fd_rdma_cm (resource)
//    data: ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CREATE_ID, rdma_ucm_create_id]] {
//      rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CREATE_ID, rdma_ucm_create_id] {
//        cmd: const = 0x0 (4 bytes)
//        in: bytesize = 0x18 (2 bytes)
//        out: const = 0xfa00 (2 bytes)
//        msg: rdma_ucm_create_id {
//          uid: int64 = 0x2 (8 bytes)
//          response: nil
//          ps: rdma_port_space = 0x111 (2 bytes)
//          qp_type: ib_qp_type = 0x2 (1 bytes)
//          reserved: buffer: {00 00 00 00 00} (length 0x5)
//        }
//      }
//    }
//    len: bytesize = 0x20 (8 bytes)
//  ]
*(uint32_t*)0x200000000140 = 0;
*(uint16_t*)0x200000000144 = 0x18;
*(uint16_t*)0x200000000146 = 0xfa00;
*(uint64_t*)0x200000000148 = 2;
*(uint64_t*)0x200000000150 = 0;
*(uint16_t*)0x200000000158 = 0x111;
*(uint8_t*)0x20000000015a = 2;
memset((void*)0x20000000015b, 0, 5);
	syscall(__NR_write, /*fd=*/(intptr_t)-1, /*data=*/0x200000000140ul, /*len=*/0x20ul);
//  sendmsg$RDMA_NLDEV_CMD_PORT_GET arguments: [
//    fd: sock_nl_rdma (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]]] {
//      msghdr_netlink[netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]]] {
//          iovec[in, netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]] {
//            addr: ptr[inout, array[ANYUNION]] {
//              array[ANYUNION] {
//                union ANYUNION {
//                  ANYBLOB: buffer: {20 00 00 00 04 14 01 00 26 bd 70 00 ff db df 25 08 00 01 00 00 00 00 00 08 00} (length 0x1a)
//                }
//              }
//            }
//            len: len = 0x20 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x20048000 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x20000000 (8 bytes)
//  ]
*(uint64_t*)0x2000000002c0 = 0;
*(uint32_t*)0x2000000002c8 = 0;
*(uint64_t*)0x2000000002d0 = 0x200000000200;
*(uint64_t*)0x200000000200 = 0x200000000140;
memcpy((void*)0x200000000140, "\x20\x00\x00\x00\x04\x14\x01\x00\x26\xbd\x70\x00\xff\xdb\xdf\x25\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00", 26);
*(uint64_t*)0x200000000208 = 0x20;
*(uint64_t*)0x2000000002d8 = 1;
*(uint64_t*)0x2000000002e0 = 0;
*(uint64_t*)0x2000000002e8 = 0;
*(uint32_t*)0x2000000002f0 = 0x20048000;
	syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x2000000002c0ul, /*f=MSG_FASTOPEN*/0x20000000ul);
//  bpf$PROG_LOAD arguments: [
//    cmd: const = 0x5 (8 bytes)
//    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
//      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]] {
//        type: bpf_prog_type = 0x1d (4 bytes)
//        ninsn: bytesize8 = 0x0 (4 bytes)
//        insns: nil
//        license: ptr[in, buffer] {
//          buffer: {47 50 4c 00} (length 0x4)
//        }
//        loglev: int32 = 0x5 (4 bytes)
//        logsize: len = 0x0 (4 bytes)
//        log: nil
//        kern_version: bpf_kern_version = 0x0 (4 bytes)
//        flags: bpf_prog_load_flags = 0x42 (4 bytes)
//        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        prog_ifindex: ifindex (resource)
//        expected_attach_type: union bpf_prog_attach_types {
//          fallback: bpf_attach_types = 0x0 (4 bytes)
//        }
//        btf_fd: fd_btf (resource)
//        func_info_rec_size: const = 0x6 (4 bytes)
//        func_info: nil
//        func_info_cnt: len = 0x0 (4 bytes)
//        line_info_rec_size: const = 0x10 (4 bytes)
//        line_info: nil
//        line_info_cnt: len = 0x0 (4 bytes)
//        attach_btf_id: bpf_btf_id (resource)
//        attach_prog_fd: fd_bpf_prog (resource)
//        core_relo_cnt: len = 0x0 (4 bytes)
//        fd_array: nil
//        core_relos: nil
//        core_relo_rec_size: const = 0x10 (4 bytes)
//        log_true_size: int32 = 0x0 (4 bytes)
//        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_prog_token_fd_wrapper {
//          void: buffer: {} (length 0x0)
//        }
//        pad: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_pad_wrapper {
//          value: const = 0x0 (4 bytes)
//        }
//      }
//    }
//    size: len = 0x94 (8 bytes)
//  ]
//  returns fd_bpf_prog
*(uint32_t*)0x200000000a00 = 0x1d;
*(uint32_t*)0x200000000a04 = 0;
*(uint64_t*)0x200000000a08 = 0;
*(uint64_t*)0x200000000a10 = 0x200000000080;
memcpy((void*)0x200000000080, "GPL\000", 4);
*(uint32_t*)0x200000000a18 = 5;
*(uint32_t*)0x200000000a1c = 0;
*(uint64_t*)0x200000000a20 = 0;
*(uint32_t*)0x200000000a28 = 0;
*(uint32_t*)0x200000000a2c = 0x42;
memset((void*)0x200000000a30, 0, 16);
*(uint32_t*)0x200000000a40 = 0;
*(uint32_t*)0x200000000a44 = 0;
*(uint32_t*)0x200000000a48 = -1;
*(uint32_t*)0x200000000a4c = 6;
*(uint64_t*)0x200000000a50 = 0;
*(uint32_t*)0x200000000a58 = 0;
*(uint32_t*)0x200000000a5c = 0x10;
*(uint64_t*)0x200000000a60 = 0;
*(uint32_t*)0x200000000a68 = 0;
*(uint32_t*)0x200000000a6c = -1;
*(uint32_t*)0x200000000a70 = -1;
*(uint32_t*)0x200000000a74 = 0;
*(uint64_t*)0x200000000a78 = 0;
*(uint64_t*)0x200000000a80 = 0;
*(uint32_t*)0x200000000a88 = 0x10;
*(uint32_t*)0x200000000a8c = 0;
*(uint32_t*)0x200000000a90 = 0;
	syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000a00ul, /*size=*/0x94ul);
	return 0;
}
]

map[KernelSrc:/app/workdir/cache/src/0c78bcd903be9e627570b89cbd734cd318119544]

map[KernelObj:/app/workdir/cache/build/9822c372d35e7bae9a446ca2e6cfeb5566c22f00]

map[Index:codesearch-index]

gemini-3.1-pro-preview

map[DenialOfService:true Exploitable:true FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:true RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.

Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).

Don't make assumptions; verify them with source code access. Try different strategies when analyzing the bug:
 - think of ways in which the vulnerable code is unreachable
 - or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.

Analysis dimensions:

* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.

Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.

* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.

* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).

* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.

* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.

* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).

* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.

* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).

* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.

* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The kernel bug report is:

UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
smc: removing ib device syz0
------------[ cut here ]------------
WARNING: drivers/infiniband/sw/rxe/rxe_pool.c:116 at rxe_pool_cleanup+0x48/0x60 drivers/infiniband/sw/rxe/rxe_pool.c:116, CPU#0: syz.1.18/5722
Modules linked in:
CPU: 0 UID: 0 PID: 5722 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:rxe_pool_cleanup+0x48/0x60 drivers/infiniband/sw/rxe/rxe_pool.c:116
Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 00 bb a4 f9 48 83 3b 00 75 0c e8 15 10 3d f9 5b c3 cc cc cc cc cc e8 09 10 3d f9 90 <0f> 0b 90 5b e9 cf 79 da 02 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc9000d3bf038 EFLAGS: 00010293
RAX: ffffffff8883f607 RBX: ffff8880544a93d8 RCX: ffff8880001724c0
RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8880544a9358
RBP: ffff8880544a90b8 R08: ffff8880544a87b3 R09: 1ffff1100a8950f6
R10: dffffc0000000000 R11: ffffffff888231b0 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff888231b0 R15: dffffc0000000000
FS:  00007fc0a0bf66c0(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc0a1573460 CR3: 000000005805b000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 rxe_dealloc+0x27/0xc0 drivers/infiniband/sw/rxe/rxe.c:24
 ib_dealloc_device+0x54/0x200 drivers/infiniband/core/device.c:693
 __ib_unregister_device+0x393/0x3f0 drivers/infiniband/core/device.c:1573
 ib_unregister_device_and_put+0xb8/0xf0 drivers/infiniband/core/device.c:1620
 nldev_dellink+0x2d1/0x320 drivers/infiniband/core/nldev.c:1827
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0x6ae/0x980 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:742
 ____sys_sendmsg+0x505/0x820 net/socket.c:2592
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2681
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc0a158f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc0a0bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc0a17e5fa0 RCX: 00007fc0a158f7c9
RDX: 0000000020000000 RSI: 00002000000002c0 RDI: 0000000000000004
RBP: 00007fc0a1613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc0a17e6038 R14: 00007fc0a17e5fa0 R15: 00007ffcdb18a758
 </TASK>




It is reproducible with the followint program.
Keep in mind that it may lack the precise threading, sandboxing, and some arguments of a working reproducer.
But it should give an idea of the involved syscalls.

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/usb/ch9.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

#define MAX_FDS 30

#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6

struct usb_endpoint_index {
	struct usb_endpoint_descriptor desc;
	int handle;
};

struct usb_iface_index {
	struct usb_interface_descriptor* iface;
	uint8_t bInterfaceNumber;
	uint8_t bAlternateSetting;
	uint8_t bInterfaceClass;
	struct usb_endpoint_index eps[USB_MAX_EP_NUM];
	int eps_num;
};

struct usb_device_index {
	struct usb_device_descriptor* dev;
	struct usb_config_descriptor* config;
	uint8_t bDeviceClass;
	uint8_t bMaxPower;
	int config_length;
	struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
	int ifaces_num;
	int iface_cur;
};

struct usb_info {
	int fd;
	struct usb_device_index index;
};

static struct usb_info usb_devices[USB_MAX_FDS];

static struct usb_device_index* lookup_usb_index(int fd)
{
	for (int i = 0; i < USB_MAX_FDS; i++) {
		if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd)
			return &usb_devices[i].index;
	}
	return NULL;
}

static int usb_devices_num;

static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
	if (length < sizeof(*index->dev) + sizeof(*index->config))
		return false;
	memset(index, 0, sizeof(*index));
	index->dev = (struct usb_device_descriptor*)buffer;
	index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
	index->bDeviceClass = index->dev->bDeviceClass;
	index->bMaxPower = index->config->bMaxPower;
	index->config_length = length - sizeof(*index->dev);
	index->iface_cur = -1;
	size_t offset = 0;
	while (true) {
		if (offset + 1 >= length)
			break;
		uint8_t desc_length = buffer[offset];
		uint8_t desc_type = buffer[offset + 1];
		if (desc_length <= 2)
			break;
		if (offset + desc_length > length)
			break;
		if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
			struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
			index->ifaces[index->ifaces_num].iface = iface;
			index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
			index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
			index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
			index->ifaces_num++;
		}
		if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
			struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
			if (iface->eps_num < USB_MAX_EP_NUM) {
				memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
				iface->eps_num++;
			}
		}
		offset += desc_length;
	}
	return true;
}

static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
	int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
	if (i >= USB_MAX_FDS)
		return NULL;
	if (!parse_usb_descriptor(dev, dev_len, &usb_devices[i].index))
		return NULL;
	__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
	return &usb_devices[i].index;
}

struct vusb_connect_string_descriptor {
	uint32_t len;
	char* str;
} __attribute__((packed));

struct vusb_connect_descriptors {
	uint32_t qual_len;
	char* qual;
	uint32_t bos_len;
	char* bos;
	uint32_t strs_len;
	struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));

static const char default_string[] = {
    8, USB_DT_STRING,
    's', 0, 'y', 0, 'z', 0
};

static const char default_lang_id[] = {
    4, USB_DT_STRING,
    0x09, 0x04
};

static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
				       const struct usb_ctrlrequest* ctrl,
				       struct usb_qualifier_descriptor* qual,
				       char** response_data, uint32_t* response_length)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	uint8_t str_idx;
	if (!index)
		return false;
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_GET_DESCRIPTOR:
			switch (ctrl->wValue >> 8) {
			case USB_DT_DEVICE:
				*response_data = (char*)index->dev;
				*response_length = sizeof(*index->dev);
				return true;
			case USB_DT_CONFIG:
				*response_data = (char*)index->config;
				*response_length = index->config_length;
				return true;
			case USB_DT_STRING:
				str_idx = (uint8_t)ctrl->wValue;
				if (descs && str_idx < descs->strs_len) {
					*response_data = descs->strs[str_idx].str;
					*response_length = descs->strs[str_idx].len;
					return true;
				}
				if (str_idx == 0) {
					*response_data = (char*)&default_lang_id[0];
					*response_length = default_lang_id[0];
					return true;
				}
				*response_data = (char*)&default_string[0];
				*response_length = default_string[0];
				return true;
			case USB_DT_BOS:
				*response_data = descs->bos;
				*response_length = descs->bos_len;
				return true;
			case USB_DT_DEVICE_QUALIFIER:
				if (!descs->qual) {
					qual->bLength = sizeof(*qual);
					qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
					qual->bcdUSB = index->dev->bcdUSB;
					qual->bDeviceClass = index->dev->bDeviceClass;
					qual->bDeviceSubClass = index->dev->bDeviceSubClass;
					qual->bDeviceProtocol = index->dev->bDeviceProtocol;
					qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
					qual->bNumConfigurations = index->dev->bNumConfigurations;
					qual->bRESERVED = 0;
					*response_data = (char*)qual;
					*response_length = sizeof(*qual);
					return true;
				}
				*response_data = descs->qual;
				*response_length = descs->qual_len;
				return true;
			default:
				break;
			}
			break;
		default:
			break;
		}
		break;
	default:
		break;
	}
	return false;
}

typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
					      const struct usb_ctrlrequest* ctrl, bool* done);

static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
						const struct usb_ctrlrequest* ctrl, bool* done)
{
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
		switch (ctrl->bRequest) {
		case USB_REQ_SET_CONFIGURATION:
			*done = true;
			return true;
		default:
			break;
		}
		break;
	}
	return false;
}

#define UDC_NAME_LENGTH_MAX 128

struct usb_raw_init {
	__u8 driver_name[UDC_NAME_LENGTH_MAX];
	__u8 device_name[UDC_NAME_LENGTH_MAX];
	__u8 speed;
};

enum usb_raw_event_type {
	USB_RAW_EVENT_INVALID = 0,
	USB_RAW_EVENT_CONNECT = 1,
	USB_RAW_EVENT_CONTROL = 2,
};

struct usb_raw_event {
	__u32 type;
	__u32 length;
	__u8 data[0];
};

struct usb_raw_ep_io {
	__u16 ep;
	__u16 flags;
	__u32 length;
	__u8 data[0];
};

#define USB_RAW_EPS_NUM_MAX 30
#define USB_RAW_EP_NAME_MAX 16
#define USB_RAW_EP_ADDR_ANY 0xff

struct usb_raw_ep_caps {
	__u32 type_control : 1;
	__u32 type_iso : 1;
	__u32 type_bulk : 1;
	__u32 type_int : 1;
	__u32 dir_in : 1;
	__u32 dir_out : 1;
};

struct usb_raw_ep_limits {
	__u16 maxpacket_limit;
	__u16 max_streams;
	__u32 reserved;
};

struct usb_raw_ep_info {
	__u8 name[USB_RAW_EP_NAME_MAX];
	__u32 addr;
	struct usb_raw_ep_caps caps;
	struct usb_raw_ep_limits limits;
};

struct usb_raw_eps_info {
	struct usb_raw_ep_info eps[USB_RAW_EPS_NUM_MAX];
};

#define USB_RAW_IOCTL_INIT _IOW('U', 0, struct usb_raw_init)
#define USB_RAW_IOCTL_RUN _IO('U', 1)
#define USB_RAW_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_raw_event)
#define USB_RAW_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP0_READ _IOWR('U', 4, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
#define USB_RAW_IOCTL_EP_DISABLE _IOW('U', 6, __u32)
#define USB_RAW_IOCTL_EP_WRITE _IOW('U', 7, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_EP_READ _IOWR('U', 8, struct usb_raw_ep_io)
#define USB_RAW_IOCTL_CONFIGURE _IO('U', 9)
#define USB_RAW_IOCTL_VBUS_DRAW _IOW('U', 10, __u32)
#define USB_RAW_IOCTL_EPS_INFO _IOR('U', 11, struct usb_raw_eps_info)
#define USB_RAW_IOCTL_EP0_STALL _IO('U', 12)
#define USB_RAW_IOCTL_EP_SET_HALT _IOW('U', 13, __u32)
#define USB_RAW_IOCTL_EP_CLEAR_HALT _IOW('U', 14, __u32)
#define USB_RAW_IOCTL_EP_SET_WEDGE _IOW('U', 15, __u32)

static int usb_raw_open()
{
	return open("/dev/raw-gadget", O_RDWR);
}

static int usb_raw_init(int fd, uint32_t speed, const char* driver, const char* device)
{
	struct usb_raw_init arg;
	strncpy((char*)&arg.driver_name[0], driver, sizeof(arg.driver_name));
	strncpy((char*)&arg.device_name[0], device, sizeof(arg.device_name));
	arg.speed = speed;
	return ioctl(fd, USB_RAW_IOCTL_INIT, &arg);
}

static int usb_raw_run(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_RUN, 0);
}

static int usb_raw_configure(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_CONFIGURE, 0);
}

static int usb_raw_vbus_draw(int fd, uint32_t power)
{
	return ioctl(fd, USB_RAW_IOCTL_VBUS_DRAW, power);
}

static int usb_raw_ep0_write(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_WRITE, io);
}

static int usb_raw_ep0_read(int fd, struct usb_raw_ep_io* io)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_READ, io);
}

static int usb_raw_event_fetch(int fd, struct usb_raw_event* event)
{
	return ioctl(fd, USB_RAW_IOCTL_EVENT_FETCH, event);
}

static int usb_raw_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_ENABLE, desc);
}

static int usb_raw_ep_disable(int fd, int ep)
{
	return ioctl(fd, USB_RAW_IOCTL_EP_DISABLE, ep);
}

static int usb_raw_ep0_stall(int fd)
{
	return ioctl(fd, USB_RAW_IOCTL_EP0_STALL, 0);
}

#define USB_MAX_PACKET_SIZE 4096

struct usb_raw_control_event {
	struct usb_raw_event inner;
	struct usb_ctrlrequest ctrl;
	char data[USB_MAX_PACKET_SIZE];
};

struct usb_raw_ep_io_data {
	struct usb_raw_ep_io inner;
	char data[USB_MAX_PACKET_SIZE];
};

static void set_interface(int fd, int n)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return;
	if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) {
			int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle);
			if (rv < 0) {
			} else {
			}
		}
	}
	if (n >= 0 && n < index->ifaces_num) {
		for (int ep = 0; ep < index->ifaces[n].eps_num; ep++) {
			int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc);
			if (rv < 0) {
			} else {
				index->ifaces[n].eps[ep].handle = rv;
			}
		}
		index->iface_cur = n;
	}
}

static int configure_device(int fd)
{
	struct usb_device_index* index = lookup_usb_index(fd);
	if (!index)
		return -1;
	int rv = usb_raw_vbus_draw(fd, index->bMaxPower);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_configure(fd);
	if (rv < 0) {
		return rv;
	}
	set_interface(fd, 0);
	return 0;
}

static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev,
					  const struct vusb_connect_descriptors* descs,
					  lookup_connect_out_response_t lookup_connect_response_out)
{
	if (!dev) {
		return -1;
	}
	int fd = usb_raw_open();
	if (fd < 0) {
		return fd;
	}
	if (fd >= MAX_FDS) {
		close(fd);
		return -1;
	}
	struct usb_device_index* index = add_usb_index(fd, dev, dev_len);
	if (!index) {
		return -1;
	}
	char device[32];
	sprintf(&device[0], "dummy_udc.%llu", procid);
	int rv = usb_raw_init(fd, speed, "dummy_udc", &device[0]);
	if (rv < 0) {
		return rv;
	}
	rv = usb_raw_run(fd);
	if (rv < 0) {
		return rv;
	}
	bool done = false;
	while (!done) {
		struct usb_raw_control_event event;
		event.inner.type = 0;
		event.inner.length = sizeof(event.ctrl);
		rv = usb_raw_event_fetch(fd, (struct usb_raw_event*)&event);
		if (rv < 0) {
			return rv;
		}
		if (event.inner.type != USB_RAW_EVENT_CONTROL)
			continue;
		char* response_data = NULL;
		uint32_t response_length = 0;
		struct usb_qualifier_descriptor qual;
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			if (!lookup_connect_response_in(fd, descs, &event.ctrl, &qual, &response_data, &response_length)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
		} else {
			if (!lookup_connect_response_out(fd, descs, &event.ctrl, &done)) {
				usb_raw_ep0_stall(fd);
				continue;
			}
			response_data = NULL;
			response_length = event.ctrl.wLength;
		}
		if ((event.ctrl.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
		    event.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
			rv = configure_device(fd);
			if (rv < 0) {
				return rv;
			}
		}
		struct usb_raw_ep_io_data response;
		response.inner.ep = 0;
		response.inner.flags = 0;
		if (response_length > sizeof(response.data))
			response_length = 0;
		if (event.ctrl.wLength < response_length)
			response_length = event.ctrl.wLength;
		response.inner.length = response_length;
		if (response_data)
			memcpy(&response.data[0], response_data, response_length);
		else
			memset(&response.data[0], 0, response_length);
		if (event.ctrl.bRequestType & USB_DIR_IN) {
			rv = usb_raw_ep0_write(fd, (struct usb_raw_ep_io*)&response);
		} else {
			rv = usb_raw_ep0_read(fd, (struct usb_raw_ep_io*)&response);
		}
		if (rv < 0) {
			return rv;
		}
	}
	sleep_ms(200);
	return fd;
}

static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3)
{
	uint64_t speed = a0;
	uint64_t dev_len = a1;
	const char* dev = (const char*)a2;
	const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
	return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic);
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  prlimit64 arguments: [
//    pid: pid (resource)
//    res: rlimit_type = 0xe (8 bytes)
//    new: ptr[in, rlimit] {
//      rlimit {
//        soft: intptr = 0x8 (8 bytes)
//        hard: intptr = 0x8b (8 bytes)
//      }
//    }
//    old: nil
//  ]
*(uint64_t*)0x200000000140 = 8;
*(uint64_t*)0x200000000148 = 0x8b;
	syscall(__NR_prlimit64, /*pid=*/0, /*res=RLIMIT_RTPRIO*/0xeul, /*new=*/0x200000000140ul, /*old=*/0ul);
//  sched_setscheduler arguments: [
//    pid: pid (resource)
//    policy: sched_policy = 0x2 (8 bytes)
//    prio: ptr[in, int32] {
//      int32 = 0x7 (4 bytes)
//    }
//  ]
*(uint32_t*)0x200000000340 = 7;
	syscall(__NR_sched_setscheduler, /*pid=*/0, /*policy=SCHED_RR*/2ul, /*prio=*/0x200000000340ul);
//  socket$nl_rdma arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x14 (4 bytes)
//  ]
//  returns sock_nl_rdma
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x14);
	if (res != -1)
		r[0] = res;
//  sendmsg$RDMA_NLDEV_CMD_NEWLINK arguments: [
//    fd: sock_nl_rdma (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]]] {
//      msghdr_netlink[netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]]] {
//          iovec[in, netlink_msg[RDMA_NLDEV_NEWLINK, void, nldev_policy$NEWLINK]] {
//            addr: ptr[inout, array[ANYUNION]] {
//              array[ANYUNION] {
//                union ANYUNION {
//                  ANYBLOB: buffer: {38 00 00 00 03 14 01 00 2a bd 70 00 fe db df 25 09 00 02 00 73 79 7a 30 00 00 00 00 08 00 41 00 72 78 65 00 14 00 33 00 62 6f 6e 64 30} (length 0x2d)
//                }
//              }
//            }
//            len: len = 0x38 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x4000840 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x24004000 (8 bytes)
//  ]
*(uint64_t*)0x2000000000c0 = 0;
*(uint32_t*)0x2000000000c8 = 0;
*(uint64_t*)0x2000000000d0 = 0x200000000080;
*(uint64_t*)0x200000000080 = 0x200000000040;
memcpy((void*)0x200000000040, "... [truncated large byte array] ...", 45);
*(uint64_t*)0x200000000088 = 0x38;
*(uint64_t*)0x2000000000d8 = 1;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint32_t*)0x2000000000f0 = 0x4000840;
	syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x2000000000c0ul, /*f=MSG_ZEROCOPY|MSG_FASTOPEN|MSG_NOSIGNAL*/0x24004000ul);
//  socket$nl_rdma arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x14 (4 bytes)
//  ]
//  returns sock_nl_rdma
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x14);
	if (res != -1)
		r[1] = res;
//  syz_usb_connect$hid arguments: [
//    speed: usb_device_speed = 0x0 (8 bytes)
//    dev_len: len = 0x36 (8 bytes)
//    dev: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//        union ANYUNION {
//          ANYBLOB: buffer: {} (length 0x0)
//        }
//      }
//    }
//    conn_descs: nil
//  ]
//  returns fd_usb_hid
syz_usb_connect(/*speed=*/0, /*dev_len=*/0x36, /*dev=*/0x200000000180, /*conn_descs=*/0);
//  write$RDMA_USER_CM_CMD_CREATE_ID arguments: [
//    fd: fd_rdma_cm (resource)
//    data: ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CREATE_ID, rdma_ucm_create_id]] {
//      rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CREATE_ID, rdma_ucm_create_id] {
//        cmd: const = 0x0 (4 bytes)
//        in: bytesize = 0x18 (2 bytes)
//        out: const = 0xfa00 (2 bytes)
//        msg: rdma_ucm_create_id {
//          uid: int64 = 0x2 (8 bytes)
//          response: nil
//          ps: rdma_port_space = 0x111 (2 bytes)
//          qp_type: ib_qp_type = 0x2 (1 bytes)
//          reserved: buffer: {00 00 00 00 00} (length 0x5)
//        }
//      }
//    }
//    len: bytesize = 0x20 (8 bytes)
//  ]
*(uint32_t*)0x200000000140 = 0;
*(uint16_t*)0x200000000144 = 0x18;
*(uint16_t*)0x200000000146 = 0xfa00;
*(uint64_t*)0x200000000148 = 2;
*(uint64_t*)0x200000000150 = 0;
*(uint16_t*)0x200000000158 = 0x111;
*(uint8_t*)0x20000000015a = 2;
memset((void*)0x20000000015b, 0, 5);
	syscall(__NR_write, /*fd=*/(intptr_t)-1, /*data=*/0x200000000140ul, /*len=*/0x20ul);
//  sendmsg$RDMA_NLDEV_CMD_PORT_GET arguments: [
//    fd: sock_nl_rdma (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]]] {
//      msghdr_netlink[netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]]] {
//          iovec[in, netlink_msg[RDMA_NLDEV_PORT_GET, void, nldev_policy$PORT_GET]] {
//            addr: ptr[inout, array[ANYUNION]] {
//              array[ANYUNION] {
//                union ANYUNION {
//                  ANYBLOB: buffer: {20 00 00 00 04 14 01 00 26 bd 70 00 ff db df 25 08 00 01 00 00 00 00 00 08 00} (length 0x1a)
//                }
//              }
//            }
//            len: len = 0x20 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x20048000 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x20000000 (8 bytes)
//  ]
*(uint64_t*)0x2000000002c0 = 0;
*(uint32_t*)0x2000000002c8 = 0;
*(uint64_t*)0x2000000002d0 = 0x200000000200;
*(uint64_t*)0x200000000200 = 0x200000000140;
memcpy((void*)0x200000000140, "\x20\x00\x00\x00\x04\x14\x01\x00\x26\xbd\x70\x00\xff\xdb\xdf\x25\x08\x00\x01\x00\x00\x00\x00\x00\x08\x00", 26);
*(uint64_t*)0x200000000208 = 0x20;
*(uint64_t*)0x2000000002d8 = 1;
*(uint64_t*)0x2000000002e0 = 0;
*(uint64_t*)0x2000000002e8 = 0;
*(uint32_t*)0x2000000002f0 = 0x20048000;
	syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x2000000002c0ul, /*f=MSG_FASTOPEN*/0x20000000ul);
//  bpf$PROG_LOAD arguments: [
//    cmd: const = 0x5 (8 bytes)
//    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
//      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]] {
//        type: bpf_prog_type = 0x1d (4 bytes)
//        ninsn: bytesize8 = 0x0 (4 bytes)
//        insns: nil
//        license: ptr[in, buffer] {
//          buffer: {47 50 4c 00} (length 0x4)
//        }
//        loglev: int32 = 0x5 (4 bytes)
//        logsize: len = 0x0 (4 bytes)
//        log: nil
//        kern_version: bpf_kern_version = 0x0 (4 bytes)
//        flags: bpf_prog_load_flags = 0x42 (4 bytes)
//        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//        prog_ifindex: ifindex (resource)
//        expected_attach_type: union bpf_prog_attach_types {
//          fallback: bpf_attach_types = 0x0 (4 bytes)
//        }
//        btf_fd: fd_btf (resource)
//        func_info_rec_size: const = 0x6 (4 bytes)
//        func_info: nil
//        func_info_cnt: len = 0x0 (4 bytes)
//        line_info_rec_size: const = 0x10 (4 bytes)
//        line_info: nil
//        line_info_cnt: len = 0x0 (4 bytes)
//        attach_btf_id: bpf_btf_id (resource)
//        attach_prog_fd: fd_bpf_prog (resource)
//        core_relo_cnt: len = 0x0 (4 bytes)
//        fd_array: nil
//        core_relos: nil
//        core_relo_rec_size: const = 0x10 (4 bytes)
//        log_true_size: int32 = 0x0 (4 bytes)
//        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_prog_token_fd_wrapper {
//          void: buffer: {} (length 0x0)
//        }
//        pad: union _bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]_pad_wrapper {
//          value: const = 0x0 (4 bytes)
//        }
//      }
//    }
//    size: len = 0x94 (8 bytes)
//  ]
//  returns fd_bpf_prog
*(uint32_t*)0x200000000a00 = 0x1d;
*(uint32_t*)0x200000000a04 = 0;
*(uint64_t*)0x200000000a08 = 0;
*(uint64_t*)0x200000000a10 = 0x200000000080;
memcpy((void*)0x200000000080, "GPL\000", 4);
*(uint32_t*)0x200000000a18 = 5;
*(uint32_t*)0x200000000a1c = 0;
*(uint64_t*)0x200000000a20 = 0;
*(uint32_t*)0x200000000a28 = 0;
*(uint32_t*)0x200000000a2c = 0x42;
memset((void*)0x200000000a30, 0, 16);
*(uint32_t*)0x200000000a40 = 0;
*(uint32_t*)0x200000000a44 = 0;
*(uint32_t*)0x200000000a48 = -1;
*(uint32_t*)0x200000000a4c = 6;
*(uint64_t*)0x200000000a50 = 0;
*(uint32_t*)0x200000000a58 = 0;
*(uint32_t*)0x200000000a5c = 0x10;
*(uint64_t*)0x200000000a60 = 0;
*(uint32_t*)0x200000000a68 = 0;
*(uint32_t*)0x200000000a6c = -1;
*(uint32_t*)0x200000000a70 = -1;
*(uint32_t*)0x200000000a74 = 0;
*(uint64_t*)0x200000000a78 = 0;
*(uint64_t*)0x200000000a80 = 0;
*(uint32_t*)0x200000000a88 = 0x10;
*(uint32_t*)0x200000000a8c = 0;
*(uint32_t*)0x200000000a90 = 0;
	syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000a00ul, /*size=*/0x94ul);
	return 0;
}

The bug report indicates a `WARN_ON(!xa_empty(&pool->xa))` in `rxe_pool_cleanup` for the `pd_pool` (Protection Domain pool). This warning is triggered during `rxe_dealloc` (called via `ib_unregister_device`), meaning that a Protection Domain (PD) was not properly deallocated before the RDMA device was unregistered and destroyed.

### Root Cause & Exploitation
The root cause is a race condition in the `rds` (Reliable Datagram Sockets) RDMA client. 
When an RDMA device is registered, `rds_ib_add_one` allocates a PD (`ib_alloc_pd`). When the device is unregistered, `rds_ib_remove_one` is called to clean up. However, `rds_ib_remove_one` defers the actual cleanup (including `ib_dealloc_pd`) to a workqueue (`rds_ib_dev_free` on `rds_wq`) and returns immediately without waiting for the work to complete.

The RDMA core (`disable_device`) waits for the device's refcount to reach 0 before freeing it. Since `rds_ib_add_one` does not hold a reference to the `ib_device`, the refcount drops to 0, and `ib_dealloc_device` proceeds to free the `ib_device` structure (via `kfree_rcu`).

Later, when the deferred `rds_ib_dev_free` work executes, it calls `ib_dealloc_pd(rds_ibdev->pd)`. This function accesses `pd->device->ops.dealloc_pd`. Since `pd->device` (the `ib_device`) has already been freed, this results in a **Use-After-Free (UAF)**. Because it involves an indirect function call (`->ops.dealloc_pd`) from a freed structure, it is highly exploitable for arbitrary code execution and privilege escalation.

### Trigger Vectors
- **Unprivileged / User Namespaces:** Triggering the software RDMA device creation/deletion (via `RDMA_NLDEV_CMD_NEWLINK` and `RDMA_NLDEV_CMD_DELLINK` netlink commands) requires `CAP_NET_ADMIN` in the **initial** user namespace (`init_user_ns`). Therefore, it cannot be triggered by unprivileged users or from within user namespaces.
- **Peripheral Trigger:** The bug can be triggered by physically hotplugging and then unplugging a PCIe RDMA device (e.g., via Thunderbolt). The kernel will automatically probe the device, register it with the RDMA core (triggering `rds_ib_add_one`), and upon unplug, unregister it (triggering the UAF race condition).

gemini-3.1-pro-preview

							input: 17361
							output: 53
							thoughts: 634
						

**Analyzing a Syzkaller Bug Report**

Okay, so I've got this syzkaller report, and the title points to a USB Raw Gadget issue – something about not finding an available UDC or it being busy. But, digging deeper, the actual problem, the meat of it, is a warning within `rxe_pool_cleanup`. It's a bit misleading at first glance. Let's trace this back to what's going on.

The stack trace gives us a clear path: `rxe_dealloc` calls `ib_dealloc_device`, which eventually leads to `__ib_unregister_device` and then `nldev_dellink`. That's where it looks like the device is being unregistered, all the way to a netlink message. The warning in `rxe_pool_cleanup` is triggered within the deallocation process, likely during resource cleanup related to the RXE (RDMA over Ethernet) pool. Time to check that source code; I need to see *why* that warning is being triggered, specifically at line 116 in `rxe_pool.c`. I have a feeling this will involve some form of contention or a race condition related to RXE resource deallocation.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_pool.c IncludeLines:true Name:rxe_pool_cleanup]

map[SourceCode: 114:	void rxe_pool_cleanup(struct rxe_pool *pool)
 115:	{
 116:		WARN_ON(!xa_empty(&pool->xa));
 117:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_pool.c]

gemini-3.1-pro-preview

							input: 18410
							output: 50
							thoughts: 95
						

**Investigating a Potential Resource Leak in the RXE Driver**

Okay, so I'm seeing this warning: `WARN_ON(!xa_empty(&pool->xa))`. That's a red flag. It's telling me that when the resource pool is supposed to be cleaned up, there are still entries left in the xarray. That screams either a resource leak or, more likely, a problem with refcounting. Someone isn't decrementing a reference count properly, or something is holding onto a reference unexpectedly. The context here is the `rxe_dev` structure, and the warning seems to be associated with a resource pool used by the RXE driver.

My gut reaction is to immediately look at the deallocation path for `rxe_dev`, so let's check `rxe_dealloc` specifically, starting at `drivers/infiniband/sw/rxe/rxe.c:24`. I need to understand exactly how this pool is being initialized, used, and, critically, deallocated. I'll be looking for where these pool entries are added, where they are removed, and the exact sequence of events during shutdown. The xarray itself is the critical piece here, and I need to see how its lifecycle aligns with the RXE device and the pool management. I'm suspecting a classic missed unmap, or a race condition where cleanup is attempted prematurely. Time to dive into the code!

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeLines:true Name:rxe_dealloc]

map[SourceCode:  16:	/* free resources for a rxe device all objects created for this device must
  17:	 * have been destroyed
  18:	 */
  19:	void rxe_dealloc(struct ib_device *ib_dev)
  20:	{
  21:		struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev);
  22:	
  23:		rxe_pool_cleanup(&rxe->uc_pool);
  24:		rxe_pool_cleanup(&rxe->pd_pool);
  25:		rxe_pool_cleanup(&rxe->ah_pool);
  26:		rxe_pool_cleanup(&rxe->srq_pool);
  27:		rxe_pool_cleanup(&rxe->qp_pool);
  28:		rxe_pool_cleanup(&rxe->cq_pool);
  29:		rxe_pool_cleanup(&rxe->mr_pool);
  30:		rxe_pool_cleanup(&rxe->mw_pool);
  31:	
  32:		WARN_ON(!RB_EMPTY_ROOT(&rxe->mcg_tree));
  33:	
  34:		mutex_destroy(&rxe->usdev_lock);
  35:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe.c]

gemini-3.1-pro-preview

							input: 19225
							output: 52
							thoughts: 580
						

**Debugging an RXE Protection Domain Pool Issue**

Okay, so I'm looking at this warning on line 24 of `rxe.c`: `rxe_pool_cleanup(&rxe->pd_pool)`. The stack trace says the error is in `rxe_dealloc`, specifically the protection domain pool, `pd_pool`.  Let's see what's creating and destroying these protection domains, as this seems to be the core issue.

The reproducer's sequence starts with creating a netlink socket for RDMA, then using `sendmsg(RDMA_NLDEV_CMD_NEWLINK)` to bring up an `rxe` device named `syz0` on `bond0`. Then, there's a failed write to fd=-1, which seems like a red herring. Then, it uses `sendmsg(RDMA_NLDEV_CMD_PORT_GET)`.  

Wait, so it creates an rxe device and then... destroys it? But where's the explicit delete?  Ah, the stack trace mentions `nldev_dellink`. I bet the reproducer's implicit delete comes from the process exit or maybe the destruction of the bond0 device, which cascades into the rxe device removal. The net namespace destruction seems like the most likely trigger. It starts by creating an RXE device with `RDMA_NLDEV_CMD_NEWLINK`, and then gets information with `RDMA_NLDEV_CMD_PORT_GET` after it exits, but why the cleanup warning?

Since `rxe_dealloc` is being called and the `pd_pool` is not empty, this is a leak or something is preventing clean up.  I need to dig into the `rxe` code and see if it creates a default protection domain, or if there's an actual leak happening.

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeSnippetLines:0 Name:rxe_alloc_pd]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 20269
							output: 17
							thoughts: 12
						

Okay, here's my summarized thought process, presented as if I'm thinking it:

**Digging into `pd_pool` Usage**

Alright, time to get to work. First, I need to understand how `pd_pool` is being used. I need to be thorough here, I want to find every instance. Let's start with a broad search, a query that's going to catch all the direct references. This is a common pattern, I'll need to use that initial search to help direct the next one.

map[Expression:pd_pool]

map[Output:drivers/atm/he.c=970=static int he_start(struct atm_dev *dev)
--
drivers/atm/he.c-1422-
drivers/atm/he.c:1423:	he_dev->tpd_pool = dma_pool_create("tpd", &he_dev->pci_dev->dev,
drivers/atm/he.c-1424-					   sizeof(struct he_tpd), TPD_ALIGNMENT, 0);
drivers/atm/he.c:1425:	if (he_dev->tpd_pool == NULL) {
drivers/atm/he.c-1426-		hprintk("unable to create tpd dma_pool\n");
--
drivers/atm/he.c=1524=he_stop(struct he_dev *he_dev)
--
drivers/atm/he.c-1592-
drivers/atm/he.c:1593:	dma_pool_destroy(he_dev->tpd_pool);
drivers/atm/he.c-1594-
--
drivers/atm/he.c=1606=__alloc_tpd(struct he_dev *he_dev)
--
drivers/atm/he.c-1610-
drivers/atm/he.c:1611:	tpd = dma_pool_alloc(he_dev->tpd_pool, GFP_ATOMIC, &mapping);
drivers/atm/he.c-1612-	if (tpd == NULL)
--
drivers/atm/he.c=1799=he_service_tbrq(struct he_dev *he_dev, int group)
--
drivers/atm/he.c-1861-		if (tpd)
drivers/atm/he.c:1862:			dma_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
drivers/atm/he.c-1863-		he_dev->tbrq_head = (struct he_tbrq *)
--
drivers/atm/he.c=2050=__enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
--
drivers/atm/he.c-2096-			}
drivers/atm/he.c:2097:			dma_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
drivers/atm/he.c-2098-			return;
--
drivers/atm/he.h=252=struct he_dev {
--
drivers/atm/he.h-283-	struct tasklet_struct tasklet;
drivers/atm/he.h:284:	struct dma_pool *tpd_pool;
drivers/atm/he.h-285-	struct list_head outstanding_tpds;
--
drivers/infiniband/hw/ocrdma/ocrdma_hw.c=1560=static void ocrdma_mbx_dealloc_pd_range(struct ocrdma_dev *dev)
--
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-1590-
drivers/infiniband/hw/ocrdma/ocrdma_hw.c:1591:void ocrdma_alloc_pd_pool(struct ocrdma_dev *dev)
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-1592-{
--
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-1606-
drivers/infiniband/hw/ocrdma/ocrdma_hw.c:1607:static void ocrdma_free_pd_pool(struct ocrdma_dev *dev)
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-1608-{
--
drivers/infiniband/hw/ocrdma/ocrdma_hw.c=3230=void ocrdma_cleanup_hw(struct ocrdma_dev *dev)
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-3231-{
drivers/infiniband/hw/ocrdma/ocrdma_hw.c:3232:	ocrdma_free_pd_pool(dev);
drivers/infiniband/hw/ocrdma/ocrdma_hw.c-3233-	ocrdma_mbx_delete_ah_tbl(dev);
--
drivers/infiniband/hw/ocrdma/ocrdma_hw.h=154=void ocrdma_init_service_level(struct ocrdma_dev *);
drivers/infiniband/hw/ocrdma/ocrdma_hw.h:155:void ocrdma_alloc_pd_pool(struct ocrdma_dev *dev);
drivers/infiniband/hw/ocrdma/ocrdma_hw.h-156-void ocrdma_free_pd_range(struct ocrdma_dev *dev);
--
drivers/infiniband/hw/ocrdma/ocrdma_main.c=219=static int ocrdma_alloc_resources(struct ocrdma_dev *dev)
--
drivers/infiniband/hw/ocrdma/ocrdma_main.c-238-
drivers/infiniband/hw/ocrdma/ocrdma_main.c:239:	ocrdma_alloc_pd_pool(dev);
drivers/infiniband/hw/ocrdma/ocrdma_main.c-240-
--
drivers/infiniband/sw/rxe/rxe.c=19=void rxe_dealloc(struct ib_device *ib_dev)
--
drivers/infiniband/sw/rxe/rxe.c-23-	rxe_pool_cleanup(&rxe->uc_pool);
drivers/infiniband/sw/rxe/rxe.c:24:	rxe_pool_cleanup(&rxe->pd_pool);
drivers/infiniband/sw/rxe/rxe.c-25-	rxe_pool_cleanup(&rxe->ah_pool);
--
drivers/infiniband/sw/rxe/rxe.c=156=static void rxe_init_pools(struct rxe_dev *rxe)
--
drivers/infiniband/sw/rxe/rxe.c-158-	rxe_pool_init(rxe, &rxe->uc_pool, RXE_TYPE_UC);
drivers/infiniband/sw/rxe/rxe.c:159:	rxe_pool_init(rxe, &rxe->pd_pool, RXE_TYPE_PD);
drivers/infiniband/sw/rxe/rxe.c-160-	rxe_pool_init(rxe, &rxe->ah_pool, RXE_TYPE_AH);
--
drivers/infiniband/sw/rxe/rxe_verbs.c=250=static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-255-
drivers/infiniband/sw/rxe/rxe_verbs.c:256:	err = rxe_add_to_pool(&rxe->pd_pool, pd);
drivers/infiniband/sw/rxe/rxe_verbs.c-257-	if (err) {
--
drivers/infiniband/sw/rxe/rxe_verbs.h=411=struct rxe_dev {
--
drivers/infiniband/sw/rxe/rxe_verbs.h-420-	struct rxe_pool		uc_pool;
drivers/infiniband/sw/rxe/rxe_verbs.h:421:	struct rxe_pool		pd_pool;
drivers/infiniband/sw/rxe/rxe_verbs.h-422-	struct rxe_pool		ah_pool;
--
drivers/scsi/lpfc/lpfc.h=839=struct lpfc_mbox_ext_buf_ctx {
--
drivers/scsi/lpfc/lpfc.h-854-
drivers/scsi/lpfc/lpfc.h:855:struct lpfc_epd_pool {
drivers/scsi/lpfc/lpfc.h-856-	/* Expedite pool */
--
drivers/scsi/lpfc/lpfc.h=914=struct lpfc_hba {
--
drivers/scsi/lpfc/lpfc.h-998-	/* expedite pool */
drivers/scsi/lpfc/lpfc.h:999:	struct lpfc_epd_pool epd_pool;
drivers/scsi/lpfc/lpfc.h-1000-
--
drivers/scsi/lpfc/lpfc_init.c=3449=static void lpfc_create_expedite_pool(struct lpfc_hba *phba)
--
drivers/scsi/lpfc/lpfc_init.c-3453-	struct lpfc_io_buf *lpfc_ncmd_next;
drivers/scsi/lpfc/lpfc_init.c:3454:	struct lpfc_epd_pool *epd_pool;
drivers/scsi/lpfc/lpfc_init.c-3455-	unsigned long iflag;
drivers/scsi/lpfc/lpfc_init.c-3456-
drivers/scsi/lpfc/lpfc_init.c:3457:	epd_pool = &phba->epd_pool;
drivers/scsi/lpfc/lpfc_init.c-3458-	qp = &phba->sli4_hba.hdwq[0];
drivers/scsi/lpfc/lpfc_init.c-3459-
drivers/scsi/lpfc/lpfc_init.c:3460:	spin_lock_init(&epd_pool->lock);
drivers/scsi/lpfc/lpfc_init.c-3461-	spin_lock_irqsave(&qp->io_buf_list_put_lock, iflag);
drivers/scsi/lpfc/lpfc_init.c:3462:	spin_lock(&epd_pool->lock);
drivers/scsi/lpfc/lpfc_init.c:3463:	INIT_LIST_HEAD(&epd_pool->list);
drivers/scsi/lpfc/lpfc_init.c-3464-	list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
drivers/scsi/lpfc/lpfc_init.c-3465-				 &qp->lpfc_io_buf_list_put, list) {
drivers/scsi/lpfc/lpfc_init.c:3466:		list_move_tail(&lpfc_ncmd->list, &epd_pool->list);
drivers/scsi/lpfc/lpfc_init.c-3467-		lpfc_ncmd->expedite = true;
drivers/scsi/lpfc/lpfc_init.c-3468-		qp->put_io_bufs--;
drivers/scsi/lpfc/lpfc_init.c:3469:		epd_pool->count++;
drivers/scsi/lpfc/lpfc_init.c:3470:		if (epd_pool->count >= XRI_BATCH)
drivers/scsi/lpfc/lpfc_init.c-3471-			break;
drivers/scsi/lpfc/lpfc_init.c-3472-	}
drivers/scsi/lpfc/lpfc_init.c:3473:	spin_unlock(&epd_pool->lock);
drivers/scsi/lpfc/lpfc_init.c-3474-	spin_unlock_irqrestore(&qp->io_buf_list_put_lock, iflag);
--
drivers/scsi/lpfc/lpfc_init.c=3484=static void lpfc_destroy_expedite_pool(struct lpfc_hba *phba)
--
drivers/scsi/lpfc/lpfc_init.c-3488-	struct lpfc_io_buf *lpfc_ncmd_next;
drivers/scsi/lpfc/lpfc_init.c:3489:	struct lpfc_epd_pool *epd_pool;
drivers/scsi/lpfc/lpfc_init.c-3490-	unsigned long iflag;
drivers/scsi/lpfc/lpfc_init.c-3491-
drivers/scsi/lpfc/lpfc_init.c:3492:	epd_pool = &phba->epd_pool;
drivers/scsi/lpfc/lpfc_init.c-3493-	qp = &phba->sli4_hba.hdwq[0];
--
drivers/scsi/lpfc/lpfc_init.c-3495-	spin_lock_irqsave(&qp->io_buf_list_put_lock, iflag);
drivers/scsi/lpfc/lpfc_init.c:3496:	spin_lock(&epd_pool->lock);
drivers/scsi/lpfc/lpfc_init.c-3497-	list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
drivers/scsi/lpfc/lpfc_init.c:3498:				 &epd_pool->list, list) {
drivers/scsi/lpfc/lpfc_init.c-3499-		list_move_tail(&lpfc_ncmd->list,
--
drivers/scsi/lpfc/lpfc_init.c-3502-		qp->put_io_bufs++;
drivers/scsi/lpfc/lpfc_init.c:3503:		epd_pool->count--;
drivers/scsi/lpfc/lpfc_init.c-3504-	}
drivers/scsi/lpfc/lpfc_init.c:3505:	spin_unlock(&epd_pool->lock);
drivers/scsi/lpfc/lpfc_init.c-3506-	spin_unlock_irqrestore(&qp->io_buf_list_put_lock, iflag);
--
drivers/scsi/lpfc/lpfc_sli.c=21946=void lpfc_release_io_buf(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_ncmd,
--
drivers/scsi/lpfc/lpfc_sli.c-21951-	struct lpfc_pvt_pool *pvt_pool;
drivers/scsi/lpfc/lpfc_sli.c:21952:	struct lpfc_epd_pool *epd_pool;
drivers/scsi/lpfc/lpfc_sli.c-21953-	u32 txcmplq_cnt;
--
drivers/scsi/lpfc/lpfc_sli.c-21971-			/* Return to expedite pool */
drivers/scsi/lpfc/lpfc_sli.c:21972:			epd_pool = &phba->epd_pool;
drivers/scsi/lpfc/lpfc_sli.c:21973:			spin_lock_irqsave(&epd_pool->lock, iflag);
drivers/scsi/lpfc/lpfc_sli.c:21974:			list_add_tail(&lpfc_ncmd->list, &epd_pool->list);
drivers/scsi/lpfc/lpfc_sli.c:21975:			epd_pool->count++;
drivers/scsi/lpfc/lpfc_sli.c:21976:			spin_unlock_irqrestore(&epd_pool->lock, iflag);
drivers/scsi/lpfc/lpfc_sli.c-21977-			return;
--
drivers/scsi/lpfc/lpfc_sli.c=22085=lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba)
--
drivers/scsi/lpfc/lpfc_sli.c-22089-	unsigned long iflag;
drivers/scsi/lpfc/lpfc_sli.c:22090:	struct lpfc_epd_pool *epd_pool;
drivers/scsi/lpfc/lpfc_sli.c-22091-
drivers/scsi/lpfc/lpfc_sli.c:22092:	epd_pool = &phba->epd_pool;
drivers/scsi/lpfc/lpfc_sli.c-22093-
drivers/scsi/lpfc/lpfc_sli.c:22094:	spin_lock_irqsave(&epd_pool->lock, iflag);
drivers/scsi/lpfc/lpfc_sli.c:22095:	if (epd_pool->count > 0) {
drivers/scsi/lpfc/lpfc_sli.c-22096-		list_for_each_entry_safe(iter, lpfc_ncmd_next,
drivers/scsi/lpfc/lpfc_sli.c:22097:					 &epd_pool->list, list) {
drivers/scsi/lpfc/lpfc_sli.c-22098-			list_del(&iter->list);
drivers/scsi/lpfc/lpfc_sli.c:22099:			epd_pool->count--;
drivers/scsi/lpfc/lpfc_sli.c-22100-			lpfc_ncmd = iter;
--
drivers/scsi/lpfc/lpfc_sli.c-22103-	}
drivers/scsi/lpfc/lpfc_sli.c:22104:	spin_unlock_irqrestore(&epd_pool->lock, iflag);
drivers/scsi/lpfc/lpfc_sli.c-22105-
--
drivers/usb/mtu3/mtu3.h=331=struct mtu3 {
--
drivers/usb/mtu3/mtu3.h-349-
drivers/usb/mtu3/mtu3.h:350:	struct dma_pool	*qmu_gpd_pool;
drivers/usb/mtu3/mtu3.h-351-	enum mtu3_g_ep0_state ep0_state;
--
drivers/usb/mtu3/mtu3_qmu.c=165=int mtu3_gpd_ring_alloc(struct mtu3_ep *mep)
--
drivers/usb/mtu3/mtu3_qmu.c-170-	/* software own all gpds as default */
drivers/usb/mtu3/mtu3_qmu.c:171:	gpd = dma_pool_zalloc(mep->mtu->qmu_gpd_pool, GFP_ATOMIC, &ring->dma);
drivers/usb/mtu3/mtu3_qmu.c-172-	if (gpd == NULL)
--
drivers/usb/mtu3/mtu3_qmu.c=180=void mtu3_gpd_ring_free(struct mtu3_ep *mep)
--
drivers/usb/mtu3/mtu3_qmu.c-183-
drivers/usb/mtu3/mtu3_qmu.c:184:	dma_pool_free(mep->mtu->qmu_gpd_pool,
drivers/usb/mtu3/mtu3_qmu.c-185-			ring->start, ring->dma);
--
drivers/usb/mtu3/mtu3_qmu.c=669=int mtu3_qmu_init(struct mtu3 *mtu)
--
drivers/usb/mtu3/mtu3_qmu.c-673-
drivers/usb/mtu3/mtu3_qmu.c:674:	mtu->qmu_gpd_pool = dma_pool_create("QMU_GPD", mtu->dev,
drivers/usb/mtu3/mtu3_qmu.c-675-			QMU_GPD_RING_SIZE, QMU_GPD_SIZE, 0);
drivers/usb/mtu3/mtu3_qmu.c-676-
drivers/usb/mtu3/mtu3_qmu.c:677:	if (!mtu->qmu_gpd_pool)
drivers/usb/mtu3/mtu3_qmu.c-678-		return -ENOMEM;
--
drivers/usb/mtu3/mtu3_qmu.c=683=void mtu3_qmu_exit(struct mtu3 *mtu)
drivers/usb/mtu3/mtu3_qmu.c-684-{
drivers/usb/mtu3/mtu3_qmu.c:685:	dma_pool_destroy(mtu->qmu_gpd_pool);
drivers/usb/mtu3/mtu3_qmu.c-686-}
]

gemini-3.1-pro-preview

							input: 25836
							output: 54
							thoughts: 47
						

Here's my thought process, summarized as if I were considering the situation:

**Investigating the `rxe_alloc_pd` function**

Okay, so `rxe_alloc_pd`... right, it's located in `drivers/infiniband/sw/rxe/rxe_verbs.c`. That's good to know, confirming my recollection. Now, the more important question is: what actually *uses* this function? I need to understand the call graph to see how and why this particular memory allocation is happening within the RXE stack. Time to track down all the calls to `rxe_alloc_pd` and analyze the context of each usage. That's the key to understanding its purpose and potential impact.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_verbs.c IncludeSnippetLines:0 Name:rxe_alloc_pd]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 26114
							output: 53
							thoughts: 44
						

Here's my summary, as though I'm thinking through this process:

**Diving into the RDMA Codebase**

Okay, so `rxe_alloc_pd`. My intuition tells me that's a callback within the `ib_device_ops` structure. I need to confirm that. Right, so I'll check `rxe_verbs.c` in the RDMA code. I'll need to confirm that `rxe_alloc_pd` is indeed the function I'm thinking of, and specifically, what its implementation reveals about how it handles memory region allocation. I'm hoping I can get a clearer understanding of how the `rxe` driver manages protection domains. Let's see what the implementation details can teach us. This will tell me what the driver is doing at a fundamental level in terms of memory management, which, of course, is key for any RDMA implementation.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_verbs.c IncludeLines:true Name:rxe_alloc_pd]

map[SourceCode: 249:	/* pd */
 250:	static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 251:	{
 252:		struct rxe_dev *rxe = to_rdev(ibpd->device);
 253:		struct rxe_pd *pd = to_rpd(ibpd);
 254:		int err;
 255:	
 256:		err = rxe_add_to_pool(&rxe->pd_pool, pd);
 257:		if (err) {
 258:			rxe_dbg_dev(rxe, "unable to alloc pd\n");
 259:			goto err_out;
 260:		}
 261:	
 262:		return 0;
 263:	
 264:	err_out:
 265:		rxe_err_dev(rxe, "returned err = %d\n", err);
 266:		return err;
 267:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 26728
							output: 54
							thoughts: 44
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**PD Pool Management: A Quick Review**

Alright, let's see, `rxe_alloc_pd` is clearly the function responsible for adding Protection Domains (PDs) to that pool. No surprises there. But, I need to make absolutely certain I haven't missed a potential entry point for these things. Are there any *other* locations, functions, or scenarios where a PD might get introduced into the pool? It's crucial for the integrity of the pool's state. I need to be thorough.

And what about the counterpart? `rxe_dealloc_pd`… that, logically, *should* be the removal function. It's the expected inverse operation. But again, I need to mentally check. Does it only *remove* or could there be more to it? Does the deallocation process guarantee that the domain is truly gone? I need to know the allocation/deallocation pair works as expected. A quick review is definitely in order, just to keep everything straight.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_verbs.c IncludeLines:true Name:rxe_dealloc_pd]

map[SourceCode: 269:	static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 270:	{
 271:		struct rxe_pd *pd = to_rpd(ibpd);
 272:		int err;
 273:	
 274:		err = rxe_cleanup(pd);
 275:		if (err)
 276:			rxe_err_pd(pd, "cleanup failed, err = %d\n", err);
 277:	
 278:		return 0;
 279:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 27263
							output: 51
							thoughts: 214
						

**Analyzing the `rxe_cleanup` Function's Role in a Reproducer**

Okay, so I'm looking at this `rxe_cleanup` function and it's either dropping a refcount or removing something from the pool. That's the key. Now, what triggers this? Let me think... When does a "PD" (Protection Domain, right?) get allocated in the first place? Ah, `rxe_alloc_pd`! The reproducer code calls `rxe_alloc_pd`, which means a Protection Domain must be getting allocated.

The question is, who is responsible for allocating this Protection Domain? I need to trace back from that. The reproducer itself does it: it's doing a `write$RDMA_USER_CM_CMD_CREATE_ID` to `fd_rdma_cm`. Wait, but the file descriptor, `fd`, is -1. That's a fail condition right there! So, that's not the problem.

Alright, what else is the reproducer doing? It calls `sendmsg(RDMA_NLDEV_CMD_NEWLINK)`. That creates the device, right? It then does `syz_usb_connect`. Then, a `sendmsg(RDMA_NLDEV_CMD_PORT_GET)`. And then a `bpf$PROG_LOAD`. Hmm, none of these explicitly allocate a PD. This is where it gets interesting... could `RDMA_NLDEV_CMD_NEWLINK` be allocating a PD internally? It's the only real candidate among these operations. I'd better dig into `rxe_register_device` to verify that assumption.

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeLines:true Name:rxe_register_device]

map[SourceCode:1533:	int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name,
1534:							struct net_device *ndev)
1535:	{
1536:		int err;
1537:		struct ib_device *dev = &rxe->ib_dev;
1538:	
1539:		strscpy(dev->node_desc, "rxe", sizeof(dev->node_desc));
1540:	
1541:		dev->node_type = RDMA_NODE_IB_CA;
1542:		dev->phys_port_cnt = 1;
1543:		dev->num_comp_vectors = num_possible_cpus();
1544:		dev->local_dma_lkey = 0;
1545:		addrconf_addr_eui48((unsigned char *)&dev->node_guid,
1546:				    rxe->raw_gid);
1547:	
1548:		dev->uverbs_cmd_mask |= BIT_ULL(IB_USER_VERBS_CMD_POST_SEND) |
1549:					BIT_ULL(IB_USER_VERBS_CMD_REQ_NOTIFY_CQ);
1550:	
1551:		ib_set_device_ops(dev, &rxe_dev_ops);
1552:		err = ib_device_set_netdev(&rxe->ib_dev, ndev, 1);
1553:		if (err)
1554:			return err;
1555:	
1556:		err = ib_register_device(dev, ibdev_name, NULL);
1557:		if (err)
1558:			rxe_dbg_dev(rxe, "failed with error %d\n", err);
1559:	
1560:		/*
1561:		 * Note that rxe may be invalid at this point if another thread
1562:		 * unregistered it.
1563:		 */
1564:		return err;
1565:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 28474
							output: 46
							thoughts: 45
						

Okay, let's break this down.

**Investigating the Device Registration Process in RDMA**

Hmm, so `rxe_register_device`... that's definitely hanging out in `rxe_verbs.c`, which makes sense. I'm trying to trace the device registration flow in this RDMA implementation. Now, the next logical question is, does `ib_register_device` – which I assume is the underlying function being called – handle the allocation of a Protection Domain (PD)? That's a critical part of device setup, obviously. So, my next move is clear: I need to dive into the `ib_register_device` function itself. I'll need to confirm if it's responsible for the PD allocation. Understanding that will provide valuable insight to the device registration implementation.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:ib_register_device]

map[SourceCode:1415:	/**
1416:	 * ib_register_device - Register an IB device with IB core
1417:	 * @device: Device to register
1418:	 * @name: unique string device name. This may include a '%' which will
1419:	 * 	  cause a unique index to be added to the passed device name.
1420:	 * @dma_device: pointer to a DMA-capable device. If %NULL, then the IB
1421:	 *	        device will be used. In this case the caller should fully
1422:	 *		setup the ibdev for DMA. This usually means using dma_virt_ops.
1423:	 *
1424:	 * Low-level drivers use ib_register_device() to register their
1425:	 * devices with the IB core.  All registered clients will receive a
1426:	 * callback for each device that is added. @device must be allocated
1427:	 * with ib_alloc_device().
1428:	 *
1429:	 * If the driver uses ops.dealloc_driver and calls any ib_unregister_device()
1430:	 * asynchronously then the device pointer may become freed as soon as this
1431:	 * function returns.
1432:	 */
1433:	int ib_register_device(struct ib_device *device, const char *name,
1434:			       struct device *dma_device)
1435:	{
1436:		int ret;
1437:	
1438:		ret = assign_name(device, name);
1439:		if (ret)
1440:			return ret;
1441:	
1442:		/*
1443:		 * If the caller does not provide a DMA capable device then the IB core
1444:		 * will set up ib_sge and scatterlist structures that stash the kernel
1445:		 * virtual address into the address field.
1446:		 */
1447:		WARN_ON(dma_device && !dma_device->dma_parms);
1448:		device->dma_device = dma_device;
1449:	
1450:		ret = setup_device(device);
1451:		if (ret)
1452:			return ret;
1453:	
1454:		ret = ib_cache_setup_one(device);
1455:		if (ret) {
1456:			dev_warn(&device->dev,
1457:				 "Couldn't set up InfiniBand P_Key/GID cache\n");
1458:			return ret;
1459:		}
1460:	
1461:		device->groups[0] = &ib_dev_attr_group;
1462:		device->groups[1] = device->ops.device_group;
1463:		ret = ib_setup_device_attrs(device);
1464:		if (ret)
1465:			goto cache_cleanup;
1466:	
1467:		ib_device_register_rdmacg(device);
1468:	
1469:		rdma_counter_init(device);
1470:	
1471:		/*
1472:		 * Ensure that ADD uevent is not fired because it
1473:		 * is too early amd device is not initialized yet.
1474:		 */
1475:		dev_set_uevent_suppress(&device->dev, true);
1476:		ret = device_add(&device->dev);
1477:		if (ret)
1478:			goto cg_cleanup;
1479:	
1480:		ret = ib_setup_port_attrs(&device->coredev);
1481:		if (ret) {
1482:			dev_warn(&device->dev,
1483:				 "Couldn't register device with driver model\n");
1484:			goto dev_cleanup;
1485:		}
1486:	
1487:		ret = enable_device_and_get(device);
1488:		if (ret) {
1489:			void (*dealloc_fn)(struct ib_device *);
1490:	
1491:			/*
1492:			 * If we hit this error flow then we don't want to
1493:			 * automatically dealloc the device since the caller is
1494:			 * expected to call ib_dealloc_device() after
1495:			 * ib_register_device() fails. This is tricky due to the
1496:			 * possibility for a parallel unregistration along with this
1497:			 * error flow. Since we have a refcount here we know any
1498:			 * parallel flow is stopped in disable_device and will see the
1499:			 * special dealloc_driver pointer, causing the responsibility to
1500:			 * ib_dealloc_device() to revert back to this thread.
1501:			 */
1502:			dealloc_fn = device->ops.dealloc_driver;
1503:			device->ops.dealloc_driver = prevent_dealloc_device;
1504:			ib_device_put(device);
1505:			__ib_unregister_device(device);
1506:			device->ops.dealloc_driver = dealloc_fn;
1507:			dev_set_uevent_suppress(&device->dev, false);
1508:			return ret;
1509:		}
1510:		dev_set_uevent_suppress(&device->dev, false);
1511:	
1512:		ib_device_notify_register(device);
1513:	
1514:		ib_device_put(device);
1515:	
1516:		return 0;
1517:	
1518:	dev_cleanup:
1519:		device_del(&device->dev);
1520:	cg_cleanup:
1521:		dev_set_uevent_suppress(&device->dev, false);
1522:		ib_device_unregister_rdmacg(device);
1523:	cache_cleanup:
1524:		ib_cache_cleanup_one(device);
1525:		return ret;
1526:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 30448
							output: 44
							thoughts: 15
						

Here's a summary of my thought process, as requested:

**Deconstructing the IB Registration Call**

Okay, so I'm looking at this `ib_register_device` function. I'm immediately drawn to the fact that it's the core registration function for an InfiniBand device. Now, I need to understand the implications of this registration process. The name itself suggests a "setup" phase, but what exactly does that involve?

Right, the function call itself gives us a huge clue. "Wait a minute!" I'm just looking now, `ib_register_device` *explicitly* calls `setup_device`. That's not just a coincidence, that's the key. This clarifies the device registration's nature, as I see it. It is clear that the registration process is reliant on a setup function. So `ib_register_device` isn't some black box; it *uses* `setup_device`. This must mean that `setup_device` is the foundational element that gets everything running. That gives me a critical starting point to delve deeper into the device's life cycle. This is the place to start.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:setup_device]

map[SourceCode:1268:	/*
1269:	 * setup_device() allocates memory and sets up data that requires calling the
1270:	 * device ops, this is the only reason these actions are not done during
1271:	 * ib_alloc_device. It is undone by ib_dealloc_device().
1272:	 */
1273:	static int setup_device(struct ib_device *device)
1274:	{
1275:		struct ib_udata uhw = {.outlen = 0, .inlen = 0};
1276:		int ret;
1277:	
1278:		ib_device_check_mandatory(device);
1279:	
1280:		ret = setup_port_data(device);
1281:		if (ret) {
1282:			dev_warn(&device->dev, "Couldn't create per-port data\n");
1283:			return ret;
1284:		}
1285:	
1286:		memset(&device->attrs, 0, sizeof(device->attrs));
1287:		ret = device->ops.query_device(device, &device->attrs, &uhw);
1288:		if (ret) {
1289:			dev_warn(&device->dev,
1290:				 "Couldn't query the device attributes\n");
1291:			return ret;
1292:		}
1293:	
1294:		return 0;
1295:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 31191
							output: 48
							thoughts: 34
						

Here's a summary of my immediate thought process, focusing on the core problem:

**Immediate Questioning of Device Registration and Resource Allocation**

Okay, so I'm digging into this `ib_register_device` function call, and it's making me think. Specifically, I see that it ultimately calls `enable_device_and_get`. The crucial question that's hitting me right now is: does this `enable_device_and_get` function *itself* handle the allocation of a Protection Domain (PD)? That's the critical resource I'm trying to track down. I need to understand whether this function is responsible, or if `ib_register_device` handles it before calling enable, or if it's handled somewhere entirely different.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:enable_device_and_get]

map[SourceCode:1335:	/*
1336:	 * An enabled device is visible to all clients and to all the public facing
1337:	 * APIs that return a device pointer. This always returns with a new get, even
1338:	 * if it fails.
1339:	 */
1340:	static int enable_device_and_get(struct ib_device *device)
1341:	{
1342:		struct ib_client *client;
1343:		unsigned long index;
1344:		int ret = 0;
1345:	
1346:		/*
1347:		 * One ref belongs to the xa and the other belongs to this
1348:		 * thread. This is needed to guard against parallel unregistration.
1349:		 */
1350:		refcount_set(&device->refcount, 2);
1351:		down_write(&devices_rwsem);
1352:		xa_set_mark(&devices, device->index, DEVICE_REGISTERED);
1353:	
1354:		/*
1355:		 * By using downgrade_write() we ensure that no other thread can clear
1356:		 * DEVICE_REGISTERED while we are completing the client setup.
1357:		 */
1358:		downgrade_write(&devices_rwsem);
1359:	
1360:		if (device->ops.enable_driver) {
1361:			ret = device->ops.enable_driver(device);
1362:			if (ret)
1363:				goto out;
1364:		}
1365:	
1366:		down_read(&clients_rwsem);
1367:		xa_for_each_marked (&clients, index, client, CLIENT_REGISTERED) {
1368:			ret = add_client_context(device, client);
1369:			if (ret)
1370:				break;
1371:		}
1372:		up_read(&clients_rwsem);
1373:		if (!ret)
1374:			ret = add_compat_devs(device);
1375:	out:
1376:		up_read(&devices_rwsem);
1377:		return ret;
1378:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 32078
							output: 46
							thoughts: 33
						

Okay, here's my interpretation of that thought process, assuming I'm deeply familiar with this code:

**Checking `add_client_context` for Potential Resource Allocation**

Hold on a second... `add_client_context` is the one that triggers the client callbacks, right? That's a key point. My gut's telling me to investigate the possibility that a client might be allocating a protection domain (PD) within one of those callbacks. This could have significant implications for resource management and overall system behavior, depending on the architecture.

Since I am aware of potential issues of this design, I need to verify: I'd better double-check the `add_client_context` function immediately. I need to understand exactly what those client callbacks are doing and what resources they might be requesting or allocating. I'll need to confirm if there are allocations done inside of the callback and what they are, and then confirm if these allocations are related to a PD. Let's dig in.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:add_client_context]

map[SourceCode: 718:	/*
 719:	 * add_client_context() and remove_client_context() must be safe against
 720:	 * parallel calls on the same device - registration/unregistration of both the
 721:	 * device and client can be occurring in parallel.
 722:	 *
 723:	 * The routines need to be a fence, any caller must not return until the add
 724:	 * or remove is fully completed.
 725:	 */
 726:	static int add_client_context(struct ib_device *device,
 727:				      struct ib_client *client)
 728:	{
 729:		int ret = 0;
 730:	
 731:		if (!device->kverbs_provider && !client->no_kverbs_req)
 732:			return 0;
 733:	
 734:		down_write(&device->client_data_rwsem);
 735:		/*
 736:		 * So long as the client is registered hold both the client and device
 737:		 * unregistration locks.
 738:		 */
 739:		if (!refcount_inc_not_zero(&client->uses))
 740:			goto out_unlock;
 741:		refcount_inc(&device->refcount);
 742:	
 743:		/*
 744:		 * Another caller to add_client_context got here first and has already
 745:		 * completely initialized context.
 746:		 */
 747:		if (xa_get_mark(&device->client_data, client->client_id,
 748:			    CLIENT_DATA_REGISTERED))
 749:			goto out;
 750:	
 751:		ret = xa_err(xa_store(&device->client_data, client->client_id, NULL,
 752:				      GFP_KERNEL));
 753:		if (ret)
 754:			goto out;
 755:		downgrade_write(&device->client_data_rwsem);
 756:		if (client->add) {
 757:			if (client->add(device)) {
 758:				/*
 759:				 * If a client fails to add then the error code is
 760:				 * ignored, but we won't call any more ops on this
 761:				 * client.
 762:				 */
 763:				xa_erase(&device->client_data, client->client_id);
 764:				up_read(&device->client_data_rwsem);
 765:				ib_device_put(device);
 766:				ib_client_put(client);
 767:				return 0;
 768:			}
 769:		}
 770:	
 771:		/* Readers shall not see a client until add has been completed */
 772:		xa_set_mark(&device->client_data, client->client_id,
 773:			    CLIENT_DATA_REGISTERED);
 774:		up_read(&device->client_data_rwsem);
 775:		return 0;
 776:	
 777:	out:
 778:		ib_device_put(device);
 779:		ib_client_put(client);
 780:	out_unlock:
 781:		up_write(&device->client_data_rwsem);
 782:		return ret;
 783:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 33347
							output: 49
							thoughts: 44
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Identifying the Root Cause - SMC and InfiniBand**

Alright, the initial question is about figuring out the affected clients. That's the key to understanding the scope of this issue. The bug report is hinting at something specific with "smc: removing ib device syz0". My brain immediately flags `smc` as a potential culprit. We know `smc` is related to shared memory communication. The "ib device" reference suggests InfiniBand is also in the mix. So, we're likely dealing with an issue related to shared memory over InfiniBand, possibly some kind of device removal or setup problem.

My next move is clear: I need to dig into the `smc_ib_add_dev` function. That's the likely entry point where InfiniBand devices are associated with the `smc` subsystem. Understanding how that function works – how it handles device addition, potential error conditions, and resource management – is critical to pinpointing the actual bug and its implications. I'm going to start there.

map[ContextFile:net/smc/smc_ib.c IncludeSnippetLines:0 Name:smc_ib_add_dev]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 33695
							output: 19
							thoughts: 26
						

Here's my thought process, summarized as you requested:

**Navigating the SMC InfiniBand Landscape**

Okay, so I need to find where the `ib_alloc_pd` function is being used, specifically within the context of the System Management Controller (SMC) protocol in the network code. My instinct is to start by searching in the `net/smc/smc_ib.c` file. It's logical to assume that any InfiniBand-related allocations within the SMC path would be handled there. Let's see what that search turns up and if that file contains the function's usage. Hopefully, this narrows the scope significantly.

map[Expression:ib_alloc_pd]

map[Output:drivers/infiniband/core/mad.c=3194=static int ib_mad_port_open(struct ib_device *device,
--
drivers/infiniband/core/mad.c-3224-
drivers/infiniband/core/mad.c:3225:	port_priv->pd = ib_alloc_pd(device, 0);
drivers/infiniband/core/mad.c-3226-	if (IS_ERR(port_priv->pd)) {
--
drivers/infiniband/core/verbs.c=249=EXPORT_SYMBOL(rdma_port_get_link_layer);
--
drivers/infiniband/core/verbs.c-253-/**
drivers/infiniband/core/verbs.c:254: * __ib_alloc_pd - Allocates an unused protection domain.
drivers/infiniband/core/verbs.c-255- * @device: The device on which to allocate the protection domain.
--
drivers/infiniband/core/verbs.c-264- */
drivers/infiniband/core/verbs.c:265:struct ib_pd *__ib_alloc_pd(struct ib_device *device, unsigned int flags,
drivers/infiniband/core/verbs.c-266-		const char *caller)
--
drivers/infiniband/core/verbs.c-325-}
drivers/infiniband/core/verbs.c:326:EXPORT_SYMBOL(__ib_alloc_pd);
drivers/infiniband/core/verbs.c-327-
--
drivers/infiniband/hw/bnxt_re/ib_verbs.c=695=int bnxt_re_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
--
drivers/infiniband/hw/bnxt_re/ib_verbs.c-706-	pd->rdev = rdev;
drivers/infiniband/hw/bnxt_re/ib_verbs.c:707:	if (bnxt_qplib_alloc_pd(&rdev->qplib_res, &pd->qplib_pd)) {
drivers/infiniband/hw/bnxt_re/ib_verbs.c-708-		ibdev_err(&rdev->ibdev, "Failed to allocate HW PD");
--
drivers/infiniband/hw/bnxt_re/qplib_res.c=608=static void bnxt_qplib_init_sgid_tbl(struct bnxt_qplib_sgid_tbl *sgid_tbl,
--
drivers/infiniband/hw/bnxt_re/qplib_res.c-619-/* PDs */
drivers/infiniband/hw/bnxt_re/qplib_res.c:620:int bnxt_qplib_alloc_pd(struct bnxt_qplib_res  *res, struct bnxt_qplib_pd *pd)
drivers/infiniband/hw/bnxt_re/qplib_res.c-621-{
--
drivers/infiniband/hw/bnxt_re/qplib_res.c=660=static void bnxt_qplib_free_pd_tbl(struct bnxt_qplib_pd_tbl *pdt)
--
drivers/infiniband/hw/bnxt_re/qplib_res.c-666-
drivers/infiniband/hw/bnxt_re/qplib_res.c:667:static int bnxt_qplib_alloc_pd_tbl(struct bnxt_qplib_res *res,
drivers/infiniband/hw/bnxt_re/qplib_res.c-668-				   struct bnxt_qplib_pd_tbl *pdt,
--
drivers/infiniband/hw/bnxt_re/qplib_res.c=866=int bnxt_qplib_alloc_res(struct bnxt_qplib_res *res, struct net_device *netdev)
--
drivers/infiniband/hw/bnxt_re/qplib_res.c-885-
drivers/infiniband/hw/bnxt_re/qplib_res.c:886:	rc = bnxt_qplib_alloc_pd_tbl(res, &res->pd_tbl, dev_attr->max_pd);
drivers/infiniband/hw/bnxt_re/qplib_res.c-887-	if (rc)
--
drivers/infiniband/hw/bnxt_re/qplib_res.h=421=int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,
drivers/infiniband/hw/bnxt_re/qplib_res.h-422-			      struct bnxt_qplib_hwq_attr *hwq_attr);
drivers/infiniband/hw/bnxt_re/qplib_res.h:423:int bnxt_qplib_alloc_pd(struct bnxt_qplib_res *res,
drivers/infiniband/hw/bnxt_re/qplib_res.h-424-			struct bnxt_qplib_pd *pd);
--
drivers/infiniband/hw/hns/hns_roce_pd.c=44=int hns_roce_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
--
drivers/infiniband/hw/hns/hns_roce_pd.c-61-	if (udata) {
drivers/infiniband/hw/hns/hns_roce_pd.c:62:		struct hns_roce_ib_alloc_pd_resp resp = {.pdn = pd->pdn};
drivers/infiniband/hw/hns/hns_roce_pd.c-63-
--
drivers/infiniband/hw/mana/device.c=14=static const struct ib_device_ops mana_ib_dev_ops = {
--
drivers/infiniband/hw/mana/device.c-19-	.add_gid = mana_ib_gd_add_gid,
drivers/infiniband/hw/mana/device.c:20:	.alloc_pd = mana_ib_alloc_pd,
drivers/infiniband/hw/mana/device.c-21-	.alloc_ucontext = mana_ib_alloc_ucontext,
--
drivers/infiniband/hw/mana/main.c=29=int mana_ib_cfg_vport(struct mana_ib_dev *dev, u32 port, struct mana_ib_pd *pd,
--
drivers/infiniband/hw/mana/main.c-68-
drivers/infiniband/hw/mana/main.c:69:int mana_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
drivers/infiniband/hw/mana/main.c-70-{
--
drivers/infiniband/hw/mana/mana_ib.h=666=int mana_ib_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata);
drivers/infiniband/hw/mana/mana_ib.h-667-
drivers/infiniband/hw/mana/mana_ib.h:668:int mana_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata);
drivers/infiniband/hw/mana/mana_ib.h-669-int mana_ib_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata);
--
drivers/infiniband/hw/mlx4/mad.c=1980=static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
--
drivers/infiniband/hw/mlx4/mad.c-2023-
drivers/infiniband/hw/mlx4/mad.c:2024:	ctx->pd = ib_alloc_pd(ctx->ib_dev, 0);
drivers/infiniband/hw/mlx4/mad.c-2025-	if (IS_ERR(ctx->pd)) {
--
drivers/infiniband/hw/mlx4/main.c=1153=static int mlx4_ib_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
--
drivers/infiniband/hw/mlx4/main.c-1197-
drivers/infiniband/hw/mlx4/main.c:1198:static int mlx4_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
drivers/infiniband/hw/mlx4/main.c-1199-{
--
drivers/infiniband/hw/mlx4/main.c=1221=static int mlx4_ib_alloc_xrcd(struct ib_xrcd *ibxrcd, struct ib_udata *udata)
--
drivers/infiniband/hw/mlx4/main.c-1234-
drivers/infiniband/hw/mlx4/main.c:1235:	xrcd->pd = ib_alloc_pd(ibxrcd->device, 0);
drivers/infiniband/hw/mlx4/main.c-1236-	if (IS_ERR(xrcd->pd)) {
--
drivers/infiniband/hw/mlx4/main.c=2518=static const struct ib_device_ops mlx4_ib_dev_ops = {
--
drivers/infiniband/hw/mlx4/main.c-2524-	.alloc_mr = mlx4_ib_alloc_mr,
drivers/infiniband/hw/mlx4/main.c:2525:	.alloc_pd = mlx4_ib_alloc_pd,
drivers/infiniband/hw/mlx4/main.c-2526-	.alloc_ucontext = mlx4_ib_alloc_ucontext,
--
drivers/infiniband/hw/mlx5/main.c=2514=static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vma)
--
drivers/infiniband/hw/mlx5/main.c-2563-
drivers/infiniband/hw/mlx5/main.c:2564:static int mlx5_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
drivers/infiniband/hw/mlx5/main.c-2565-{
--
drivers/infiniband/hw/mlx5/main.c-2567-	struct ib_device *ibdev = ibpd->device;
drivers/infiniband/hw/mlx5/main.c:2568:	struct mlx5_ib_alloc_pd_resp resp;
drivers/infiniband/hw/mlx5/main.c-2569-	int err;
--
drivers/infiniband/hw/mlx5/main.c=3033=int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev)
--
drivers/infiniband/hw/mlx5/main.c-3054-	ibdev = &dev->ib_dev;
drivers/infiniband/hw/mlx5/main.c:3055:	pd = ib_alloc_pd(ibdev, 0);
drivers/infiniband/hw/mlx5/main.c-3056-	if (IS_ERR(pd)) {
--
drivers/infiniband/hw/mlx5/main.c=4245=static const struct ib_device_ops mlx5_ib_dev_ops = {
--
drivers/infiniband/hw/mlx5/main.c-4253-	.alloc_mr_integrity = mlx5_ib_alloc_mr_integrity,
drivers/infiniband/hw/mlx5/main.c:4254:	.alloc_pd = mlx5_ib_alloc_pd,
drivers/infiniband/hw/mlx5/main.c-4255-	.alloc_ucontext = mlx5_ib_alloc_ucontext,
--
drivers/infiniband/hw/mlx5/umr.c=211=int mlx5r_umr_init(struct mlx5_ib_dev *dev)
--
drivers/infiniband/hw/mlx5/umr.c-214-
drivers/infiniband/hw/mlx5/umr.c:215:	pd = ib_alloc_pd(&dev->ib_dev, 0);
drivers/infiniband/hw/mlx5/umr.c-216-	if (IS_ERR(pd)) {
--
drivers/infiniband/hw/usnic/usnic_ib_main.c=352=static const struct ib_device_ops usnic_dev_ops = {
--
drivers/infiniband/hw/usnic/usnic_ib_main.c-356-
drivers/infiniband/hw/usnic/usnic_ib_main.c:357:	.alloc_pd = usnic_ib_alloc_pd,
drivers/infiniband/hw/usnic/usnic_ib_main.c-358-	.alloc_ucontext = usnic_ib_alloc_ucontext,
--
drivers/infiniband/hw/usnic/usnic_ib_verbs.c=423=int usnic_ib_query_gid(struct ib_device *ibdev, u32 port, int index,
--
drivers/infiniband/hw/usnic/usnic_ib_verbs.c-441-
drivers/infiniband/hw/usnic/usnic_ib_verbs.c:442:int usnic_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
drivers/infiniband/hw/usnic/usnic_ib_verbs.c-443-{
--
drivers/infiniband/hw/usnic/usnic_ib_verbs.h=49=int usnic_ib_query_gid(struct ib_device *ibdev, u32 port, int index,
drivers/infiniband/hw/usnic/usnic_ib_verbs.h-50-				union ib_gid *gid);
drivers/infiniband/hw/usnic/usnic_ib_verbs.h:51:int usnic_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata);
drivers/infiniband/hw/usnic/usnic_ib_verbs.h-52-int usnic_ib_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata);
--
drivers/infiniband/sw/rdmavt/pd.c=18=int rvt_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
--
drivers/infiniband/sw/rdmavt/pd.c-41-
drivers/infiniband/sw/rdmavt/pd.c:42:	/* ib_alloc_pd() will initialize pd->ibpd. */
drivers/infiniband/sw/rdmavt/pd.c-43-	pd->user = !!udata;
--
drivers/infiniband/ulp/ipoib/ipoib_main.c=1853=static int ipoib_dev_init(struct net_device *dev)
--
drivers/infiniband/ulp/ipoib/ipoib_main.c-1870-	/* create pd, which used both for control and datapath*/
drivers/infiniband/ulp/ipoib/ipoib_main.c:1871:	priv->pd = ib_alloc_pd(priv->ca, 0);
drivers/infiniband/ulp/ipoib/ipoib_main.c-1872-	if (IS_ERR(priv->pd)) {
--
drivers/infiniband/ulp/iser/iser_verbs.c=61=static int iser_create_device_ib_res(struct iser_device *device)
--
drivers/infiniband/ulp/iser/iser_verbs.c-69-
drivers/infiniband/ulp/iser/iser_verbs.c:70:	device->pd = ib_alloc_pd(ib_dev,
drivers/infiniband/ulp/iser/iser_verbs.c-71-		iser_always_reg ? 0 : IB_PD_UNSAFE_GLOBAL_RKEY);
--
drivers/infiniband/ulp/isert/ib_isert.c=213=isert_create_device_ib_res(struct isert_device *device)
--
drivers/infiniband/ulp/isert/ib_isert.c-221-
drivers/infiniband/ulp/isert/ib_isert.c:222:	device->pd = ib_alloc_pd(ib_dev, 0);
drivers/infiniband/ulp/isert/ib_isert.c-223-	if (IS_ERR(device->pd)) {
--
drivers/infiniband/ulp/rtrs/rtrs.c=606=rtrs_ib_dev_find_or_add(struct ib_device *ib_dev,
--
drivers/infiniband/ulp/rtrs/rtrs.c-624-	dev->ib_dev = ib_dev;
drivers/infiniband/ulp/rtrs/rtrs.c:625:	dev->ib_pd = ib_alloc_pd(ib_dev, pool->pd_flags);
drivers/infiniband/ulp/rtrs/rtrs.c-626-	if (IS_ERR(dev->ib_pd))
--
drivers/infiniband/ulp/srp/ib_srp.c=4001=static int srp_add_one(struct ib_device *device)
--
drivers/infiniband/ulp/srp/ib_srp.c-4056-	srp_dev->dev = device;
drivers/infiniband/ulp/srp/ib_srp.c:4057:	srp_dev->pd  = ib_alloc_pd(device, flags);
drivers/infiniband/ulp/srp/ib_srp.c-4058-	if (IS_ERR(srp_dev->pd)) {
--
drivers/infiniband/ulp/srpt/ib_srpt.c=3203=static int srpt_add_one(struct ib_device *device)
--
drivers/infiniband/ulp/srpt/ib_srpt.c-3220-
drivers/infiniband/ulp/srpt/ib_srpt.c:3221:	sdev->pd = ib_alloc_pd(device, 0);
drivers/infiniband/ulp/srpt/ib_srpt.c-3222-	if (IS_ERR(sdev->pd)) {
--
drivers/nvme/host/rdma.c=367=nvme_rdma_find_get_device(struct rdma_cm_id *cm_id)
--
drivers/nvme/host/rdma.c-384-
drivers/nvme/host/rdma.c:385:	ndev->pd = ib_alloc_pd(ndev->dev,
drivers/nvme/host/rdma.c-386-		register_always ? 0 : IB_PD_UNSAFE_GLOBAL_RKEY);
--
drivers/nvme/target/rdma.c=1195=nvmet_rdma_find_get_device(struct rdma_cm_id *cm_id)
--
drivers/nvme/target/rdma.c-1237-
drivers/nvme/target/rdma.c:1238:	ndev->pd = ib_alloc_pd(ndev->device, 0);
drivers/nvme/target/rdma.c-1239-	if (IS_ERR(ndev->pd))
--
fs/smb/client/smbdirect.c=1784=static struct smbd_connection *_smbd_get_connection(
--
fs/smb/client/smbdirect.c-1882-
fs/smb/client/smbdirect.c:1883:	sc->ib.pd = ib_alloc_pd(sc->ib.dev, 0);
fs/smb/client/smbdirect.c-1884-	if (IS_ERR(sc->ib.pd)) {
--
fs/smb/client/smbdirect.c-1886-		sc->ib.pd = NULL;
fs/smb/client/smbdirect.c:1887:		log_rdma_event(ERR, "ib_alloc_pd() returned %d\n", rc);
fs/smb/client/smbdirect.c-1888-		goto alloc_pd_failed;
--
fs/smb/server/transport_rdma.c=2198=static int smb_direct_create_qpair(struct smbdirect_socket *sc)
--
fs/smb/server/transport_rdma.c-2289-
fs/smb/server/transport_rdma.c:2290:	sc->ib.pd = ib_alloc_pd(sc->ib.dev, 0);
fs/smb/server/transport_rdma.c-2291-	if (IS_ERR(sc->ib.pd)) {
--
include/rdma/ib_verbs.h=3589=enum ib_pd_flags {
--
include/rdma/ib_verbs.h-3601-
include/rdma/ib_verbs.h:3602:struct ib_pd *__ib_alloc_pd(struct ib_device *device, unsigned int flags,
include/rdma/ib_verbs.h-3603-		const char *caller);
--
include/rdma/ib_verbs.h-3605-/**
include/rdma/ib_verbs.h:3606: * ib_alloc_pd - Allocates an unused protection domain.
include/rdma/ib_verbs.h-3607- * @device: The device on which to allocate the protection domain.
--
include/rdma/ib_verbs.h-3615- */
include/rdma/ib_verbs.h:3616:#define ib_alloc_pd(device, flags) \
include/rdma/ib_verbs.h:3617:	__ib_alloc_pd((device), (flags), KBUILD_MODNAME)
include/rdma/ib_verbs.h-3618-
--
include/uapi/rdma/hns-abi.h=141=struct hns_roce_ib_alloc_ucontext {
--
include/uapi/rdma/hns-abi.h-145-
include/uapi/rdma/hns-abi.h:146:struct hns_roce_ib_alloc_pd_resp {
include/uapi/rdma/hns-abi.h-147-	__u32 pdn;
--
include/uapi/rdma/mlx4-abi.h=66=struct mlx4_ib_alloc_ucontext_resp {
--
include/uapi/rdma/mlx4-abi.h-73-
include/uapi/rdma/mlx4-abi.h:74:struct mlx4_ib_alloc_pd_resp {
include/uapi/rdma/mlx4-abi.h-75-	__u32	pdn;
--
include/uapi/rdma/mlx5-abi.h=135=struct mlx5_ib_alloc_ucontext_resp {
--
include/uapi/rdma/mlx5-abi.h-159-
include/uapi/rdma/mlx5-abi.h:160:struct mlx5_ib_alloc_pd_resp {
include/uapi/rdma/mlx5-abi.h-161-	__u32	pdn;
--
net/9p/trans_rdma.c=522=rdma_create_trans(struct p9_client *client, struct fs_context *fc)
--
net/9p/trans_rdma.c-590-	/* Create the Protection Domain */
net/9p/trans_rdma.c:591:	rdma->pd = ib_alloc_pd(rdma->cm_id->device, 0);
net/9p/trans_rdma.c-592-	if (IS_ERR(rdma->pd))
--
net/rds/ib.c=128=static int rds_ib_add_one(struct ib_device *device)
--
net/rds/ib.c-185-	rds_ibdev->dev = device;
net/rds/ib.c:186:	rds_ibdev->pd = ib_alloc_pd(device, 0);
net/rds/ib.c-187-	if (IS_ERR(rds_ibdev->pd)) {
--
net/smc/smc_ib.c=458=int smc_ib_create_protection_domain(struct smc_link *lnk)
--
net/smc/smc_ib.c-461-
net/smc/smc_ib.c:462:	lnk->roce_pd = ib_alloc_pd(lnk->smcibdev->ibdev, 0);
net/smc/smc_ib.c-463-	rc = PTR_ERR_OR_ZERO(lnk->roce_pd);
--
net/sunrpc/xprtrdma/svc_rdma_transport.c=407=static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
--
net/sunrpc/xprtrdma/svc_rdma_transport.c-477-
net/sunrpc/xprtrdma/svc_rdma_transport.c:478:	newxprt->sc_pd = ib_alloc_pd(dev, 0);
net/sunrpc/xprtrdma/svc_rdma_transport.c-479-	if (IS_ERR(newxprt->sc_pd)) {
--
net/sunrpc/xprtrdma/verbs.c=378=static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
--
net/sunrpc/xprtrdma/verbs.c-470-
net/sunrpc/xprtrdma/verbs.c:471:	ep->re_pd = ib_alloc_pd(device, 0);
net/sunrpc/xprtrdma/verbs.c-472-	if (IS_ERR(ep->re_pd)) {
]

gemini-3.1-pro-preview

							input: 40711
							output: 48
							thoughts: 46
						

**My Line of Inquiry: SMC and Protection Domain Allocation**

Okay, hold on a second. `smc_ib_create_protection_domain` is pretty explicit: it *creates* a Protection Domain (PD). But that makes me wonder... does the SMC code implicitly allocate a PD when a new device is brought into the fold? I need to be absolutely sure about this. The architecture hinges on this.

So, instead of relying on assumption, let's dive into the `smc_ib_add_dev` function. That seems like the logical place to start digging. I'll need to trace the execution path and see if PD allocation is happening under the hood when a device is first integrated. I'm looking for either a direct call to a PD creation function or some indirect indication that a new PD is being spun up. This needs to be clarified, and now.

map[ContextFile:net/smc/smc_ib.c IncludeLines:true Name:smc_ib_add_dev]

map[SourceCode: 937:	/* callback function for ib_register_client() */
 938:	static int smc_ib_add_dev(struct ib_device *ibdev)
 939:	{
 940:		struct smc_ib_device *smcibdev;
 941:		u8 port_cnt;
 942:		int i;
 943:	
 944:		if (ibdev->node_type != RDMA_NODE_IB_CA)
 945:			return -EOPNOTSUPP;
 946:	
 947:		smcibdev = kzalloc(sizeof(*smcibdev), GFP_KERNEL);
 948:		if (!smcibdev)
 949:			return -ENOMEM;
 950:	
 951:		smcibdev->ibdev = ibdev;
 952:		INIT_WORK(&smcibdev->port_event_work, smc_ib_port_event_work);
 953:		atomic_set(&smcibdev->lnk_cnt, 0);
 954:		init_waitqueue_head(&smcibdev->lnks_deleted);
 955:		mutex_init(&smcibdev->mutex);
 956:		mutex_lock(&smc_ib_devices.mutex);
 957:		list_add_tail(&smcibdev->list, &smc_ib_devices.list);
 958:		mutex_unlock(&smc_ib_devices.mutex);
 959:		ib_set_client_data(ibdev, &smc_ib_client, smcibdev);
 960:		INIT_IB_EVENT_HANDLER(&smcibdev->event_handler, smcibdev->ibdev,
 961:				      smc_ib_global_event_handler);
 962:		ib_register_event_handler(&smcibdev->event_handler);
 963:	
 964:		/* trigger reading of the port attributes */
 965:		port_cnt = smcibdev->ibdev->phys_port_cnt;
 966:		pr_warn_ratelimited("smc: adding ib device %s with port count %d\n",
 967:				    smcibdev->ibdev->name, port_cnt);
 968:		for (i = 0;
 969:		     i < min_t(size_t, port_cnt, SMC_MAX_PORTS);
 970:		     i++) {
 971:			set_bit(i, &smcibdev->port_event_mask);
 972:			/* determine pnetids of the port */
 973:			if (smc_pnetid_by_dev_port(ibdev->dev.parent, i,
 974:						   smcibdev->pnetid[i]))
 975:				smc_pnetid_by_table_ib(smcibdev, i + 1);
 976:			smc_copy_netdev_ifindex(smcibdev, i);
 977:			if (smc_pnet_is_pnetid_set(smcibdev->pnetid[i]))
 978:				pr_warn_ratelimited("smc:    ib device %s port %d has pnetid %.16s%s\n",
 979:						    smcibdev->ibdev->name, i + 1,
 980:						    smcibdev->pnetid[i],
 981:						    smcibdev->pnetid_by_user[i] ?
 982:							" (user defined)" :
 983:							"");
 984:			else
 985:				pr_warn_ratelimited("smc:    ib device %s port %d has no pnetid\n",
 986:						    smcibdev->ibdev->name, i + 1);
 987:	
 988:		}
 989:		schedule_work(&smcibdev->port_event_work);
 990:		return 0;
 991:	}
 SourceFile:net/smc/smc_ib.c]

gemini-3.1-pro-preview

							input: 42106
							output: 50
							thoughts: 42
						

Here's the summary, formatted as requested:

**Deconstructing the IB Device Addition**

Okay, so `smc_ib_add_dev` is the crucial function here. That's where the initial device integration happens, and specifically, I see that it schedules `smcibdev->port_event_work`. That's the key: the device addition triggers a work item.

Now my mind immediately jumps to `smc_ib_port_event_work`. That's what I *really* need to focus on next. I need to understand what that work item *does*. Is it responsible for initial port configuration? Are there any race conditions with the hardware initialization? Does it handle the initial state transitions? Digging into this work function will reveal the essential logic flow associated with the newly added IB device's initial interaction with the system, and that's precisely what I'm after. This function is where the rubber meets the road.

map[ContextFile:net/smc/smc_ib.c IncludeLines:true Name:smc_ib_port_event_work]

map[SourceCode: 380:	/* process context wrapper for might_sleep smc_ib_remember_port_attr */
 381:	static void smc_ib_port_event_work(struct work_struct *work)
 382:	{
 383:		struct smc_ib_device *smcibdev = container_of(
 384:			work, struct smc_ib_device, port_event_work);
 385:		u8 port_idx;
 386:	
 387:		for_each_set_bit(port_idx, &smcibdev->port_event_mask, SMC_MAX_PORTS) {
 388:			smc_ib_remember_port_attr(smcibdev, port_idx + 1);
 389:			clear_bit(port_idx, &smcibdev->port_event_mask);
 390:			if (!smc_ib_port_active(smcibdev, port_idx + 1)) {
 391:				set_bit(port_idx, smcibdev->ports_going_away);
 392:				smcr_port_err(smcibdev, port_idx + 1);
 393:			} else {
 394:				clear_bit(port_idx, smcibdev->ports_going_away);
 395:				smcr_port_add(smcibdev, port_idx + 1);
 396:				smc_ib_gid_check(smcibdev, port_idx + 1);
 397:			}
 398:		}
 399:	}
 SourceFile:net/smc/smc_ib.c]

gemini-3.1-pro-preview

							input: 42854
							output: 46
							thoughts: 41
						

Here's my thought process, as it stands:

**Potential PD Allocation Point**

Okay, hold on a second... I'm pretty sure either `smc_ib_remember_port_attr` or `smcr_port_add` is responsible for potentially allocating a Protection Domain (PD). I need to nail down exactly where that allocation happens, especially if there's a possibility of a race condition. Let's make sure I'm right about this and get a closer look at what `smcr_port_add` does. I'll need to dig into its implementation to see how it manages PDs, and if it could be the point of allocation.

map[ContextFile:net/smc/smc_core.c IncludeLines:true Name:smcr_port_add]

map[SourceCode:1757:	void smcr_port_add(struct smc_ib_device *smcibdev, u8 ibport)
1758:	{
1759:		struct smc_link_group *lgr, *n;
1760:	
1761:		spin_lock_bh(&smc_lgr_list.lock);
1762:		list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
1763:			struct smc_link *link;
1764:	
1765:			if (strncmp(smcibdev->pnetid[ibport - 1], lgr->pnet_id,
1766:				    SMC_MAX_PNETID_LEN) ||
1767:			    lgr->type == SMC_LGR_SYMMETRIC ||
1768:			    lgr->type == SMC_LGR_ASYMMETRIC_PEER ||
1769:			    !rdma_dev_access_netns(smcibdev->ibdev, lgr->net))
1770:				continue;
1771:	
1772:			if (lgr->type == SMC_LGR_SINGLE && lgr->max_links <= 1)
1773:				continue;
1774:	
1775:			/* trigger local add link processing */
1776:			link = smc_llc_usable_link(lgr);
1777:			if (link)
1778:				smc_llc_add_link_local(link);
1779:		}
1780:		spin_unlock_bh(&smc_lgr_list.lock);
1781:	}
 SourceFile:net/smc/smc_core.c]

gemini-3.1-pro-preview

							input: 43574
							output: 48
							thoughts: 40
						

Okay, here's my interpretation of that.

**Analyzing the Bug Report: A Quick Diagnostic**

Alright, no immediate indication of a Performance Data (PD) allocation issue here. That's a good first check, ruling out a common source of problems. But wait, let's dig into the details. The bug report is specifically mentioning the removal of an InfiniBand (IB) device: `"smc: removing ib device syz0"`. Hmmm, that's being printed by `smc_ib_remove_dev`. That function gives us a clue to focus our attention there. This suggests that the issue might be related to the Secure Messaging Cluster (SMC) stack's interaction with the IB device removal process, or perhaps the removal itself. We need to look closely at the conditions that trigger `smc_ib_remove_dev` and what happens both before and after that call within the broader SMC context, keeping in mind potential race conditions or resource conflicts with other parts of the network stack. This removal could be a symptom of a larger problem. Let's see if we can find associated error codes or log messages to add context to the scenario.

map[ContextFile:net/smc/smc_ib.c IncludeLines:true Name:smc_ib_remove_dev]

map[SourceCode: 993:	/* callback function for ib_unregister_client() */
 994:	static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data)
 995:	{
 996:		struct smc_ib_device *smcibdev = client_data;
 997:	
 998:		mutex_lock(&smc_ib_devices.mutex);
 999:		list_del_init(&smcibdev->list); /* remove from smc_ib_devices */
1000:		mutex_unlock(&smc_ib_devices.mutex);
1001:		pr_warn_ratelimited("smc: removing ib device %s\n",
1002:				    smcibdev->ibdev->name);
1003:		smc_smcr_terminate_all(smcibdev);
1004:		smc_ib_cleanup_per_ibdev(smcibdev);
1005:		ib_unregister_event_handler(&smcibdev->event_handler);
1006:		cancel_work_sync(&smcibdev->port_event_work);
1007:		kfree(smcibdev);
1008:	}
 SourceFile:net/smc/smc_ib.c]

gemini-3.1-pro-preview

							input: 44261
							output: 53
							thoughts: 195
						

**My Line of Reasoning**

Okay, let's break this down. First, I see that `smc_ib_remove_dev` calls `smc_smcr_terminate_all(smcibdev)`. That's the starting point. I need to understand the connection between these functions and what they're trying to achieve. The question that pops up immediately is: does the `smc` module allocate a Protection Domain (PD) when an InfiniBand (IB) link is established? My knowledge tells me that `smc_ib_create_protection_domain` is responsible for this allocation.

But then I have to question if the reproducer even *creates* an SMC link. The code seems focused on creating an `rxe` device, which complicates things. It looks like the reproducer is bypassing the `smc` layer, making my initial line of thought, potentially, a red herring.

Hold on a minute, if `smc` *is* loaded, then it registers as an IB client, right? When an IB device is registered, that triggers `smc_ib_add_dev`. Does *that* allocate a PD? No, that's not its job.

Hmm, maybe there's an interplay with other IB modules. What if `ipoib` is loaded? That's when things start to get interesting. `ipoib_add_port` calls `ipoib_dev_init` which then calls `ib_alloc_pd`. Ah, this is more promising. It's likely that this is the path the reproducer is taking, as `ipoib` is more commonly used in such setups. It is probably important to note how `ipoib` does its device initialization, because that's where the PD allocation happens.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_add_port]

map[SourceCode:2584:	static struct net_device *ipoib_add_port(const char *format,
2585:						 struct ib_device *hca, u32 port)
2586:	{
2587:		struct rtnl_link_ops *ops = ipoib_get_link_ops();
2588:		struct rdma_netdev_alloc_params params;
2589:		struct ipoib_dev_priv *priv;
2590:		struct net_device *ndev;
2591:		int result;
2592:	
2593:		ndev = ipoib_intf_alloc(hca, port, format);
2594:		if (IS_ERR(ndev)) {
2595:			pr_warn("%s, %d: ipoib_intf_alloc failed %ld\n", hca->name, port,
2596:				PTR_ERR(ndev));
2597:			return ndev;
2598:		}
2599:		priv = ipoib_priv(ndev);
2600:	
2601:		INIT_IB_EVENT_HANDLER(&priv->event_handler,
2602:				      priv->ca, ipoib_event);
2603:		ib_register_event_handler(&priv->event_handler);
2604:	
2605:		/* call event handler to ensure pkey in sync */
2606:		ipoib_queue_work(priv, IPOIB_FLUSH_HEAVY);
2607:	
2608:		ndev->rtnl_link_ops = ipoib_get_link_ops();
2609:	
2610:		dev_net_set(ndev, rdma_dev_net(hca));
2611:	
2612:		result = register_netdev(ndev);
2613:		if (result) {
2614:			pr_warn("%s: couldn't register ipoib port %d; error %d\n",
2615:				hca->name, port, result);
2616:	
2617:			ipoib_parent_unregister_pre(ndev);
2618:			ipoib_intf_free(ndev);
2619:			free_netdev(ndev);
2620:	
2621:			return ERR_PTR(result);
2622:		}
2623:	
2624:		if (hca->ops.rdma_netdev_get_params) {
2625:			int rc = hca->ops.rdma_netdev_get_params(hca, port,
2626:							     RDMA_NETDEV_IPOIB,
2627:							     &params);
2628:	
2629:			if (!rc && ops->priv_size < params.sizeof_priv)
2630:				ops->priv_size = params.sizeof_priv;
2631:		}
2632:		/*
2633:		 * We cannot set priv_destructor before register_netdev because we
2634:		 * need priv to be always valid during the error flow to execute
2635:		 * ipoib_parent_unregister_pre(). Instead handle it manually and only
2636:		 * enter priv_destructor mode once we are completely registered.
2637:		 */
2638:		ndev->priv_destructor = ipoib_intf_free;
2639:	
2640:		if (ipoib_intercept_dev_id_attr(ndev))
2641:			goto sysfs_failed;
2642:		if (ipoib_cm_add_mode_attr(ndev))
2643:			goto sysfs_failed;
2644:		if (ipoib_add_pkey_attr(ndev))
2645:			goto sysfs_failed;
2646:		if (ipoib_add_umcast_attr(ndev))
2647:			goto sysfs_failed;
2648:		if (device_create_file(&ndev->dev, &dev_attr_create_child))
2649:			goto sysfs_failed;
2650:		if (device_create_file(&ndev->dev, &dev_attr_delete_child))
2651:			goto sysfs_failed;
2652:	
2653:		return ndev;
2654:	
2655:	sysfs_failed:
2656:		ipoib_parent_unregister_pre(ndev);
2657:		unregister_netdev(ndev);
2658:		return ERR_PTR(-ENOMEM);
2659:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 46163
							output: 54
							thoughts: 51
						

Okay, let's see...

**Deconstructing the IPoIB Initialization Flow**

Hang on a second. I need to make sure I've got this straight. I thought `ipoib_intf_alloc` was calling `ipoib_dev_init`. But no, wait, that doesn't quite fit the picture, does it? My understanding is that `ipoib_intf_alloc` is responsible for allocating the `netdev` itself. Alright, let's just confirm my understanding. I should probably go back and examine the code for `ipoib_intf_alloc` directly. It's time to refresh that portion of the initialization sequence.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_intf_alloc]

map[SourceCode:2335:	struct net_device *ipoib_intf_alloc(struct ib_device *hca, u32 port,
2336:					    const char *name)
2337:	{
2338:		struct net_device *dev;
2339:		int rc;
2340:	
2341:		dev = ipoib_alloc_netdev(hca, port, name);
2342:		if (IS_ERR(dev))
2343:			return dev;
2344:	
2345:		rc = ipoib_intf_init(hca, port, name, dev);
2346:		if (rc) {
2347:			free_netdev(dev);
2348:			return ERR_PTR(rc);
2349:		}
2350:	
2351:		/*
2352:		 * Upon success the caller must ensure ipoib_intf_free is called or
2353:		 * register_netdevice succeed'd and priv_destructor is set to
2354:		 * ipoib_intf_free.
2355:		 */
2356:		return dev;
2357:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 46775
							output: 54
							thoughts: 21
						

Here's my take on those thoughts, tailored for an expert audience:

**A Quick Trace & Aha! Moment**

Okay, so I'm digging into this InfiniBand initialization sequence and I've hit a little mental roadblock. I was just reviewing the `ipoib_intf_init` function, and it seems like it's calling `ipoib_dev_init`. Now, this connection isn't *entirely* unexpected, but it's always good to refresh my memory of the inter-module dependency tree, especially when tracking down potential issues or looking to optimize. So, `ipoib_intf_init` actually handles the interface-level setup, and then, likely, `ipoib_dev_init` is called to work on the device level details like hardware probing and resource allocation. Makes sense, assuming the interface is associated with some specific hardware or physical device. Just making sure I've got the correct mental model of the initialization process. Good to know I was right and can move forward.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_intf_init]

map[SourceCode:2276:	int ipoib_intf_init(struct ib_device *hca, u32 port, const char *name,
2277:			    struct net_device *dev)
2278:	{
2279:		struct rdma_netdev *rn = netdev_priv(dev);
2280:		struct ipoib_dev_priv *priv;
2281:		int rc;
2282:	
2283:		priv = kzalloc(sizeof(*priv), GFP_KERNEL);
2284:		if (!priv)
2285:			return -ENOMEM;
2286:	
2287:		priv->ca = hca;
2288:		priv->port = port;
2289:	
2290:		rc = rdma_init_netdev(hca, port, RDMA_NETDEV_IPOIB, name,
2291:				      NET_NAME_UNKNOWN, ipoib_setup_common, dev);
2292:		if (rc) {
2293:			if (rc != -EOPNOTSUPP)
2294:				goto out;
2295:	
2296:			rn->send = ipoib_send;
2297:			rn->attach_mcast = ipoib_mcast_attach;
2298:			rn->detach_mcast = ipoib_mcast_detach;
2299:			rn->hca = hca;
2300:	
2301:			rc = netif_set_real_num_tx_queues(dev, 1);
2302:			if (rc)
2303:				goto out;
2304:	
2305:			rc = netif_set_real_num_rx_queues(dev, 1);
2306:			if (rc)
2307:				goto out;
2308:		}
2309:	
2310:		priv->rn_ops = dev->netdev_ops;
2311:	
2312:		if (hca->attrs.kernel_cap_flags & IBK_VIRTUAL_FUNCTION)
2313:			dev->netdev_ops	= &ipoib_netdev_ops_vf;
2314:		else
2315:			dev->netdev_ops	= &ipoib_netdev_ops_pf;
2316:	
2317:		rn->clnt_priv = priv;
2318:		/*
2319:		 * Only the child register_netdev flows can handle priv_destructor
2320:		 * being set, so we force it to NULL here and handle manually until it
2321:		 * is safe to turn on.
2322:		 */
2323:		priv->next_priv_destructor = dev->priv_destructor;
2324:		dev->priv_destructor = NULL;
2325:	
2326:		ipoib_build_priv(dev);
2327:	
2328:		return 0;
2329:	
2330:	out:
2331:		kfree(priv);
2332:		return rc;
2333:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 47957
							output: 56
							thoughts: 29
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**IPOIB Initialization Conundrum**

Okay, hold on a second. I'm tracing through this InfiniBand over Ethernet (IPoIB) driver initialization sequence. I'm seeing that `ipoib_dev_init` is, in fact, being called from `ipoib_netdev_ops_pf.ndo_init`. And the significance of this is, I have to mentally unpick whether I'm looking at the initialization of the underlying hardware, or the specific network device's aspects... and how the two interact. Given my experience, I need to understand the dependencies here and make sure there isn't some obscure issue. Is this a clean call path? Are there any potential race conditions lurking? Or memory leaks? And, given how IPoIB can be, I need to make sure the PF (Physical Function) initialization path is right. Time to dive deeper into the code and verify the control flow.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_netdev_ops_pf]

map[SourceCode:2158:	static const struct net_device_ops ipoib_netdev_ops_pf = {
2159:		.ndo_init		 = ipoib_ndo_init,
2160:		.ndo_uninit		 = ipoib_ndo_uninit,
2161:		.ndo_open		 = ipoib_open,
2162:		.ndo_stop		 = ipoib_stop,
2163:		.ndo_change_mtu		 = ipoib_change_mtu,
2164:		.ndo_fix_features	 = ipoib_fix_features,
2165:		.ndo_start_xmit		 = ipoib_start_xmit,
2166:		.ndo_tx_timeout		 = ipoib_timeout,
2167:		.ndo_set_rx_mode	 = ipoib_set_mcast_list,
2168:		.ndo_get_iflink		 = ipoib_get_iflink,
2169:		.ndo_set_vf_link_state	 = ipoib_set_vf_link_state,
2170:		.ndo_get_vf_config	 = ipoib_get_vf_config,
2171:		.ndo_get_vf_stats	 = ipoib_get_vf_stats,
2172:		.ndo_get_vf_guid	 = ipoib_get_vf_guid,
2173:		.ndo_set_vf_guid	 = ipoib_set_vf_guid,
2174:		.ndo_set_mac_address	 = ipoib_set_mac,
2175:		.ndo_get_stats64	 = ipoib_get_stats,
2176:		.ndo_eth_ioctl		 = ipoib_ioctl,
2177:		.ndo_hwtstamp_get	 = ipoib_hwtstamp_get,
2178:		.ndo_hwtstamp_set	 = ipoib_hwtstamp_set,
2179:	};
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 48829
							output: 53
							thoughts: 18
						

Okay, here's my interpretation of that thought process, summarized as if it were my own:

**Initial Setup of the IP-over-InfiniBand Driver**

Alright, so the `ipoib_ndo_init` function is the crucial entry point for initializing the IP-over-InfiniBand driver, which I already know is foundational to the correct operation of that specific network interface. Now, I see that this initialization function directly calls `ipoib_dev_init`. This is interesting because the naming convention implies a device-level initialization routine is called as part of the driver setup, and that's precisely what I would expect. It means the driver's overall setup leverages a more granular, device-specific initialization step. This suggests a well-structured and modular design where the overarching driver logic delegates the intricate hardware interactions to a more specific function. I'll need to dig into `ipoib_dev_init` next to understand how the hardware resources and specific InfiniBand verbs are being acquired and prepared for use, but `ipoib_ndo_init` has given me the right entrypoint into the full process.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_ndo_init]

map[SourceCode:2017:	static int ipoib_ndo_init(struct net_device *ndev)
2018:	{
2019:		struct ipoib_dev_priv *priv = ipoib_priv(ndev);
2020:		int rc;
2021:		struct rdma_netdev *rn = netdev_priv(ndev);
2022:	
2023:		if (priv->parent) {
2024:			ipoib_child_init(ndev);
2025:		} else {
2026:			rc = ipoib_parent_init(ndev);
2027:			if (rc)
2028:				return rc;
2029:		}
2030:	
2031:		/* MTU will be reset when mcast join happens */
2032:		ndev->mtu = IPOIB_UD_MTU(priv->max_ib_mtu);
2033:		priv->mcast_mtu = priv->admin_mtu = ndev->mtu;
2034:		rn->mtu = priv->mcast_mtu;
2035:		ndev->max_mtu = IPOIB_CM_MTU;
2036:	
2037:		ndev->neigh_priv_len = sizeof(struct ipoib_neigh);
2038:	
2039:		/*
2040:		 * Set the full membership bit, so that we join the right
2041:		 * broadcast group, etc.
2042:		 */
2043:		priv->pkey |= 0x8000;
2044:	
2045:		ndev->broadcast[8] = priv->pkey >> 8;
2046:		ndev->broadcast[9] = priv->pkey & 0xff;
2047:		set_bit(IPOIB_FLAG_DEV_ADDR_SET, &priv->flags);
2048:	
2049:		ipoib_set_dev_features(priv);
2050:	
2051:		rc = ipoib_dev_init(ndev);
2052:		if (rc) {
2053:			pr_warn("%s: failed to initialize device: %s port %d (ret = %d)\n",
2054:				priv->ca->name, priv->dev->name, priv->port, rc);
2055:			return rc;
2056:		}
2057:	
2058:		if (priv->parent) {
2059:			struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
2060:	
2061:			dev_hold(priv->parent);
2062:	
2063:			netdev_lock(priv->parent);
2064:			list_add_tail(&priv->list, &ppriv->child_intfs);
2065:			netdev_unlock(priv->parent);
2066:		}
2067:	
2068:		return 0;
2069:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 49989
							output: 53
							thoughts: 40
						

Okay, here's my interpretation of that.

**Analyzing the IPoIB Initialization Flow**

Alright, let's break this down. My initial observation is that the `ipoib_dev_init` function handles the fundamental allocation of a Protection Domain (PD). That's a key first step, the groundwork for InfiniBand communication. Now, the next logical question is: when does `ipoib_add_port` get triggered? It's crucial to understand the timing and context. Aha! It's called from `ipoib_add_one`. This gives me the crucial insight into how ports are incorporated into the IPoIB setup. This call must be involved in establishing the functional IPoIB interfaces for each port.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_add_one]

map[SourceCode:2661:	static int ipoib_add_one(struct ib_device *device)
2662:	{
2663:		struct list_head *dev_list;
2664:		struct net_device *dev;
2665:		struct ipoib_dev_priv *priv;
2666:		unsigned int p;
2667:		int count = 0;
2668:	
2669:		dev_list = kmalloc(sizeof(*dev_list), GFP_KERNEL);
2670:		if (!dev_list)
2671:			return -ENOMEM;
2672:	
2673:		INIT_LIST_HEAD(dev_list);
2674:	
2675:		rdma_for_each_port (device, p) {
2676:			if (!rdma_protocol_ib(device, p))
2677:				continue;
2678:			dev = ipoib_add_port("ib%d", device, p);
2679:			if (!IS_ERR(dev)) {
2680:				priv = ipoib_priv(dev);
2681:				list_add_tail(&priv->list, dev_list);
2682:				count++;
2683:			}
2684:		}
2685:	
2686:		if (!count) {
2687:			kfree(dev_list);
2688:			return -EOPNOTSUPP;
2689:		}
2690:	
2691:		ib_set_client_data(device, &ipoib_client, dev_list);
2692:		return 0;
2693:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 50733
							output: 45
							thoughts: 66
						

Here's a summary of my thought process:

**IB Device Registration Inquiry**

Okay, so `ipoib_add_one` is triggered during the registration of an InfiniBand (IB) device. That much is clear. But then I have to ask myself, how does this relate to `rxe` devices, which are specifically identified as type `RDMA_NODE_IB_CA`? And, if I'm remembering correctly, the `rdma_protocol_ib` function should return true for these `rxe` devices. I need to make sure I understand the call tree, and confirm that `rdma_protocol_ib` is behaving as I expect in this scenario. Time to verify the behavior of `rdma_protocol_ib`. I can't be sure of the implication of an unexpected return here.

map[ContextFile:include/rdma/ib_verbs.h IncludeLines:true Name:rdma_protocol_ib]

map[SourceCode:3197:	static inline bool rdma_protocol_ib(const struct ib_device *device,
3198:					    u32 port_num)
3199:	{
3200:		return device->port_data[port_num].immutable.core_cap_flags &
3201:		       RDMA_CORE_CAP_PROT_IB;
3202:	}
 SourceFile:include/rdma/ib_verbs.h]

gemini-3.1-pro-preview

							input: 51155
							output: 51
							thoughts: 46
						

Okay, here's my interpretation of those thoughts, considering my expertise:

**Checking RoCE Configuration for Optimization**

Hmm, hold on a second. If `rxe` indicates RoCE, doesn't that mean `rdma_protocol_roce` should be the active flag, not `rdma_protocol_ib`? I need to quickly verify that. Something doesn't feel quite right with the logic here. Let me double-check the configuration related to `rxe_port_immutable`. It feels like there might be a subtle but critical interplay there that I need to confirm to ensure the RDMA protocol is correctly set and that RoCE is working as expected. This could impact performance, so I'd better be thorough.

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeLines:true Name:rxe_port_immutable]

map[SourceCode: 196:	static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num,
 197:				      struct ib_port_immutable *immutable)
 198:	{
 199:		struct rxe_dev *rxe = to_rdev(ibdev);
 200:		struct ib_port_attr attr = {};
 201:		int err;
 202:	
 203:		if (port_num != 1) {
 204:			err = -EINVAL;
 205:			rxe_dbg_dev(rxe, "bad port_num = %d\n", port_num);
 206:			goto err_out;
 207:		}
 208:	
 209:		err = ib_query_port(ibdev, port_num, &attr);
 210:		if (err)
 211:			goto err_out;
 212:	
 213:		immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
 214:		immutable->pkey_tbl_len = attr.pkey_tbl_len;
 215:		immutable->gid_tbl_len = attr.gid_tbl_len;
 216:		immutable->max_mad_size = IB_MGMT_MAD_SIZE;
 217:	
 218:		return 0;
 219:	
 220:	err_out:
 221:		rxe_err_dev(rxe, "returned err = %d\n", err);
 222:		return err;
 223:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 51890
							output: 48
							thoughts: 240
						

**My RDMA PD Allocation Thoughts**

Okay, so I'm digging into this `rxe` issue, and it looks like it's missing `RDMA_CORE_CAP_PROT_IB`. That's a key capability, and it explains why `ipoib` isn't getting added when `rxe` is involved. Hmm, interesting. I need to figure out what other clients are actually allocating a Protection Domain (PD) in the RDMA stack. Let's revisit those `ib_alloc_pd` call sites.

Right, I've got the list again. I see `smbdirect.c`, the various RDMA transports like `transport_rdma.c` and `9p/trans_rdma.c`, `rds/ib.c`, `smc/smc_ib.c`, and the SUN RPC stuff, specifically `sunrpc/xprtrdma/svc_rdma_transport.c` and `sunrpc/xprtrdma/verbs.c`. Then there are the NVMe RDMA modules, `nvme/host/rdma.c` and `nvme/target/rdma.c`, and of course SRP, with `srp/ib_srp.c` and `srpt/ib_srpt.c`. Also `rtrs/rtrs.c`, `isert/ib_isert.c`, `iser/iser_verbs.c`, and...wait a second...`mad.c`! I nearly missed that.

Oh, yes, `mad.c`, specifically `ib_mad_port_open`. That's calling `ib_alloc_pd`, which I probably need to investigate further.

map[ContextFile:drivers/infiniband/core/mad.c IncludeLines:true Name:ib_mad_port_open]

map[SourceCode:3190:	/*
3191:	 * Open the port
3192:	 * Create the QP, PD, MR, and CQ if needed
3193:	 */
3194:	static int ib_mad_port_open(struct ib_device *device,
3195:				    u32 port_num)
3196:	{
3197:		int ret, cq_size;
3198:		struct ib_mad_port_private *port_priv;
3199:		unsigned long flags;
3200:		int has_smi;
3201:	
3202:		if (WARN_ON(rdma_max_mad_size(device, port_num) < IB_MGMT_MAD_SIZE))
3203:			return -EFAULT;
3204:	
3205:		if (WARN_ON(rdma_cap_opa_mad(device, port_num) &&
3206:			    rdma_max_mad_size(device, port_num) < OPA_MGMT_MAD_SIZE))
3207:			return -EFAULT;
3208:	
3209:		/* Create new device info */
3210:		port_priv = kzalloc(sizeof *port_priv, GFP_KERNEL);
3211:		if (!port_priv)
3212:			return -ENOMEM;
3213:	
3214:		port_priv->device = device;
3215:		port_priv->port_num = port_num;
3216:		spin_lock_init(&port_priv->reg_lock);
3217:		init_mad_qp(port_priv, &port_priv->qp_info[0]);
3218:		init_mad_qp(port_priv, &port_priv->qp_info[1]);
3219:	
3220:		cq_size = mad_sendq_size + mad_recvq_size;
3221:		has_smi = rdma_cap_ib_smi(device, port_num);
3222:		if (has_smi)
3223:			cq_size *= 2;
3224:	
3225:		port_priv->pd = ib_alloc_pd(device, 0);
3226:		if (IS_ERR(port_priv->pd)) {
3227:			dev_err(&device->dev, "Couldn't create ib_mad PD\n");
3228:			ret = PTR_ERR(port_priv->pd);
3229:			goto error3;
3230:		}
3231:	
3232:		port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
3233:				IB_POLL_UNBOUND_WORKQUEUE);
3234:		if (IS_ERR(port_priv->cq)) {
3235:			dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
3236:			ret = PTR_ERR(port_priv->cq);
3237:			goto error4;
3238:		}
3239:	
3240:		if (has_smi) {
3241:			ret = create_mad_qp(&port_priv->qp_info[0], IB_QPT_SMI);
3242:			if (ret)
3243:				goto error6;
3244:		}
3245:	
3246:		if (rdma_cap_ib_cm(device, port_num)) {
3247:			ret = create_mad_qp(&port_priv->qp_info[1], IB_QPT_GSI);
3248:			if (ret)
3249:				goto error7;
3250:		}
3251:	
3252:		port_priv->wq = alloc_ordered_workqueue("ib_mad%u", WQ_MEM_RECLAIM,
3253:							port_num);
3254:		if (!port_priv->wq) {
3255:			ret = -ENOMEM;
3256:			goto error8;
3257:		}
3258:	
3259:		spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3260:		list_add_tail(&port_priv->port_list, &ib_mad_port_list);
3261:		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3262:	
3263:		ret = ib_mad_port_start(port_priv);
3264:		if (ret) {
3265:			dev_err(&device->dev, "Couldn't start port\n");
3266:			goto error9;
3267:		}
3268:	
3269:		return 0;
3270:	
3271:	error9:
3272:		spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3273:		list_del_init(&port_priv->port_list);
3274:		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3275:	
3276:		destroy_workqueue(port_priv->wq);
3277:	error8:
3278:		destroy_mad_qp(&port_priv->qp_info[1]);
3279:	error7:
3280:		destroy_mad_qp(&port_priv->qp_info[0]);
3281:	error6:
3282:		ib_free_cq(port_priv->cq);
3283:		cleanup_recv_queue(&port_priv->qp_info[1]);
3284:		cleanup_recv_queue(&port_priv->qp_info[0]);
3285:	error4:
3286:		ib_dealloc_pd(port_priv->pd);
3287:	error3:
3288:		kfree(port_priv);
3289:	
3290:		return ret;
3291:	}
 SourceFile:drivers/infiniband/core/mad.c]

gemini-3.1-pro-preview

							input: 54217
							output: 48
							thoughts: 23
						

Here's a summary of my thought process, as requested:

**Digging into the InfiniBand Initialization**

Okay, so I'm tracing the initialization sequence for this InfiniBand driver, and I've hit a specific point of interest. I'm focusing on the call flow and, more specifically, the `ib_mad_port_open` function. It's crucial for understanding how the Management Datagrams (MADs) are handled. I was just reviewing the broader picture and then I realized something key: `ib_mad_port_open` isn't called randomly, it's called *specifically* within the context of `ib_mad_init_device`. This detail is important, because this tells me something more about initialization process than I previously considered.

This means it's not a standalone function triggered independently. Instead, it's an integrated step within the device initialization itself. So, now my understanding is more complete, which should help as I continue my analysis.

map[ContextFile:drivers/infiniband/core/mad.c IncludeLines:true Name:ib_mad_init_device]

map[SourceCode:3327:	static int ib_mad_init_device(struct ib_device *device)
3328:	{
3329:		int start, i;
3330:		unsigned int count = 0;
3331:		int ret;
3332:	
3333:		start = rdma_start_port(device);
3334:	
3335:		for (i = start; i <= rdma_end_port(device); i++) {
3336:			if (!rdma_cap_ib_mad(device, i))
3337:				continue;
3338:	
3339:			ret = ib_mad_port_open(device, i);
3340:			if (ret) {
3341:				dev_err(&device->dev, "Couldn't open port %d\n", i);
3342:				goto error;
3343:			}
3344:			ret = ib_agent_port_open(device, i);
3345:			if (ret) {
3346:				dev_err(&device->dev,
3347:					"Couldn't open port %d for agents\n", i);
3348:				goto error_agent;
3349:			}
3350:			count++;
3351:		}
3352:		if (!count)
3353:			return -EOPNOTSUPP;
3354:	
3355:		return 0;
3356:	
3357:	error_agent:
3358:		if (ib_mad_port_close(device, i))
3359:			dev_err(&device->dev, "Couldn't close port %d\n", i);
3360:	
3361:	error:
3362:		while (--i >= start) {
3363:			if (!rdma_cap_ib_mad(device, i))
3364:				continue;
3365:	
3366:			if (ib_agent_port_close(device, i))
3367:				dev_err(&device->dev,
3368:					"Couldn't close port %d for agents\n", i);
3369:			if (ib_mad_port_close(device, i))
3370:				dev_err(&device->dev, "Couldn't close port %d\n", i);
3371:		}
3372:		return ret;
3373:	}
 SourceFile:drivers/infiniband/core/mad.c]

gemini-3.1-pro-preview

							input: 55197
							output: 47
							thoughts: 32
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**RDMA Capability Inquiry**

Alright, let's get down to it. I'm taking a look at `rxe` right now, and the critical question is whether it's got the capability to handle InfiniBand Management Datagrams. To be precise, I need to know if `rxe` has support for `rdma_cap_ib_mad`. That's the key bit of information I'm after, the crucial piece of the puzzle. Essentially, I need to verify that its RDMA implementation includes support for managing InfiniBand fabric resources. I know I have to check `rdma_cap_ib_mad`.

map[ContextFile:include/rdma/ib_verbs.h IncludeLines:true Name:rdma_cap_ib_mad]

map[SourceCode:3253:	/**
3254:	 * rdma_cap_ib_mad - Check if the port of a device supports Infiniband
3255:	 * Management Datagrams.
3256:	 * @device: Device to check
3257:	 * @port_num: Port number to check
3258:	 *
3259:	 * Management Datagrams (MAD) are a required part of the InfiniBand
3260:	 * specification and are supported on all InfiniBand devices.  A slightly
3261:	 * extended version are also supported on OPA interfaces.
3262:	 *
3263:	 * Return: true if the port supports sending/receiving of MAD packets.
3264:	 */
3265:	static inline bool rdma_cap_ib_mad(const struct ib_device *device, u32 port_num)
3266:	{
3267:		return device->port_data[port_num].immutable.core_cap_flags &
3268:		       RDMA_CORE_CAP_IB_MAD;
3269:	}
 SourceFile:include/rdma/ib_verbs.h]

gemini-3.1-pro-preview

							input: 55755
							output: 56
							thoughts: 62
						

**Decoding the RXE Encap Setting**

Okay, hold on a second. I'm looking at this `rxe` code and it seems to be assigning `immutable->core_cap_flags` to `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP`. That's interesting, I need to understand what that constant actually *means* in the context of this RDMA implementation. I should go check the definition for `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP` and make sure my understanding of this field and its interaction with the broader RXE architecture is spot on. I need to fully grasp how this encapsulation method figures into the system's overall data transport strategy.

requested entity does not exist

map[ContextFile:include/rdma/ib_verbs.h IncludeLines:true Name:RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 56050
							output: 31
							thoughts: 24
						

Here's a summary of my thought process, as requested:

**Diving into the RDMA Landscape**

Okay, so I'm looking into something RDMA-related, and the first thing that pops into my head is a specific string: `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP`. That string immediately tells me a few things. First, it suggests I'm dealing with RDMA, obviously, likely within the context of the `rdma-core` stack. The "PORT" implies network interface configuration, and "IBA" points to InfiniBand Architecture, indicating a possible InfiniBand connection. The presence of "ROCE" is critical; this hints at RDMA over Converged Ethernet. And finally, "UDP_ENCAP" is the kicker, signaling that we're talking about encapsulating the RDMA traffic within UDP packets, a common technique for traversing networks that don't directly support RDMA protocols. Now I need to figure out why this specific string came to mind, what I'm trying to achieve in regards to it, and what the context is. Are we troubleshooting a RoCE setup? Configuring an interface? Trying to optimize performance? The next step is to use grep to try to find its location, and hopefully with some context as well.

map[Expression:RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP]

map[Output:drivers/infiniband/hw/erdma/erdma_verbs.c=412=int erdma_get_port_immutable(struct ib_device *ibdev, u32 port,
--
drivers/infiniband/hw/erdma/erdma_verbs.c-421-		port_immutable->core_cap_flags =
drivers/infiniband/hw/erdma/erdma_verbs.c:422:			RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/erdma/erdma_verbs.c-423-		port_immutable->max_mad_size = IB_MGMT_MAD_SIZE;
--
drivers/infiniband/hw/hns/hns_roce_main.c=566=static int hns_roce_port_immutable(struct ib_device *ib_dev, u32 port_num,
--
drivers/infiniband/hw/hns/hns_roce_main.c-581-	if (to_hr_dev(ib_dev)->caps.flags & HNS_ROCE_CAP_FLAG_ROCE_V1_V2)
drivers/infiniband/hw/hns/hns_roce_main.c:582:		immutable->core_cap_flags |= RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/hns/hns_roce_main.c-583-
--
drivers/infiniband/hw/ionic/ionic_ibdev.c=148=static int ionic_get_port_immutable(struct ib_device *ibdev, u32 port,
--
drivers/infiniband/hw/ionic/ionic_ibdev.c-153-
drivers/infiniband/hw/ionic/ionic_ibdev.c:154:	attr->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/ionic/ionic_ibdev.c-155-
--
drivers/infiniband/hw/irdma/verbs.c=4591=static int irdma_roce_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/hw/irdma/verbs.c-4596-
drivers/infiniband/hw/irdma/verbs.c:4597:	immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/irdma/verbs.c-4598-	err = ib_query_port(ibdev, port_num, &attr);
--
drivers/infiniband/hw/mana/main.c=550=int mana_ib_get_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/hw/mana/main.c-565-		if (port_num == 1) {
drivers/infiniband/hw/mana/main.c:566:			immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/mana/main.c-567-			immutable->max_mad_size = IB_MGMT_MAD_SIZE;
--
drivers/infiniband/hw/mlx4/main.c=2476=static int mlx4_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/hw/mlx4/main.c-2490-			immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE |
drivers/infiniband/hw/mlx4/main.c:2491:				RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/mlx4/main.c-2492-		immutable->core_cap_flags |= RDMA_CORE_PORT_RAW_PACKET;
drivers/infiniband/hw/mlx4/main.c-2493-		if (immutable->core_cap_flags & (RDMA_CORE_PORT_IBA_ROCE |
drivers/infiniband/hw/mlx4/main.c:2494:		    RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP))
drivers/infiniband/hw/mlx4/main.c-2495-			immutable->max_mad_size = IB_MGMT_MAD_SIZE;
--
drivers/infiniband/hw/mlx5/main.c=3264=static u32 get_core_cap_flags(struct ib_device *ibdev,
--
drivers/infiniband/hw/mlx5/main.c-3299-	if (roce_version_cap & MLX5_ROCE_VERSION_2_CAP)
drivers/infiniband/hw/mlx5/main.c:3300:		ret |= RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/mlx5/main.c-3301-
--
drivers/infiniband/hw/qedr/main.c=84=static int qedr_roce_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/hw/qedr/main.c-96-	immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE |
drivers/infiniband/hw/qedr/main.c:97:	    RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/qedr/main.c-98-	immutable->max_mad_size = IB_MGMT_MAD_SIZE;
--
drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c=124=static int pvrdma_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c-133-	else if (dev->dsr->caps.gid_types == PVRDMA_GID_TYPE_FLAG_ROCE_V2)
drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c:134:		immutable->core_cap_flags |= RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c-135-
--
drivers/infiniband/sw/rxe/rxe_verbs.c=196=static int rxe_port_immutable(struct ib_device *ibdev, u32 port_num,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-212-
drivers/infiniband/sw/rxe/rxe_verbs.c:213:	immutable->core_cap_flags = RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP;
drivers/infiniband/sw/rxe/rxe_verbs.c-214-	immutable->pkey_tbl_len = attr.pkey_tbl_len;
--
include/rdma/ib_verbs.h=637=void rdma_free_hw_stats_struct(struct rdma_hw_stats *stats);
--
include/rdma/ib_verbs.h-678-					| RDMA_CORE_CAP_ETH_AH)
include/rdma/ib_verbs.h:679:#define RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP			\
include/rdma/ib_verbs.h-680-					(RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP \
]

gemini-3.1-pro-preview

							input: 58390
							output: 56
							thoughts: 84
						

Okay, here's my interpretation of that thought process, assuming I'm well-versed in RDMA internals:

**RDMA Capability Investigation**

Right, so I see `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP` and it's flagged as including `RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP`. That makes sense; it's the basic RoCE over UDP encapsulation support. The question that immediately pops into my head is: does this encompass InfiniBand MAD access as well? That can be critical for certain management tasks.

To make sure I'm clear on the exact capabilities, I'm going to quickly look up the definition of `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP`. I need to be absolutely certain what functionality is baked in here to avoid any gotchas down the line. It's best to be precise, especially when we are considering the implications of this setting.

requested entity does not exist

map[ContextFile:include/rdma/ib_verbs.h IncludeLines:true Name:RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 58763
							output: 25
							thoughts: 23
						

Here's my summary, as if I were thinking it:

**Digging into the RDMA Verbs Header**

Okay, so I need to refresh my memory on the specifics of the IB Verbs API, particularly in relation to this RDMA implementation. Let's see...I recall some crucial structures defined around the `ib_verbs.h` file, and I'm pretty sure a key element I need for this is likely in the vicinity of the `ibv_create_cq` definitions or the `ibv_cq` struct itself. I'll need to double-check error handling or context registration as well. Let's start by zeroing in on line 679 of `include/rdma/ib_verbs.h`. That location should give me a good starting point to jog my memory and pinpoint the particular piece of code I need to understand better. Hopefully, that will be close to the relevant structure or function definition I'm looking for. Let's see what's there...

map[File:include/rdma/ib_verbs.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */
/*
 * Copyright (c) 2004 Mellanox Technologies Ltd.  All rights reserved.
 * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
 * Copyright (c) 2004, 2020 Intel Corporation.  All rights reserved.
 * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
 * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
 * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
 * Copyright (c) 2005, 2006, 2007 Cisco Systems.  All rights reserved.
 */

#ifndef IB_VERBS_H
#define IB_VERBS_H

#include <linux/ethtool.h>
#include <linux/types.h>
#include <linux/device.h>
#include <linux/dma-mapping.h>
#include <linux/kref.h>
#include <linux/list.h>
#include <linux/rwsem.h>
#include <linux/workqueue.h>
#include <linux/irq_poll.h>
#include <uapi/linux/if_ether.h>
#include <net/ipv6.h>
#include <net/ip.h>
#include <linux/string.h>
#include <linux/slab.h>
#include <linux/netdevice.h>
#include <linux/refcount.h>
#include <linux/if_link.h>
#include <linux/atomic.h>
#include <linux/mmu_notifier.h>
#include <linux/uaccess.h>
#include <linux/cgroup_rdma.h>
#include <linux/irqflags.h>
#include <linux/preempt.h>
#include <linux/dim.h>
#include <uapi/rdma/ib_user_verbs.h>
#include <rdma/rdma_counter.h>
#include <rdma/restrack.h>
#include <rdma/signature.h>
#include <uapi/rdma/rdma_user_ioctl.h>
#include <uapi/rdma/ib_user_ioctl_verbs.h>
#include <linux/pci-tph.h>

#define IB_FW_VERSION_NAME_MAX	ETHTOOL_FWVERS_LEN

struct ib_umem_odp;
struct ib_uqp_object;
struct ib_usrq_object;
struct ib_uwq_object;
struct rdma_cm_id;
struct ib_port;
struct hw_stats_device_data;

extern struct workqueue_struct *ib_wq;
extern struct workqueue_struct *ib_comp_wq;
extern struct workqueue_struct *ib_comp_unbound_wq;

struct ib_ucq_object;

__printf(2, 3) __cold
void ibdev_emerg(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_alert(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_crit(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_err(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_warn(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_notice(const struct ib_device *ibdev, const char *format, ...);
__printf(2, 3) __cold
void ibdev_info(const struct ib_device *ibdev, const char *format, ...);

#if defined(CONFIG_DYNAMIC_DEBUG) || \
	(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
#define ibdev_dbg(__dev, format, args...)                       \
	dynamic_ibdev_dbg(__dev, format, ##args)
#else
__printf(2, 3) __cold
static inline
void ibdev_dbg(const struct ib_device *ibdev, const char *format, ...) {}
#endif

#define ibdev_level_ratelimited(ibdev_level, ibdev, fmt, ...)           \
do {                                                                    \
	static DEFINE_RATELIMIT_STATE(_rs,                              \
				      DEFAULT_RATELIMIT_INTERVAL,       \
				      DEFAULT_RATELIMIT_BURST);         \
	if (__ratelimit(&_rs))                                          \
		ibdev_level(ibdev, fmt, ##__VA_ARGS__);                 \
} while (0)

#define ibdev_emerg_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_emerg, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_alert_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_alert, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_crit_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_crit, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_err_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_err, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_warn_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_warn, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_notice_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_notice, ibdev, fmt, ##__VA_ARGS__)
#define ibdev_info_ratelimited(ibdev, fmt, ...) \
	ibdev_level_ratelimited(ibdev_info, ibdev, fmt, ##__VA_ARGS__)

#if defined(CONFIG_DYNAMIC_DEBUG) || \
	(defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE))
/* descriptor check is first to prevent flooding with "callbacks suppressed" */
#define ibdev_dbg_ratelimited(ibdev, fmt, ...)                          \
do {                                                                    \
	static DEFINE_RATELIMIT_STATE(_rs,                              \
				      DEFAULT_RATELIMIT_INTERVAL,       \
				      DEFAULT_RATELIMIT_BURST);         \
	DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt);                 \
	if (DYNAMIC_DEBUG_BRANCH(descriptor) && __ratelimit(&_rs))      \
		__dynamic_ibdev_dbg(&descriptor, ibdev, fmt,            \
				    ##__VA_ARGS__);                     \
} while (0)
#else
__printf(2, 3) __cold
static inline
void ibdev_dbg_ratelimited(const struct ib_device *ibdev, const char *format, ...) {}
#endif

union ib_gid {
	u8	raw[16];
	struct {
		__be64	subnet_prefix;
		__be64	interface_id;
	} global;
};

extern union ib_gid zgid;

enum ib_gid_type {
	IB_GID_TYPE_IB = IB_UVERBS_GID_TYPE_IB,
	IB_GID_TYPE_ROCE = IB_UVERBS_GID_TYPE_ROCE_V1,
	IB_GID_TYPE_ROCE_UDP_ENCAP = IB_UVERBS_GID_TYPE_ROCE_V2,
	IB_GID_TYPE_SIZE
};

#define ROCE_V2_UDP_DPORT      4791
struct ib_gid_attr {
	struct net_device __rcu	*ndev;
	struct ib_device	*device;
	union ib_gid		gid;
	enum ib_gid_type	gid_type;
	u16			index;
	u32			port_num;
};

enum {
	/* set the local administered indication */
	IB_SA_WELL_KNOWN_GUID	= BIT_ULL(57) | 2,
};

enum rdma_transport_type {
	RDMA_TRANSPORT_IB,
	RDMA_TRANSPORT_IWARP,
	RDMA_TRANSPORT_USNIC,
	RDMA_TRANSPORT_USNIC_UDP,
	RDMA_TRANSPORT_UNSPECIFIED,
};

enum rdma_protocol_type {
	RDMA_PROTOCOL_IB,
	RDMA_PROTOCOL_IBOE,
	RDMA_PROTOCOL_IWARP,
	RDMA_PROTOCOL_USNIC_UDP
};

__attribute_const__ enum rdma_transport_type
rdma_node_get_transport(unsigned int node_type);

enum rdma_network_type {
	RDMA_NETWORK_IB,
	RDMA_NETWORK_ROCE_V1,
	RDMA_NETWORK_IPV4,
	RDMA_NETWORK_IPV6
};

static inline enum ib_gid_type ib_network_to_gid_type(enum rdma_network_type network_type)
{
	if (network_type == RDMA_NETWORK_IPV4 ||
	    network_type == RDMA_NETWORK_IPV6)
		return IB_GID_TYPE_ROCE_UDP_ENCAP;
	else if (network_type == RDMA_NETWORK_ROCE_V1)
		return IB_GID_TYPE_ROCE;
	else
		return IB_GID_TYPE_IB;
}

static inline enum rdma_network_type
rdma_gid_attr_network_type(const struct ib_gid_attr *attr)
{
	if (attr->gid_type == IB_GID_TYPE_IB)
		return RDMA_NETWORK_IB;

	if (attr->gid_type == IB_GID_TYPE_ROCE)
		return RDMA_NETWORK_ROCE_V1;

	if (ipv6_addr_v4mapped((struct in6_addr *)&attr->gid))
		return RDMA_NETWORK_IPV4;
	else
		return RDMA_NETWORK_IPV6;
}

enum rdma_link_layer {
	IB_LINK_LAYER_UNSPECIFIED,
	IB_LINK_LAYER_INFINIBAND,
	IB_LINK_LAYER_ETHERNET,
};

enum ib_device_cap_flags {
	IB_DEVICE_RESIZE_MAX_WR = IB_UVERBS_DEVICE_RESIZE_MAX_WR,
	IB_DEVICE_BAD_PKEY_CNTR = IB_UVERBS_DEVICE_BAD_PKEY_CNTR,
	IB_DEVICE_BAD_QKEY_CNTR = IB_UVERBS_DEVICE_BAD_QKEY_CNTR,
	IB_DEVICE_RAW_MULTI = IB_UVERBS_DEVICE_RAW_MULTI,
	IB_DEVICE_AUTO_PATH_MIG = IB_UVERBS_DEVICE_AUTO_PATH_MIG,
	IB_DEVICE_CHANGE_PHY_PORT = IB_UVERBS_DEVICE_CHANGE_PHY_PORT,
	IB_DEVICE_UD_AV_PORT_ENFORCE = IB_UVERBS_DEVICE_UD_AV_PORT_ENFORCE,
	IB_DEVICE_CURR_QP_STATE_MOD = IB_UVERBS_DEVICE_CURR_QP_STATE_MOD,
	IB_DEVICE_SHUTDOWN_PORT = IB_UVERBS_DEVICE_SHUTDOWN_PORT,
	/* IB_DEVICE_INIT_TYPE = IB_UVERBS_DEVICE_INIT_TYPE, (not in use) */
	IB_DEVICE_PORT_ACTIVE_EVENT = IB_UVERBS_DEVICE_PORT_ACTIVE_EVENT,
	IB_DEVICE_SYS_IMAGE_GUID = IB_UVERBS_DEVICE_SYS_IMAGE_GUID,
	IB_DEVICE_RC_RNR_NAK_GEN = IB_UVERBS_DEVICE_RC_RNR_NAK_GEN,
	IB_DEVICE_SRQ_RESIZE = IB_UVERBS_DEVICE_SRQ_RESIZE,
	IB_DEVICE_N_NOTIFY_CQ = IB_UVERBS_DEVICE_N_NOTIFY_CQ,

	/* Reserved, old SEND_W_INV = 1 << 16,*/
	IB_DEVICE_MEM_WINDOW = IB_UVERBS_DEVICE_MEM_WINDOW,
	/*
	 * Devices should set IB_DEVICE_UD_IP_SUM if they support
	 * insertion of UDP and TCP checksum on outgoing UD IPoIB
	 * messages and can verify the validity of checksum for
	 * incoming messages.  Setting this flag implies that the
	 * IPoIB driver may set NETIF_F_IP_CSUM for datagram mode.
	 */
	IB_DEVICE_UD_IP_CSUM = IB_UVERBS_DEVICE_UD_IP_CSUM,
	IB_DEVICE_XRC = IB_UVERBS_DEVICE_XRC,

	/*
	 * This device supports the IB "base memory management extension",
	 * which includes support for fast registrations (IB_WR_REG_MR,
	 * IB_WR_LOCAL_INV and IB_WR_SEND_WITH_INV verbs).  This flag should
	 * also be set by any iWarp device which must support FRs to comply
	 * to the iWarp verbs spec.  iWarp devices also support the
	 * IB_WR_RDMA_READ_WITH_INV verb for RDMA READs that invalidate the
	 * stag.
	 */
	IB_DEVICE_MEM_MGT_EXTENSIONS = IB_UVERBS_DEVICE_MEM_MGT_EXTENSIONS,
	IB_DEVICE_MEM_WINDOW_TYPE_2A = IB_UVERBS_DEVICE_MEM_WINDOW_TYPE_2A,
	IB_DEVICE_MEM_WINDOW_TYPE_2B = IB_UVERBS_DEVICE_MEM_WINDOW_TYPE_2B,
	IB_DEVICE_RC_IP_CSUM = IB_UVERBS_DEVICE_RC_IP_CSUM,
	/* Deprecated. Please use IB_RAW_PACKET_CAP_IP_CSUM. */
	IB_DEVICE_RAW_IP_CSUM = IB_UVERBS_DEVICE_RAW_IP_CSUM,
	IB_DEVICE_MANAGED_FLOW_STEERING =
		IB_UVERBS_DEVICE_MANAGED_FLOW_STEERING,
	/* Deprecated. Please use IB_RAW_PACKET_CAP_SCATTER_FCS. */
	IB_DEVICE_RAW_SCATTER_FCS = IB_UVERBS_DEVICE_RAW_SCATTER_FCS,
	/* The device supports padding incoming writes to cacheline. */
	IB_DEVICE_PCI_WRITE_END_PADDING =
		IB_UVERBS_DEVICE_PCI_WRITE_END_PADDING,
	/* Placement type attributes */
	IB_DEVICE_FLUSH_GLOBAL = IB_UVERBS_DEVICE_FLUSH_GLOBAL,
	IB_DEVICE_FLUSH_PERSISTENT = IB_UVERBS_DEVICE_FLUSH_PERSISTENT,
	IB_DEVICE_ATOMIC_WRITE = IB_UVERBS_DEVICE_ATOMIC_WRITE,
};

enum ib_kernel_cap_flags {
	/*
	 * This device supports a per-device lkey or stag that can be
	 * used without performing a memory registration for the local
	 * memory.  Note that ULPs should never check this flag, but
	 * instead of use the local_dma_lkey flag in the ib_pd structure,
	 * which will always contain a usable lkey.
	 */
	IBK_LOCAL_DMA_LKEY = 1 << 0,
	/* IB_QP_CREATE_INTEGRITY_EN is supported to implement T10-PI */
	IBK_INTEGRITY_HANDOVER = 1 << 1,
	/* IB_ACCESS_ON_DEMAND is supported during reg_user_mr() */
	IBK_ON_DEMAND_PAGING = 1 << 2,
	/* IB_MR_TYPE_SG_GAPS is supported */
	IBK_SG_GAPS_REG = 1 << 3,
	/* Driver supports RDMA_NLDEV_CMD_DELLINK */
	IBK_ALLOW_USER_UNREG = 1 << 4,

	/* ipoib will use IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK */
	IBK_BLOCK_MULTICAST_LOOPBACK = 1 << 5,
	/* iopib will use IB_QP_CREATE_IPOIB_UD_LSO for its QPs */
	IBK_UD_TSO = 1 << 6,
	/* iopib will use the device ops:
	 *   get_vf_config
	 *   get_vf_guid
	 *   get_vf_stats
	 *   set_vf_guid
	 *   set_vf_link_state
	 */
	IBK_VIRTUAL_FUNCTION = 1 << 7,
	/* ipoib will use IB_QP_CREATE_NETDEV_USE for its QPs */
	IBK_RDMA_NETDEV_OPA = 1 << 8,
};

enum ib_atomic_cap {
	IB_ATOMIC_NONE,
	IB_ATOMIC_HCA,
	IB_ATOMIC_GLOB
};

enum ib_odp_general_cap_bits {
	IB_ODP_SUPPORT		= IB_UVERBS_ODP_SUPPORT,
	IB_ODP_SUPPORT_IMPLICIT = IB_UVERBS_ODP_SUPPORT_IMPLICIT,
};

enum ib_odp_transport_cap_bits {
	IB_ODP_SUPPORT_SEND	= IB_UVERBS_ODP_SUPPORT_SEND,
	IB_ODP_SUPPORT_RECV	= IB_UVERBS_ODP_SUPPORT_RECV,
	IB_ODP_SUPPORT_WRITE	= IB_UVERBS_ODP_SUPPORT_WRITE,
	IB_ODP_SUPPORT_READ	= IB_UVERBS_ODP_SUPPORT_READ,
	IB_ODP_SUPPORT_ATOMIC	= IB_UVERBS_ODP_SUPPORT_ATOMIC,
	IB_ODP_SUPPORT_SRQ_RECV	= IB_UVERBS_ODP_SUPPORT_SRQ_RECV,
	IB_ODP_SUPPORT_FLUSH	= IB_UVERBS_ODP_SUPPORT_FLUSH,
	IB_ODP_SUPPORT_ATOMIC_WRITE	= IB_UVERBS_ODP_SUPPORT_ATOMIC_WRITE,
};

struct ib_odp_caps {
	uint64_t general_caps;
	struct {
		uint32_t  rc_odp_caps;
		uint32_t  uc_odp_caps;
		uint32_t  ud_odp_caps;
		uint32_t  xrc_odp_caps;
	} per_transport_caps;
};

struct ib_rss_caps {
	/* Corresponding bit will be set if qp type from
	 * 'enum ib_qp_type' is supported, e.g.
	 * supported_qpts |= 1 << IB_QPT_UD
	 */
	u32 supported_qpts;
	u32 max_rwq_indirection_tables;
	u32 max_rwq_indirection_table_size;
};

enum ib_tm_cap_flags {
	/*  Support tag matching with rendezvous offload for RC transport */
	IB_TM_CAP_RNDV_RC = 1 << 0,
};

struct ib_tm_caps {
	/* Max size of RNDV header */
	u32 max_rndv_hdr_size;
	/* Max number of entries in tag matching list */
	u32 max_num_tags;
	/* From enum ib_tm_cap_flags */
	u32 flags;
	/* Max number of outstanding list operations */
	u32 max_ops;
	/* Max number of SGE in tag matching entry */
	u32 max_sge;
};

struct ib_cq_init_attr {
	unsigned int	cqe;
	u32		comp_vector;
	u32		flags;
};

enum ib_cq_attr_mask {
	IB_CQ_MODERATE = 1 << 0,
};

struct ib_cq_caps {
	u16     max_cq_moderation_count;
	u16     max_cq_moderation_period;
};

struct ib_dm_mr_attr {
	u64		length;
	u64		offset;
	u32		access_flags;
};

struct ib_dm_alloc_attr {
	u64	length;
	u32	alignment;
	u32	flags;
};

struct ib_device_attr {
	u64			fw_ver;
	__be64			sys_image_guid;
	u64			max_mr_size;
	u64			page_size_cap;
	u32			vendor_id;
	u32			vendor_part_id;
	u32			hw_ver;
	int			max_qp;
	int			max_qp_wr;
	u64			device_cap_flags;
	u64			kernel_cap_flags;
	int			max_send_sge;
	int			max_recv_sge;
	int			max_sge_rd;
	int			max_cq;
	int			max_cqe;
	int			max_mr;
	int			max_pd;
	int			max_qp_rd_atom;
	int			max_ee_rd_atom;
	int			max_res_rd_atom;
	int			max_qp_init_rd_atom;
	int			max_ee_init_rd_atom;
	enum ib_atomic_cap	atomic_cap;
	enum ib_atomic_cap	masked_atomic_cap;
	int			max_ee;
	int			max_rdd;
	int			max_mw;
	int			max_raw_ipv6_qp;
	int			max_raw_ethy_qp;
	int			max_mcast_grp;
	int			max_mcast_qp_attach;
	int			max_total_mcast_qp_attach;
	int			max_ah;
	int			max_srq;
	int			max_srq_wr;
	int			max_srq_sge;
	unsigned int		max_fast_reg_page_list_len;
	unsigned int		max_pi_fast_reg_page_list_len;
	u16			max_pkeys;
	u8			local_ca_ack_delay;
	int			sig_prot_cap;
	int			sig_guard_cap;
	struct ib_odp_caps	odp_caps;
	uint64_t		timestamp_mask;
	uint64_t		hca_core_clock; /* in KHZ */
	struct ib_rss_caps	rss_caps;
	u32			max_wq_type_rq;
	u32			raw_packet_caps; /* Use ib_raw_packet_caps enum */
	struct ib_tm_caps	tm_caps;
	struct ib_cq_caps       cq_caps;
	u64			max_dm_size;
	/* Max entries for sgl for optimized performance per READ */
	u32			max_sgl_rd;
};

enum ib_mtu {
	IB_MTU_256  = 1,
	IB_MTU_512  = 2,
	IB_MTU_1024 = 3,
	IB_MTU_2048 = 4,
	IB_MTU_4096 = 5
};

enum opa_mtu {
	OPA_MTU_8192 = 6,
	OPA_MTU_10240 = 7
};

static inline int ib_mtu_enum_to_int(enum ib_mtu mtu)
{
	switch (mtu) {
	case IB_MTU_256:  return  256;
	case IB_MTU_512:  return  512;
	case IB_MTU_1024: return 1024;
	case IB_MTU_2048: return 2048;
	case IB_MTU_4096: return 4096;
	default: 	  return -1;
	}
}

static inline enum ib_mtu ib_mtu_int_to_enum(int mtu)
{
	if (mtu >= 4096)
		return IB_MTU_4096;
	else if (mtu >= 2048)
		return IB_MTU_2048;
	else if (mtu >= 1024)
		return IB_MTU_1024;
	else if (mtu >= 512)
		return IB_MTU_512;
	else
		return IB_MTU_256;
}

static inline int opa_mtu_enum_to_int(enum opa_mtu mtu)
{
	switch (mtu) {
	case OPA_MTU_8192:
		return 8192;
	case OPA_MTU_10240:
		return 10240;
	default:
		return(ib_mtu_enum_to_int((enum ib_mtu)mtu));
	}
}

static inline enum opa_mtu opa_mtu_int_to_enum(int mtu)
{
	if (mtu >= 10240)
		return OPA_MTU_10240;
	else if (mtu >= 8192)
		return OPA_MTU_8192;
	else
		return ((enum opa_mtu)ib_mtu_int_to_enum(mtu));
}

enum ib_port_state {
	IB_PORT_NOP		= 0,
	IB_PORT_DOWN		= 1,
	IB_PORT_INIT		= 2,
	IB_PORT_ARMED		= 3,
	IB_PORT_ACTIVE		= 4,
	IB_PORT_ACTIVE_DEFER	= 5
};

static inline const char *__attribute_const__
ib_port_state_to_str(enum ib_port_state state)
{
	const char * const states[] = {
		[IB_PORT_NOP] = "NOP",
		[IB_PORT_DOWN] = "DOWN",
		[IB_PORT_INIT] = "INIT",
		[IB_PORT_ARMED] = "ARMED",
		[IB_PORT_ACTIVE] = "ACTIVE",
		[IB_PORT_ACTIVE_DEFER] = "ACTIVE_DEFER",
	};

	if (state < ARRAY_SIZE(states))
		return states[state];
	return "UNKNOWN";
}

enum ib_port_phys_state {
	IB_PORT_PHYS_STATE_SLEEP = 1,
	IB_PORT_PHYS_STATE_POLLING = 2,
	IB_PORT_PHYS_STATE_DISABLED = 3,
	IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING = 4,
	IB_PORT_PHYS_STATE_LINK_UP = 5,
	IB_PORT_PHYS_STATE_LINK_ERROR_RECOVERY = 6,
	IB_PORT_PHYS_STATE_PHY_TEST = 7,
};

enum ib_port_width {
	IB_WIDTH_1X	= 1,
	IB_WIDTH_2X	= 16,
	IB_WIDTH_4X	= 2,
	IB_WIDTH_8X	= 4,
	IB_WIDTH_12X	= 8
};

static inline int ib_width_enum_to_int(enum ib_port_width width)
{
	switch (width) {
	case IB_WIDTH_1X:  return  1;
	case IB_WIDTH_2X:  return  2;
	case IB_WIDTH_4X:  return  4;
	case IB_WIDTH_8X:  return  8;
	case IB_WIDTH_12X: return 12;
	default: 	  return -1;
	}
}

enum ib_port_speed {
	IB_SPEED_SDR	= 1,
	IB_SPEED_DDR	= 2,
	IB_SPEED_QDR	= 4,
	IB_SPEED_FDR10	= 8,
	IB_SPEED_FDR	= 16,
	IB_SPEED_EDR	= 32,
	IB_SPEED_HDR	= 64,
	IB_SPEED_NDR	= 128,
	IB_SPEED_XDR	= 256,
};

enum ib_stat_flag {
	IB_STAT_FLAG_OPTIONAL = 1 << 0,
};

/**
 * struct rdma_stat_desc - description of one rdma stat/counter
 * @name: The name of the counter
 * @flags: Flags of the counter; For example, IB_STAT_FLAG_OPTIONAL
 * @priv: Driver private information; Core code should not use
 */
struct rdma_stat_desc {
	const char *name;
	unsigned int flags;
	const void *priv;
};

/**
 * struct rdma_hw_stats - collection of hardware stats and their management
 * @lock: Mutex to protect parallel write access to lifespan and values
 *    of counters, which are 64bits and not guaranteed to be written
 *    atomicaly on 32bits systems.
 * @timestamp: Used by the core code to track when the last update was
 * @lifespan: Used by the core code to determine how old the counters
 *   should be before being updated again.  Stored in jiffies, defaults
 *   to 10 milliseconds, drivers can override the default be specifying
 *   their own value during their allocation routine.
 * @descs: Array of pointers to static descriptors used for the counters
 *   in directory.
 * @is_disabled: A bitmap to indicate each counter is currently disabled
 *   or not.
 * @num_counters: How many hardware counters there are.  If name is
 *   shorter than this number, a kernel oops will result.  Driver authors
 *   are encouraged to leave BUILD_BUG_ON(ARRAY_SIZE(@name) < num_counters)
 *   in their code to prevent this.
 * @value: Array of u64 counters that are accessed by the sysfs code and
 *   filled in by the drivers get_stats routine
 */
struct rdma_hw_stats {
	struct mutex	lock; /* Protect lifespan and values[] */
	unsigned long	timestamp;
	unsigned long	lifespan;
	const struct rdma_stat_desc *descs;
	unsigned long	*is_disabled;
	int		num_counters;
	u64		value[] __counted_by(num_counters);
};

#define RDMA_HW_STATS_DEFAULT_LIFESPAN 10

struct rdma_hw_stats *rdma_alloc_hw_stats_struct(
	const struct rdma_stat_desc *descs, int num_counters,
	unsigned long lifespan);

void rdma_free_hw_stats_struct(struct rdma_hw_stats *stats);

/* Define bits for the various functionality this port needs to be supported by
 * the core.
 */
/* Management                           0x00000FFF */
#define RDMA_CORE_CAP_IB_MAD            0x00000001
#define RDMA_CORE_CAP_IB_SMI            0x00000002
#define RDMA_CORE_CAP_IB_CM             0x00000004
#define RDMA_CORE_CAP_IW_CM             0x00000008
#define RDMA_CORE_CAP_IB_SA             0x00000010
#define RDMA_CORE_CAP_OPA_MAD           0x00000020

/* Address format                       0x000FF000 */
#define RDMA_CORE_CAP_AF_IB             0x00001000
#define RDMA_CORE_CAP_ETH_AH            0x00002000
#define RDMA_CORE_CAP_OPA_AH            0x00004000
#define RDMA_CORE_CAP_IB_GRH_REQUIRED   0x00008000

/* Protocol                             0xFFF00000 */
#define RDMA_CORE_CAP_PROT_IB           0x00100000
#define RDMA_CORE_CAP_PROT_ROCE         0x00200000
#define RDMA_CORE_CAP_PROT_IWARP        0x00400000
#define RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP 0x00800000
#define RDMA_CORE_CAP_PROT_RAW_PACKET   0x01000000
#define RDMA_CORE_CAP_PROT_USNIC        0x02000000

#define RDMA_CORE_PORT_IB_GRH_REQUIRED (RDMA_CORE_CAP_IB_GRH_REQUIRED \
					| RDMA_CORE_CAP_PROT_ROCE     \
					| RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP)

#define RDMA_CORE_PORT_IBA_IB          (RDMA_CORE_CAP_PROT_IB  \
					| RDMA_CORE_CAP_IB_MAD \
					| RDMA_CORE_CAP_IB_SMI \
					| RDMA_CORE_CAP_IB_CM  \
					| RDMA_CORE_CAP_IB_SA  \
					| RDMA_CORE_CAP_AF_IB)
#define RDMA_CORE_PORT_IBA_ROCE        (RDMA_CORE_CAP_PROT_ROCE \
					| RDMA_CORE_CAP_IB_MAD  \
					| RDMA_CORE_CAP_IB_CM   \
					| RDMA_CORE_CAP_AF_IB   \
					| RDMA_CORE_CAP_ETH_AH)
#define RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP			\
					(RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP \
					| RDMA_CORE_CAP_IB_MAD  \
					| RDMA_CORE_CAP_IB_CM   \
					| RDMA_CORE_CAP_AF_IB   \
					| RDMA_CORE_CAP_ETH_AH)
#define RDMA_CORE_PORT_IWARP           (RDMA_CORE_CAP_PROT_IWARP \
					| RDMA_CORE_CAP_IW_CM)
#define RDMA_CORE_PORT_INTEL_OPA       (RDMA_CORE_PORT_IBA_IB  \
					| RDMA_CORE_CAP_OPA_MAD)

#define RDMA_CORE_PORT_RAW_PACKET	(RDMA_CORE_CAP_PROT_RAW_PACKET)

#define RDMA_CORE_PORT_USNIC		(RDMA_CORE_CAP_PROT_USNIC)

struct ib_port_attr {
	u64			subnet_prefix;
	enum ib_port_state	state;
	enum ib_mtu		max_mtu;
	enum ib_mtu		active_mtu;
	u32                     phys_mtu;
	int			gid_tbl_len;
	unsigned int		ip_gids:1;
	/* This is the value from PortInfo CapabilityMask, defined by IBA */
	u32			port_cap_flags;
	u32			max_msg_sz;
	u32			bad_pkey_cntr;
	u32			qkey_viol_cntr;
	u16			pkey_tbl_len;
	u32			sm_lid;
	u32			lid;
	u8			lmc;
	u8			max_vl_num;
	u8			sm_sl;
	u8			subnet_timeout;
	u8			init_type_reply;
	u8			active_width;
	u16			active_speed;
	u8                      phys_state;
	u16			port_cap_flags2;
};

enum ib_device_modify_flags {
	IB_DEVICE_MODIFY_SYS_IMAGE_GUID	= 1 << 0,
	IB_DEVICE_MODIFY_NODE_DESC	= 1 << 1
};

#define IB_DEVICE_NODE_DESC_MAX 64

struct ib_device_modify {
	u64	sys_image_guid;
	char	node_desc[IB_DEVICE_NODE_DESC_MAX];
};

enum ib_port_modify_flags {
	IB_PORT_SHUTDOWN		= 1,
	IB_PORT_INIT_TYPE		= (1<<2),
	IB_PORT_RESET_QKEY_CNTR		= (1<<3),
	IB_PORT_OPA_MASK_CHG		= (1<<4)
};

struct ib_port_modify {
	u32	set_port_cap_mask;
	u32	clr_port_cap_mask;
	u8	init_type;
};

enum ib_event_type {
	IB_EVENT_CQ_ERR,
	IB_EVENT_QP_FATAL,
	IB_EVENT_QP_REQ_ERR,
	IB_EVENT_QP_ACCESS_ERR,
	IB_EVENT_COMM_EST,
	IB_EVENT_SQ_DRAINED,
	IB_EVENT_PATH_MIG,
	IB_EVENT_PATH_MIG_ERR,
	IB_EVENT_DEVICE_FATAL,
	IB_EVENT_PORT_ACTIVE,
	IB_EVENT_PORT_ERR,
	IB_EVENT_LID_CHANGE,
	IB_EVENT_PKEY_CHANGE,
	IB_EVENT_SM_CHANGE,
	IB_EVENT_SRQ_ERR,
	IB_EVENT_SRQ_LIMIT_REACHED,
	IB_EVENT_QP_LAST_WQE_REACHED,
	IB_EVENT_CLIENT_REREGISTER,
	IB_EVENT_GID_CHANGE,
	IB_EVENT_WQ_FATAL,
};

const char *__attribute_const__ ib_event_msg(enum ib_event_type event);

struct ib_event {
	struct ib_device	*device;
	union {
		struct ib_cq	*cq;
		struct ib_qp	*qp;
		struct ib_srq	*srq;
		struct ib_wq	*wq;
		u32		port_num;
	} element;
	enum ib_event_type	event;
};

struct ib_event_handler {
	struct ib_device *device;
	void            (*handler)(struct ib_event_handler *, struct ib_event *);
	struct list_head  list;
};

#define INIT_IB_EVENT_HANDLER(_ptr, _device, _handler)		\
	do {							\
		(_ptr)->device  = _device;			\
		(_ptr)->handler = _handler;			\
		INIT_LIST_HEAD(&(_ptr)->list);			\
	} while (0)

struct ib_global_route {
	const struct ib_gid_attr *sgid_attr;
	union ib_gid	dgid;
	u32		flow_label;
	u8		sgid_index;
	u8		hop_limit;
	u8		traffic_class;
};

struct ib_grh {
	__be32		version_tclass_flow;
	__be16		paylen;
	u8		next_hdr;
	u8		hop_limit;
	union ib_gid	sgid;
	union ib_gid	dgid;
};

union rdma_network_hdr {
	struct ib_grh ibgrh;
	struct {
		/* The IB spec states that if it's IPv4, the header
		 * is located in the last 20 bytes of the header.
		 */
		u8		reserved[20];
		struct iphdr	roce4grh;
	};
};

#define IB_QPN_MASK		0xFFFFFF

enum {
	IB_MULTICAST_QPN = 0xffffff
};

#define IB_LID_PERMISSIVE	cpu_to_be16(0xFFFF)
#define IB_MULTICAST_LID_BASE	cpu_to_be16(0xC000)

enum ib_ah_flags {
	IB_AH_GRH	= 1
};

enum ib_rate {
	IB_RATE_PORT_CURRENT = 0,
	IB_RATE_2_5_GBPS = 2,
	IB_RATE_5_GBPS   = 5,
	IB_RATE_10_GBPS  = 3,
	IB_RATE_20_GBPS  = 6,
	IB_RATE_30_GBPS  = 4,
	IB_RATE_40_GBPS  = 7,
	IB_RATE_60_GBPS  = 8,
	IB_RATE_80_GBPS  = 9,
	IB_RATE_120_GBPS = 10,
	IB_RATE_14_GBPS  = 11,
	IB_RATE_56_GBPS  = 12,
	IB_RATE_112_GBPS = 13,
	IB_RATE_168_GBPS = 14,
	IB_RATE_25_GBPS  = 15,
	IB_RATE_100_GBPS = 16,
	IB_RATE_200_GBPS = 17,
	IB_RATE_300_GBPS = 18,
	IB_RATE_28_GBPS  = 19,
	IB_RATE_50_GBPS  = 20,
	IB_RATE_400_GBPS = 21,
	IB_RATE_600_GBPS = 22,
	IB_RATE_800_GBPS = 23,
	IB_RATE_1600_GBPS = 25,
};

/**
 * ib_rate_to_mult - Convert the IB rate enum to a multiple of the
 * base rate of 2.5 Gbit/sec.  For example, IB_RATE_5_GBPS will be
 * converted to 2, since 5 Gbit/sec is 2 * 2.5 Gbit/sec.
 * @rate: rate to convert.
 */
__attribute_const__ int ib_rate_to_mult(enum ib_rate rate);

/**
 * ib_rate_to_mbps - Convert the IB rate enum to Mbps.
 * For example, IB_RATE_2_5_GBPS will be converted to 2500.
 * @rate: rate to convert.
 */
__attribute_const__ int ib_rate_to_mbps(enum ib_rate rate);


/**
 * enum ib_mr_type - memory region type
 * @IB_MR_TYPE_MEM_REG:       memory region that is used for
 *                            normal registration
 * @IB_MR_TYPE_SG_GAPS:       memory region that is capable to
 *                            register any arbitrary sg lists (without
 *                            the normal mr constraints - see
 *                            ib_map_mr_sg)
 * @IB_MR_TYPE_DM:            memory region that is used for device
 *                            memory registration
 * @IB_MR_TYPE_USER:          memory region that is used for the user-space
 *                            application
 * @IB_MR_TYPE_DMA:           memory region that is used for DMA operations
 *                            without address translations (VA=PA)
 * @IB_MR_TYPE_INTEGRITY:     memory region that is used for
 *                            data integrity operations
 */
enum ib_mr_type {
	IB_MR_TYPE_MEM_REG,
	IB_MR_TYPE_SG_GAPS,
	IB_MR_TYPE_DM,
	IB_MR_TYPE_USER,
	IB_MR_TYPE_DMA,
	IB_MR_TYPE_INTEGRITY,
};

enum ib_mr_status_check {
	IB_MR_CHECK_SIG_STATUS = 1,
};

/**
 * struct ib_mr_status - Memory region status container
 *
 * @fail_status: Bitmask of MR checks status. For each
 *     failed check a corresponding status bit is set.
 * @sig_err: Additional info for IB_MR_CEHCK_SIG_STATUS
 *     failure.
 */
struct ib_mr_status {
	u32		    fail_status;
	struct ib_sig_err   sig_err;
};

/**
 * mult_to_ib_rate - Convert a multiple of 2.5 Gbit/sec to an IB rate
 * enum.
 * @mult: multiple to convert.
 */
__attribute_const__ enum ib_rate mult_to_ib_rate(int mult);

struct rdma_ah_init_attr {
	struct rdma_ah_attr *ah_attr;
	u32 flags;
	struct net_device *xmit_slave;
};

enum rdma_ah_attr_type {
	RDMA_AH_ATTR_TYPE_UNDEFINED,
	RDMA_AH_ATTR_TYPE_IB,
	RDMA_AH_ATTR_TYPE_ROCE,
	RDMA_AH_ATTR_TYPE_OPA,
};

struct ib_ah_attr {
	u16			dlid;
	u8			src_path_bits;
};

struct roce_ah_attr {
	u8			dmac[ETH_ALEN];
};

struct opa_ah_attr {
	u32			dlid;
	u8			src_path_bits;
	bool			make_grd;
};

struct rdma_ah_attr {
	struct ib_global_route	grh;
	u8			sl;
	u8			static_rate;
	u32			port_num;
	u8			ah_flags;
	enum rdma_ah_attr_type type;
	union {
		struct ib_ah_attr ib;
		struct roce_ah_attr roce;
		struct opa_ah_attr opa;
	};
};

enum ib_wc_status {
	IB_WC_SUCCESS,
	IB_WC_LOC_LEN_ERR,
	IB_WC_LOC_QP_OP_ERR,
	IB_WC_LOC_EEC_OP_ERR,
	IB_WC_LOC_PROT_ERR,
	IB_WC_WR_FLUSH_ERR,
	IB_WC_MW_BIND_ERR,
	IB_WC_BAD_RESP_ERR,
	IB_WC_LOC_ACCESS_ERR,
	IB_WC_REM_INV_REQ_ERR,
	IB_WC_REM_ACCESS_ERR,
	IB_WC_REM_OP_ERR,
	IB_WC_RETRY_EXC_ERR,
	IB_WC_RNR_RETRY_EXC_ERR,
	IB_WC_LOC_RDD_VIOL_ERR,
	IB_WC_REM_INV_RD_REQ_ERR,
	IB_WC_REM_ABORT_ERR,
	IB_WC_INV_EECN_ERR,
	IB_WC_INV_EEC_STATE_ERR,
	IB_WC_FATAL_ERR,
	IB_WC_RESP_TIMEOUT_ERR,
	IB_WC_GENERAL_ERR
};

const char *__attribute_const__ ib_wc_status_msg(enum ib_wc_status status);

enum ib_wc_opcode {
	IB_WC_SEND = IB_UVERBS_WC_SEND,
	IB_WC_RDMA_WRITE = IB_UVERBS_WC_RDMA_WRITE,
	IB_WC_RDMA_READ = IB_UVERBS_WC_RDMA_READ,
	IB_WC_COMP_SWAP = IB_UVERBS_WC_COMP_SWAP,
	IB_WC_FETCH_ADD = IB_UVERBS_WC_FETCH_ADD,
	IB_WC_BIND_MW = IB_UVERBS_WC_BIND_MW,
	IB_WC_LOCAL_INV = IB_UVERBS_WC_LOCAL_INV,
	IB_WC_LSO = IB_UVERBS_WC_TSO,
	IB_WC_ATOMIC_WRITE = IB_UVERBS_WC_ATOMIC_WRITE,
	IB_WC_REG_MR,
	IB_WC_MASKED_COMP_SWAP,
	IB_WC_MASKED_FETCH_ADD,
	IB_WC_FLUSH = IB_UVERBS_WC_FLUSH,
/*
 * Set value of IB_WC_RECV so consumers can test if a completion is a
 * receive by testing (opcode & IB_WC_RECV).
 */
	IB_WC_RECV			= 1 << 7,
	IB_WC_RECV_RDMA_WITH_IMM
};

enum ib_wc_flags {
	IB_WC_GRH		= 1,
	IB_WC_WITH_IMM		= (1<<1),
	IB_WC_WITH_INVALIDATE	= (1<<2),
	IB_WC_IP_CSUM_OK	= (1<<3),
	IB_WC_WITH_SMAC		= (1<<4),
	IB_WC_WITH_VLAN		= (1<<5),
	IB_WC_WITH_NETWORK_HDR_TYPE	= (1<<6),
};

struct ib_wc {
	union {
		u64		wr_id;
		struct ib_cqe	*wr_cqe;
	};
	enum ib_wc_status	status;
	enum ib_wc_opcode	opcode;
	u32			vendor_err;
	u32			byte_len;
	struct ib_qp	       *qp;
	union {
		__be32		imm_data;
		u32		invalidate_rkey;
	} ex;
	u32			src_qp;
	u32			slid;
	int			wc_flags;
	u16			pkey_index;
	u8			sl;
	u8			dlid_path_bits;
	u32 port_num; /* valid only for DR SMPs on switches */
	u8			smac[ETH_ALEN];
	u16			vlan_id;
	u8			network_hdr_type;
};

enum ib_cq_notify_flags {
	IB_CQ_SOLICITED			= 1 << 0,
	IB_CQ_NEXT_COMP			= 1 << 1,
	IB_CQ_SOLICITED_MASK		= IB_CQ_SOLICITED | IB_CQ_NEXT_COMP,
	IB_CQ_REPORT_MISSED_EVENTS	= 1 << 2,
};

enum ib_srq_type {
	IB_SRQT_BASIC = IB_UVERBS_SRQT_BASIC,
	IB_SRQT_XRC = IB_UVERBS_SRQT_XRC,
	IB_SRQT_TM = IB_UVERBS_SRQT_TM,
};

static inline bool ib_srq_has_cq(enum ib_srq_type srq_type)
{
	return srq_type == IB_SRQT_XRC ||
	       srq_type == IB_SRQT_TM;
}

enum ib_srq_attr_mask {
	IB_SRQ_MAX_WR	= 1 << 0,
	IB_SRQ_LIMIT	= 1 << 1,
};

struct ib_srq_attr {
	u32	max_wr;
	u32	max_sge;
	u32	srq_limit;
};

struct ib_srq_init_attr {
	void		      (*event_handler)(struct ib_event *, void *);
	void		       *srq_context;
	struct ib_srq_attr	attr;
	enum ib_srq_type	srq_type;

	struct {
		struct ib_cq   *cq;
		union {
			struct {
				struct ib_xrcd *xrcd;
			} xrc;

			struct {
				u32		max_num_tags;
			} tag_matching;
		};
	} ext;
};

struct ib_qp_cap {
	u32	max_send_wr;
	u32	max_recv_wr;
	u32	max_send_sge;
	u32	max_recv_sge;
	u32	max_inline_data;

	/*
	 * Maximum number of rdma_rw_ctx structures in flight at a time.
	 * ib_create_qp() will calculate the right amount of needed WRs
	 * and MRs based on this.
	 */
	u32	max_rdma_ctxs;
};

enum ib_sig_type {
	IB_SIGNAL_ALL_WR,
	IB_SIGNAL_REQ_WR
};

enum ib_qp_type {
	/*
	 * IB_QPT_SMI and IB_QPT_GSI have to be the first two entries
	 * here (and in that order) since the MAD layer uses them as
	 * indices into a 2-entry table.
	 */
	IB_QPT_SMI,
	IB_QPT_GSI,

	IB_QPT_RC = IB_UVERBS_QPT_RC,
	IB_QPT_UC = IB_UVERBS_QPT_UC,
	IB_QPT_UD = IB_UVERBS_QPT_UD,
	IB_QPT_RAW_IPV6,
	IB_QPT_RAW_ETHERTYPE,
	IB_QPT_RAW_PACKET = IB_UVERBS_QPT_RAW_PACKET,
	IB_QPT_XRC_INI = IB_UVERBS_QPT_XRC_INI,
	IB_QPT_XRC_TGT = IB_UVERBS_QPT_XRC_TGT,
	IB_QPT_MAX,
	IB_QPT_DRIVER = IB_UVERBS_QPT_DRIVER,
	/* Reserve a range for qp types internal to the low level driver.
	 * These qp types will not be visible at the IB core layer, so the
	 * IB_QPT_MAX usages should not be affected in the core layer
	 */
	IB_QPT_RESERVED1 = 0x1000,
	IB_QPT_RESERVED2,
	IB_QPT_RESERVED3,
	IB_QPT_RESERVED4,
	IB_QPT_RESERVED5,
	IB_QPT_RESERVED6,
	IB_QPT_RESERVED7,
	IB_QPT_RESERVED8,
	IB_QPT_RESERVED9,
	IB_QPT_RESERVED10,
};

enum ib_qp_create_flags {
	IB_QP_CREATE_IPOIB_UD_LSO		= 1 << 0,
	IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK	=
		IB_UVERBS_QP_CREATE_BLOCK_MULTICAST_LOOPBACK,
	IB_QP_CREATE_CROSS_CHANNEL              = 1 << 2,
	IB_QP_CREATE_MANAGED_SEND               = 1 << 3,
	IB_QP_CREATE_MANAGED_RECV               = 1 << 4,
	IB_QP_CREATE_NETIF_QP			= 1 << 5,
	IB_QP_CREATE_INTEGRITY_EN		= 1 << 6,
	IB_QP_CREATE_NETDEV_USE			= 1 << 7,
	IB_QP_CREATE_SCATTER_FCS		=
		IB_UVERBS_QP_CREATE_SCATTER_FCS,
	IB_QP_CREATE_CVLAN_STRIPPING		=
		IB_UVERBS_QP_CREATE_CVLAN_STRIPPING,
	IB_QP_CREATE_SOURCE_QPN			= 1 << 10,
	IB_QP_CREATE_PCI_WRITE_END_PADDING	=
		IB_UVERBS_QP_CREATE_PCI_WRITE_END_PADDING,
	/* reserve bits 26-31 for low level drivers' internal use */
	IB_QP_CREATE_RESERVED_START		= 1 << 26,
	IB_QP_CREATE_RESERVED_END		= 1 << 31,
};

/*
 * Note: users may not call ib_close_qp or ib_destroy_qp from the event_handler
 * callback to destroy the passed in QP.
 */

struct ib_qp_init_attr {
	/* This callback occurs in workqueue context */
	void                  (*event_handler)(struct ib_event *, void *);

	void		       *qp_context;
	struct ib_cq	       *send_cq;
	struct ib_cq	       *recv_cq;
	struct ib_srq	       *srq;
	struct ib_xrcd	       *xrcd;     /* XRC TGT QPs only */
	struct ib_qp_cap	cap;
	enum ib_sig_type	sq_sig_type;
	enum ib_qp_type		qp_type;
	u32			create_flags;

	/*
	 * Only needed for special QP types, or when using the RW API.
	 */
	u32			port_num;
	struct ib_rwq_ind_table *rwq_ind_tbl;
	u32			source_qpn;
};

struct ib_qp_open_attr {
	void                  (*event_handler)(struct ib_event *, void *);
	void		       *qp_context;
	u32			qp_num;
	enum ib_qp_type		qp_type;
};

enum ib_rnr_timeout {
	IB_RNR_TIMER_655_36 =  0,
	IB_RNR_TIMER_000_01 =  1,
	IB_RNR_TIMER_000_02 =  2,
	IB_RNR_TIMER_000_03 =  3,
	IB_RNR_TIMER_000_04 =  4,
	IB_RNR_TIMER_000_06 =  5,
	IB_RNR_TIMER_000_08 =  6,
	IB_RNR_TIMER_000_12 =  7,
	IB_RNR_TIMER_000_16 =  8,
	IB_RNR_TIMER_000_24 =  9,
	IB_RNR_TIMER_000_32 = 10,
	IB_RNR_TIMER_000_48 = 11,
	IB_RNR_TIMER_000_64 = 12,
	IB_RNR_TIMER_000_96 = 13,
	IB_RNR_TIMER_001_28 = 14,
	IB_RNR_TIMER_001_92 = 15,
	IB_RNR_TIMER_002_56 = 16,
	IB_RNR_TIMER_003_84 = 17,
	IB_RNR_TIMER_005_12 = 18,
	IB_RNR_TIMER_007_68 = 19,
	IB_RNR_TIMER_010_24 = 20,
	IB_RNR_TIMER_015_36 = 21,
	IB_RNR_TIMER_020_48 = 22,
	IB_RNR_TIMER_030_72 = 23,
	IB_RNR_TIMER_040_96 = 24,
	IB_RNR_TIMER_061_44 = 25,
	IB_RNR_TIMER_081_92 = 26,
	IB_RNR_TIMER_122_88 = 27,
	IB_RNR_TIMER_163_84 = 28,
	IB_RNR_TIMER_245_76 = 29,
	IB_RNR_TIMER_327_68 = 30,
	IB_RNR_TIMER_491_52 = 31
};

enum ib_qp_attr_mask {
	IB_QP_STATE			= 1,
	IB_QP_CUR_STATE			= (1<<1),
	IB_QP_EN_SQD_ASYNC_NOTIFY	= (1<<2),
	IB_QP_ACCESS_FLAGS		= (1<<3),
	IB_QP_PKEY_INDEX		= (1<<4),
	IB_QP_PORT			= (1<<5),
	IB_QP_QKEY			= (1<<6),
	IB_QP_AV			= (1<<7),
	IB_QP_PATH_MTU			= (1<<8),
	IB_QP_TIMEOUT			= (1<<9),
	IB_QP_RETRY_CNT			= (1<<10),
	IB_QP_RNR_RETRY			= (1<<11),
	IB_QP_RQ_PSN			= (1<<12),
	IB_QP_MAX_QP_RD_ATOMIC		= (1<<13),
	IB_QP_ALT_PATH			= (1<<14),
	IB_QP_MIN_RNR_TIMER		= (1<<15),
	IB_QP_SQ_PSN			= (1<<16),
	IB_QP_MAX_DEST_RD_ATOMIC	= (1<<17),
	IB_QP_PATH_MIG_STATE		= (1<<18),
	IB_QP_CAP			= (1<<19),
	IB_QP_DEST_QPN			= (1<<20),
	IB_QP_RESERVED1			= (1<<21),
	IB_QP_RESERVED2			= (1<<22),
	IB_QP_RESERVED3			= (1<<23),
	IB_QP_RESERVED4			= (1<<24),
	IB_QP_RATE_LIMIT		= (1<<25),

	IB_QP_ATTR_STANDARD_BITS = GENMASK(20, 0),
};

enum ib_qp_state {
	IB_QPS_RESET,
	IB_QPS_INIT,
	IB_QPS_RTR,
	IB_QPS_RTS,
	IB_QPS_SQD,
	IB_QPS_SQE,
	IB_QPS_ERR
};

enum ib_mig_state {
	IB_MIG_MIGRATED,
	IB_MIG_REARM,
	IB_MIG_ARMED
};

enum ib_mw_type {
	IB_MW_TYPE_1 = 1,
	IB_MW_TYPE_2 = 2
};

struct ib_qp_attr {
	enum ib_qp_state	qp_state;
	enum ib_qp_state	cur_qp_state;
	enum ib_mtu		path_mtu;
	enum ib_mig_state	path_mig_state;
	u32			qkey;
	u32			rq_psn;
	u32			sq_psn;
	u32			dest_qp_num;
	int			qp_access_flags;
	struct ib_qp_cap	cap;
	struct rdma_ah_attr	ah_attr;
	struct rdma_ah_attr	alt_ah_attr;
	u16			pkey_index;
	u16			alt_pkey_index;
	u8			en_sqd_async_notify;
	u8			sq_draining;
	u8			max_rd_atomic;
	u8			max_dest_rd_atomic;
	u8			min_rnr_timer;
	u32			port_num;
	u8			timeout;
	u8			retry_cnt;
	u8			rnr_retry;
	u32			alt_port_num;
	u8			alt_timeout;
	u32			rate_limit;
	struct net_device	*xmit_slave;
};

enum ib_wr_opcode {
	/* These are shared with userspace */
	IB_WR_RDMA_WRITE = IB_UVERBS_WR_RDMA_WRITE,
	IB_WR_RDMA_WRITE_WITH_IMM = IB_UVERBS_WR_RDMA_WRITE_WITH_IMM,
	IB_WR_SEND = IB_UVERBS_WR_SEND,
	IB_WR_SEND_WITH_IMM = IB_UVERBS_WR_SEND_WITH_IMM,
	IB_WR_RDMA_READ = IB_UVERBS_WR_RDMA_READ,
	IB_WR_ATOMIC_CMP_AND_SWP = IB_UVERBS_WR_ATOMIC_CMP_AND_SWP,
	IB_WR_ATOMIC_FETCH_AND_ADD = IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD,
	IB_WR_BIND_MW = IB_UVERBS_WR_BIND_MW,
	IB_WR_LSO = IB_UVERBS_WR_TSO,
	IB_WR_SEND_WITH_INV = IB_UVERBS_WR_SEND_WITH_INV,
	IB_WR_RDMA_READ_WITH_INV = IB_UVERBS_WR_RDMA_READ_WITH_INV,
	IB_WR_LOCAL_INV = IB_UVERBS_WR_LOCAL_INV,
	IB_WR_MASKED_ATOMIC_CMP_AND_SWP =
		IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP,
	IB_WR_MASKED_ATOMIC_FETCH_AND_ADD =
		IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD,
	IB_WR_FLUSH = IB_UVERBS_WR_FLUSH,
	IB_WR_ATOMIC_WRITE = IB_UVERBS_WR_ATOMIC_WRITE,

	/* These are kernel only and can not be issued by userspace */
	IB_WR_REG_MR = 0x20,
	IB_WR_REG_MR_INTEGRITY,

	/* reserve values for low level drivers' internal use.
	 * These values will not be used at all in the ib core layer.
	 */
	IB_WR_RESERVED1 = 0xf0,
	IB_WR_RESERVED2,
	IB_WR_RESERVED3,
	IB_WR_RESERVED4,
	IB_WR_RESERVED5,
	IB_WR_RESERVED6,
	IB_WR_RESERVED7,
	IB_WR_RESERVED8,
	IB_WR_RESERVED9,
	IB_WR_RESERVED10,
};

enum ib_send_flags {
	IB_SEND_FENCE		= 1,
	IB_SEND_SIGNALED	= (1<<1),
	IB_SEND_SOLICITED	= (1<<2),
	IB_SEND_INLINE		= (1<<3),
	IB_SEND_IP_CSUM		= (1<<4),

	/* reserve bits 26-31 for low level drivers' internal use */
	IB_SEND_RESERVED_START	= (1 << 26),
	IB_SEND_RESERVED_END	= (1 << 31),
};

struct ib_sge {
	u64	addr;
	u32	length;
	u32	lkey;
};

struct ib_cqe {
	void (*done)(struct ib_cq *cq, struct ib_wc *wc);
};

struct ib_send_wr {
	struct ib_send_wr      *next;
	union {
		u64		wr_id;
		struct ib_cqe	*wr_cqe;
	};
	struct ib_sge	       *sg_list;
	int			num_sge;
	enum ib_wr_opcode	opcode;
	int			send_flags;
	union {
		__be32		imm_data;
		u32		invalidate_rkey;
	} ex;
};

struct ib_rdma_wr {
	struct ib_send_wr	wr;
	u64			remote_addr;
	u32			rkey;
};

static inline const struct ib_rdma_wr *rdma_wr(const struct ib_send_wr *wr)
{
	return container_of(wr, struct ib_rdma_wr, wr);
}

struct ib_atomic_wr {
	struct ib_send_wr	wr;
	u64			remote_addr;
	u64			compare_add;
	u64			swap;
	u64			compare_add_mask;
	u64			swap_mask;
	u32			rkey;
};

static inline const struct ib_atomic_wr *atomic_wr(const struct ib_send_wr *wr)
{
	return container_of(wr, struct ib_atomic_wr, wr);
}

struct ib_ud_wr {
	struct ib_send_wr	wr;
	struct ib_ah		*ah;
	void			*header;
	int			hlen;
	int			mss;
	u32			remote_qpn;
	u32			remote_qkey;
	u16			pkey_index; /* valid for GSI only */
	u32			port_num; /* valid for DR SMPs on switch only */
};

static inline const struct ib_ud_wr *ud_wr(const struct ib_send_wr *wr)
{
	return container_of(wr, struct ib_ud_wr, wr);
}

struct ib_reg_wr {
	struct ib_send_wr	wr;
	struct ib_mr		*mr;
	u32			key;
	int			access;
};

static inline const struct ib_reg_wr *reg_wr(const struct ib_send_wr *wr)
{
	return container_of(wr, struct ib_reg_wr, wr);
}

struct ib_recv_wr {
	struct ib_recv_wr      *next;
	union {
		u64		wr_id;
		struct ib_cqe	*wr_cqe;
	};
	struct ib_sge	       *sg_list;
	int			num_sge;
};

enum ib_access_flags {
	IB_ACCESS_LOCAL_WRITE = IB_UVERBS_ACCESS_LOCAL_WRITE,
	IB_ACCESS_REMOTE_WRITE = IB_UVERBS_ACCESS_REMOTE_WRITE,
	IB_ACCESS_REMOTE_READ = IB_UVERBS_ACCESS_REMOTE_READ,
	IB_ACCESS_REMOTE_ATOMIC = IB_UVERBS_ACCESS_REMOTE_ATOMIC,
	IB_ACCESS_MW_BIND = IB_UVERBS_ACCESS_MW_BIND,
	IB_ZERO_BASED = IB_UVERBS_ACCESS_ZERO_BASED,
	IB_ACCESS_ON_DEMAND = IB_UVERBS_ACCESS_ON_DEMAND,
	IB_ACCESS_HUGETLB = IB_UVERBS_ACCESS_HUGETLB,
	IB_ACCESS_RELAXED_ORDERING = IB_UVERBS_ACCESS_RELAXED_ORDERING,
	IB_ACCESS_FLUSH_GLOBAL = IB_UVERBS_ACCESS_FLUSH_GLOBAL,
	IB_ACCESS_FLUSH_PERSISTENT = IB_UVERBS_ACCESS_FLUSH_PERSISTENT,

	IB_ACCESS_OPTIONAL = IB_UVERBS_ACCESS_OPTIONAL_RANGE,
	IB_ACCESS_SUPPORTED =
		((IB_ACCESS_FLUSH_PERSISTENT << 1) - 1) | IB_ACCESS_OPTIONAL,
};

/*
 * XXX: these are apparently used for ->rereg_user_mr, no idea why they
 * are hidden here instead of a uapi header!
 */
enum ib_mr_rereg_flags {
	IB_MR_REREG_TRANS	= 1,
	IB_MR_REREG_PD		= (1<<1),
	IB_MR_REREG_ACCESS	= (1<<2),
	IB_MR_REREG_SUPPORTED	= ((IB_MR_REREG_ACCESS << 1) - 1)
};

struct ib_umem;

enum rdma_remove_reason {
	/*
	 * Userspace requested uobject deletion or initial try
	 * to remove uobject via cleanup. Call could fail
	 */
	RDMA_REMOVE_DESTROY,
	/* Context deletion. This call should delete the actual object itself */
	RDMA_REMOVE_CLOSE,
	/* Driver is being hot-unplugged. This call should delete the actual object itself */
	RDMA_REMOVE_DRIVER_REMOVE,
	/* uobj is being cleaned-up before being committed */
	RDMA_REMOVE_ABORT,
	/* The driver failed to destroy the uobject and is being disconnected */
	RDMA_REMOVE_DRIVER_FAILURE,
};

struct ib_rdmacg_object {
#ifdef CONFIG_CGROUP_RDMA
	struct rdma_cgroup	*cg;		/* owner rdma cgroup */
#endif
};

struct ib_ucontext {
	struct ib_device       *device;
	struct ib_uverbs_file  *ufile;

	struct ib_rdmacg_object	cg_obj;
	u64 enabled_caps;
	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry res;
	struct xarray mmap_xa;
};

struct ib_uobject {
	u64			user_handle;	/* handle given to us by userspace */
	/* ufile & ucontext owning this object */
	struct ib_uverbs_file  *ufile;
	/* FIXME, save memory: ufile->context == context */
	struct ib_ucontext     *context;	/* associated user context */
	void		       *object;		/* containing object */
	struct list_head	list;		/* link to context's list */
	struct ib_rdmacg_object	cg_obj;		/* rdmacg object */
	int			id;		/* index into kernel idr */
	struct kref		ref;
	atomic_t		usecnt;		/* protects exclusive access */
	struct rcu_head		rcu;		/* kfree_rcu() overhead */

	const struct uverbs_api_object *uapi_object;
};

struct ib_udata {
	const void __user *inbuf;
	void __user *outbuf;
	size_t       inlen;
	size_t       outlen;
};

struct ib_pd {
	u32			local_dma_lkey;
	u32			flags;
	struct ib_device       *device;
	struct ib_uobject      *uobject;
	atomic_t          	usecnt; /* count all resources */

	u32			unsafe_global_rkey;

	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct ib_mr	       *__internal_mr;
	struct rdma_restrack_entry res;
};

struct ib_xrcd {
	struct ib_device       *device;
	atomic_t		usecnt; /* count all exposed resources */
	struct inode	       *inode;
	struct rw_semaphore	tgt_qps_rwsem;
	struct xarray		tgt_qps;
};

struct ib_ah {
	struct ib_device	*device;
	struct ib_pd		*pd;
	struct ib_uobject	*uobject;
	const struct ib_gid_attr *sgid_attr;
	enum rdma_ah_attr_type	type;
};

typedef void (*ib_comp_handler)(struct ib_cq *cq, void *cq_context);

enum ib_poll_context {
	IB_POLL_SOFTIRQ,	   /* poll from softirq context */
	IB_POLL_WORKQUEUE,	   /* poll from workqueue */
	IB_POLL_UNBOUND_WORKQUEUE, /* poll from unbound workqueue */
	IB_POLL_LAST_POOL_TYPE = IB_POLL_UNBOUND_WORKQUEUE,

	IB_POLL_DIRECT,		   /* caller context, no hw completions */
};

struct ib_cq {
	struct ib_device       *device;
	struct ib_ucq_object   *uobject;
	ib_comp_handler   	comp_handler;
	void                  (*event_handler)(struct ib_event *, void *);
	void                   *cq_context;
	int               	cqe;
	unsigned int		cqe_used;
	atomic_t          	usecnt; /* count number of work queues */
	enum ib_poll_context	poll_ctx;
	struct ib_wc		*wc;
	struct list_head        pool_entry;
	union {
		struct irq_poll		iop;
		struct work_struct	work;
	};
	struct workqueue_struct *comp_wq;
	struct dim *dim;

	/* updated only by trace points */
	ktime_t timestamp;
	u8 interrupt:1;
	u8 shared:1;
	unsigned int comp_vector;

	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry res;
};

struct ib_srq {
	struct ib_device       *device;
	struct ib_pd	       *pd;
	struct ib_usrq_object  *uobject;
	void		      (*event_handler)(struct ib_event *, void *);
	void		       *srq_context;
	enum ib_srq_type	srq_type;
	atomic_t		usecnt;

	struct {
		struct ib_cq   *cq;
		union {
			struct {
				struct ib_xrcd *xrcd;
				u32		srq_num;
			} xrc;
		};
	} ext;

	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry res;
};

enum ib_raw_packet_caps {
	/*
	 * Strip cvlan from incoming packet and report it in the matching work
	 * completion is supported.
	 */
	IB_RAW_PACKET_CAP_CVLAN_STRIPPING =
		IB_UVERBS_RAW_PACKET_CAP_CVLAN_STRIPPING,
	/*
	 * Scatter FCS field of an incoming packet to host memory is supported.
	 */
	IB_RAW_PACKET_CAP_SCATTER_FCS = IB_UVERBS_RAW_PACKET_CAP_SCATTER_FCS,
	/* Checksum offloads are supported (for both send and receive). */
	IB_RAW_PACKET_CAP_IP_CSUM = IB_UVERBS_RAW_PACKET_CAP_IP_CSUM,
	/*
	 * When a packet is received for an RQ with no receive WQEs, the
	 * packet processing is delayed.
	 */
	IB_RAW_PACKET_CAP_DELAY_DROP = IB_UVERBS_RAW_PACKET_CAP_DELAY_DROP,
};

enum ib_wq_type {
	IB_WQT_RQ = IB_UVERBS_WQT_RQ,
};

enum ib_wq_state {
	IB_WQS_RESET,
	IB_WQS_RDY,
	IB_WQS_ERR
};

struct ib_wq {
	struct ib_device       *device;
	struct ib_uwq_object   *uobject;
	void		    *wq_context;
	void		    (*event_handler)(struct ib_event *, void *);
	struct ib_pd	       *pd;
	struct ib_cq	       *cq;
	u32		wq_num;
	enum ib_wq_state       state;
	enum ib_wq_type	wq_type;
	atomic_t		usecnt;
};

enum ib_wq_flags {
	IB_WQ_FLAGS_CVLAN_STRIPPING	= IB_UVERBS_WQ_FLAGS_CVLAN_STRIPPING,
	IB_WQ_FLAGS_SCATTER_FCS		= IB_UVERBS_WQ_FLAGS_SCATTER_FCS,
	IB_WQ_FLAGS_DELAY_DROP		= IB_UVERBS_WQ_FLAGS_DELAY_DROP,
	IB_WQ_FLAGS_PCI_WRITE_END_PADDING =
				IB_UVERBS_WQ_FLAGS_PCI_WRITE_END_PADDING,
};

struct ib_wq_init_attr {
	void		       *wq_context;
	enum ib_wq_type	wq_type;
	u32		max_wr;
	u32		max_sge;
	struct	ib_cq	       *cq;
	void		    (*event_handler)(struct ib_event *, void *);
	u32		create_flags; /* Use enum ib_wq_flags */
};

enum ib_wq_attr_mask {
	IB_WQ_STATE		= 1 << 0,
	IB_WQ_CUR_STATE		= 1 << 1,
	IB_WQ_FLAGS		= 1 << 2,
};

struct ib_wq_attr {
	enum	ib_wq_state	wq_state;
	enum	ib_wq_state	curr_wq_state;
	u32			flags; /* Use enum ib_wq_flags */
	u32			flags_mask; /* Use enum ib_wq_flags */
};

struct ib_rwq_ind_table {
	struct ib_device	*device;
	struct ib_uobject      *uobject;
	atomic_t		usecnt;
	u32		ind_tbl_num;
	u32		log_ind_tbl_size;
	struct ib_wq	**ind_tbl;
};

struct ib_rwq_ind_table_init_attr {
	u32		log_ind_tbl_size;
	/* Each entry is a pointer to Receive Work Queue */
	struct ib_wq	**ind_tbl;
};

enum port_pkey_state {
	IB_PORT_PKEY_NOT_VALID = 0,
	IB_PORT_PKEY_VALID = 1,
	IB_PORT_PKEY_LISTED = 2,
};

struct ib_qp_security;

struct ib_port_pkey {
	enum port_pkey_state	state;
	u16			pkey_index;
	u32			port_num;
	struct list_head	qp_list;
	struct list_head	to_error_list;
	struct ib_qp_security  *sec;
};

struct ib_ports_pkeys {
	struct ib_port_pkey	main;
	struct ib_port_pkey	alt;
};

struct ib_qp_security {
	struct ib_qp	       *qp;
	struct ib_device       *dev;
	/* Hold this mutex when changing port and pkey settings. */
	struct mutex		mutex;
	struct ib_ports_pkeys  *ports_pkeys;
	/* A list of all open shared QP handles.  Required to enforce security
	 * properly for all users of a shared QP.
	 */
	struct list_head        shared_qp_list;
	void                   *security;
	bool			destroying;
	atomic_t		error_list_count;
	struct completion	error_complete;
	int			error_comps_pending;
};

/*
 * @max_write_sge: Maximum SGE elements per RDMA WRITE request.
 * @max_read_sge:  Maximum SGE elements per RDMA READ request.
 */
struct ib_qp {
	struct ib_device       *device;
	struct ib_pd	       *pd;
	struct ib_cq	       *send_cq;
	struct ib_cq	       *recv_cq;
	spinlock_t		mr_lock;
	int			mrs_used;
	struct list_head	rdma_mrs;
	struct list_head	sig_mrs;
	struct ib_srq	       *srq;
	struct completion	srq_completion;
	struct ib_xrcd	       *xrcd; /* XRC TGT QPs only */
	struct list_head	xrcd_list;

	/* count times opened, mcast attaches, flow attaches */
	atomic_t		usecnt;
	struct list_head	open_list;
	struct ib_qp           *real_qp;
	struct ib_uqp_object   *uobject;
	void                  (*event_handler)(struct ib_event *, void *);
	void                  (*registered_event_handler)(struct ib_event *, void *);
	void		       *qp_context;
	/* sgid_attrs associated with the AV's */
	const struct ib_gid_attr *av_sgid_attr;
	const struct ib_gid_attr *alt_path_sgid_attr;
	u32			qp_num;
	u32			max_write_sge;
	u32			max_read_sge;
	enum ib_qp_type		qp_type;
	struct ib_rwq_ind_table *rwq_ind_tbl;
	struct ib_qp_security  *qp_sec;
	u32			port;

	bool			integrity_en;
	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry     res;

	/* The counter the qp is bind to */
	struct rdma_counter    *counter;
};

struct ib_dm {
	struct ib_device  *device;
	u32		   length;
	u32		   flags;
	struct ib_uobject *uobject;
	atomic_t	   usecnt;
};

/* bit values to mark existence of ib_dmah fields */
enum {
	IB_DMAH_CPU_ID_EXISTS,
	IB_DMAH_MEM_TYPE_EXISTS,
	IB_DMAH_PH_EXISTS,
};

struct ib_dmah {
	struct ib_device *device;
	struct ib_uobject *uobject;
	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry res;
	u32 cpu_id;
	enum tph_mem_type mem_type;
	atomic_t usecnt;
	u8 ph;
	u8 valid_fields; /* use IB_DMAH_XXX_EXISTS */
};

struct ib_mr {
	struct ib_device  *device;
	struct ib_pd	  *pd;
	u32		   lkey;
	u32		   rkey;
	u64		   iova;
	u64		   length;
	unsigned int	   page_size;
	enum ib_mr_type	   type;
	bool		   need_inval;
	union {
		struct ib_uobject	*uobject;	/* user */
		struct list_head	qp_entry;	/* FR */
	};

	struct ib_dm      *dm;
	struct ib_sig_attrs *sig_attrs; /* only for IB_MR_TYPE_INTEGRITY MRs */
	struct ib_dmah *dmah;
	/*
	 * Implementation details of the RDMA core, don't use in drivers:
	 */
	struct rdma_restrack_entry res;
};

struct ib_mw {
	struct ib_device	*device;
	struct ib_pd		*pd;
	struct ib_uobject	*uobject;
	u32			rkey;
	enum ib_mw_type         type;
};

/* Supported steering options */
enum ib_flow_attr_type {
	/* steering according to rule specifications */
	IB_FLOW_ATTR_NORMAL		= 0x0,
	/* default unicast and multicast rule -
	 * receive all Eth traffic which isn't steered to any QP
	 */
	IB_FLOW_ATTR_ALL_DEFAULT	= 0x1,
	/* default multicast rule -
	 * receive all Eth multicast traffic which isn't steered to any QP
	 */
	IB_FLOW_ATTR_MC_DEFAULT		= 0x2,
	/* sniffer rule - receive all port traffic */
	IB_FLOW_ATTR_SNIFFER		= 0x3
};

/* Supported steering header types */
enum ib_flow_spec_type {
	/* L2 headers*/
	IB_FLOW_SPEC_ETH		= 0x20,
	IB_FLOW_SPEC_IB			= 0x22,
	/* L3 header*/
	IB_FLOW_SPEC_IPV4		= 0x30,
	IB_FLOW_SPEC_IPV6		= 0x31,
	IB_FLOW_SPEC_ESP                = 0x34,
	/* L4 headers*/
	IB_FLOW_SPEC_TCP		= 0x40,
	IB_FLOW_SPEC_UDP		= 0x41,
	IB_FLOW_SPEC_VXLAN_TUNNEL	= 0x50,
	IB_FLOW_SPEC_GRE		= 0x51,
	IB_FLOW_SPEC_MPLS		= 0x60,
	IB_FLOW_SPEC_INNER		= 0x100,
	/* Actions */
	IB_FLOW_SPEC_ACTION_TAG         = 0x1000,
	IB_FLOW_SPEC_ACTION_DROP        = 0x1001,
	IB_FLOW_SPEC_ACTION_HANDLE	= 0x1002,
	IB_FLOW_SPEC_ACTION_COUNT       = 0x1003,
};
#define IB_FLOW_SPEC_LAYER_MASK	0xF0
#define IB_FLOW_SPEC_SUPPORT_LAYERS 10

enum ib_flow_flags {
	IB_FLOW_ATTR_FLAGS_DONT_TRAP = 1UL << 1, /* Continue match, no steal */
	IB_FLOW_ATTR_FLAGS_EGRESS = 1UL << 2, /* Egress flow */
	IB_FLOW_ATTR_FLAGS_RESERVED  = 1UL << 3  /* Must be last */
};

struct ib_flow_eth_filter {
	u8	dst_mac[6];
	u8	src_mac[6];
	__be16	ether_type;
	__be16	vlan_tag;
};

struct ib_flow_spec_eth {
	u32			  type;
	u16			  size;
	struct ib_flow_eth_filter val;
	struct ib_flow_eth_filter mask;
};

struct ib_flow_ib_filter {
	__be16 dlid;
	__u8   sl;
};

struct ib_flow_spec_ib {
	u32			 type;
	u16			 size;
	struct ib_flow_ib_filter val;
	struct ib_flow_ib_filter mask;
};

/* IPv4 header flags */
enum ib_ipv4_flags {
	IB_IPV4_DONT_FRAG = 0x2, /* Don't enable packet fragmentation */
	IB_IPV4_MORE_FRAG = 0X4  /* For All fragmented packets except the
				    last have this flag set */
};

struct ib_flow_ipv4_filter {
	__be32	src_ip;
	__be32	dst_ip;
	u8	proto;
	u8	tos;
	u8	ttl;
	u8	flags;
};

struct ib_flow_spec_ipv4 {
	u32			   type;
	u16			   size;
	struct ib_flow_ipv4_filter val;
	struct ib_flow_ipv4_filter mask;
};

struct ib_flow_ipv6_filter {
	u8	src_ip[16];
	u8	dst_ip[16];
	__be32	flow_label;
	u8	next_hdr;
	u8	traffic_class;
	u8	hop_limit;
} __packed;

struct ib_flow_spec_ipv6 {
	u32			   type;
	u16			   size;
	struct ib_flow_ipv6_filter val;
	struct ib_flow_ipv6_filter mask;
};

struct ib_flow_tcp_udp_filter {
	__be16	dst_port;
	__be16	src_port;
};

struct ib_flow_spec_tcp_udp {
	u32			      type;
	u16			      size;
	struct ib_flow_tcp_udp_filter val;
	struct ib_flow_tcp_udp_filter mask;
};

struct ib_flow_tunnel_filter {
	__be32	tunnel_id;
};

/* ib_flow_spec_tunnel describes the Vxlan tunnel
 * the tunnel_id from val has the vni value
 */
struct ib_flow_spec_tunnel {
	u32			      type;
	u16			      size;
	struct ib_flow_tunnel_filter  val;
	struct ib_flow_tunnel_filter  mask;
};

struct ib_flow_esp_filter {
	__be32	spi;
	__be32  seq;
};

struct ib_flow_spec_esp {
	u32                           type;
	u16			      size;
	struct ib_flow_esp_filter     val;
	struct ib_flow_esp_filter     mask;
};

struct ib_flow_gre_filter {
	__be16 c_ks_res0_ver;
	__be16 protocol;
	__be32 key;
};

struct ib_flow_spec_gre {
	u32                           type;
	u16			      size;
	struct ib_flow_gre_filter     val;
	struct ib_flow_gre_filter     mask;
};

struct ib_flow_mpls_filter {
	__be32 tag;
};

struct ib_flow_spec_mpls {
	u32                           type;
	u16			      size;
	struct ib_flow_mpls_filter     val;
	struct ib_flow_mpls_filter     mask;
};

struct ib_flow_spec_action_tag {
	enum ib_flow_spec_type	      type;
	u16			      size;
	u32                           tag_id;
};

struct ib_flow_spec_action_drop {
	enum ib_flow_spec_type	      type;
	u16			      size;
};

struct ib_flow_spec_action_handle {
	enum ib_flow_spec_type	      type;
	u16			      size;
	struct ib_flow_action	     *act;
};

enum ib_counters_description {
	IB_COUNTER_PACKETS,
	IB_COUNTER_BYTES,
};

struct ib_flow_spec_action_count {
	enum ib_flow_spec_type type;
	u16 size;
	struct ib_counters *counters;
};

union ib_flow_spec {
	struct {
		u32			type;
		u16			size;
	};
	struct ib_flow_spec_eth		eth;
	struct ib_flow_spec_ib		ib;
	struct ib_flow_spec_ipv4        ipv4;
	struct ib_flow_spec_tcp_udp	tcp_udp;
	struct ib_flow_spec_ipv6        ipv6;
	struct ib_flow_spec_tunnel      tunnel;
	struct ib_flow_spec_esp		esp;
	struct ib_flow_spec_gre		gre;
	struct ib_flow_spec_mpls	mpls;
	struct ib_flow_spec_action_tag  flow_tag;
	struct ib_flow_spec_action_drop drop;
	struct ib_flow_spec_action_handle action;
	struct ib_flow_spec_action_count flow_count;
};

struct ib_flow_attr {
	enum ib_flow_attr_type type;
	u16	     size;
	u16	     priority;
	u32	     flags;
	u8	     num_of_specs;
	u32	     port;
	union ib_flow_spec flows[];
};

struct ib_flow {
	struct ib_qp		*qp;
	struct ib_device	*device;
	struct ib_uobject	*uobject;
};

enum ib_flow_action_type {
	IB_FLOW_ACTION_UNSPECIFIED,
	IB_FLOW_ACTION_ESP = 1,
};

struct ib_flow_action_attrs_esp_keymats {
	enum ib_uverbs_flow_action_esp_keymat			protocol;
	union {
		struct ib_uverbs_flow_action_esp_keymat_aes_gcm aes_gcm;
	} keymat;
};

struct ib_flow_action_attrs_esp_replays {
	enum ib_uverbs_flow_action_esp_replay			protocol;
	union {
		struct ib_uverbs_flow_action_esp_replay_bmp	bmp;
	} replay;
};

enum ib_flow_action_attrs_esp_flags {
	/* All user-space flags at the top: Use enum ib_uverbs_flow_action_esp_flags
	 * This is done in order to share the same flags between user-space and
	 * kernel and spare an unnecessary translation.
	 */

	/* Kernel flags */
	IB_FLOW_ACTION_ESP_FLAGS_ESN_TRIGGERED	= 1ULL << 32,
	IB_FLOW_ACTION_ESP_FLAGS_MOD_ESP_ATTRS	= 1ULL << 33,
};

struct ib_flow_spec_list {
	struct ib_flow_spec_list	*next;
	union ib_flow_spec		spec;
};

struct ib_flow_action_attrs_esp {
	struct ib_flow_action_attrs_esp_keymats		*keymat;
	struct ib_flow_action_attrs_esp_replays		*replay;
	struct ib_flow_spec_list			*encap;
	/* Used only if IB_FLOW_ACTION_ESP_FLAGS_ESN_TRIGGERED is enabled.
	 * Value of 0 is a valid value.
	 */
	u32						esn;
	u32						spi;
	u32						seq;
	u32						tfc_pad;
	/* Use enum ib_flow_action_attrs_esp_flags */
	u64						flags;
	u64						hard_limit_pkts;
};

struct ib_flow_action {
	struct ib_device		*device;
	struct ib_uobject		*uobject;
	enum ib_flow_action_type	type;
	atomic_t			usecnt;
};

struct ib_mad;

enum ib_process_mad_flags {
	IB_MAD_IGNORE_MKEY	= 1,
	IB_MAD_IGNORE_BKEY	= 2,
	IB_MAD_IGNORE_ALL	= IB_MAD_IGNORE_MKEY | IB_MAD_IGNORE_BKEY
};

enum ib_mad_result {
	IB_MAD_RESULT_FAILURE  = 0,      /* (!SUCCESS is the important flag) */
	IB_MAD_RESULT_SUCCESS  = 1 << 0, /* MAD was successfully processed   */
	IB_MAD_RESULT_REPLY    = 1 << 1, /* Reply packet needs to be sent    */
	IB_MAD_RESULT_CONSUMED = 1 << 2  /* Packet consumed: stop processing */
};

struct ib_port_cache {
	u64		      subnet_prefix;
	struct ib_pkey_cache  *pkey;
	struct ib_gid_table   *gid;
	u8                     lmc;
	enum ib_port_state     port_state;
	enum ib_port_state     last_port_state;
};

struct ib_port_immutable {
	int                           pkey_tbl_len;
	int                           gid_tbl_len;
	u32                           core_cap_flags;
	u32                           max_mad_size;
};

struct ib_port_data {
	struct ib_device *ib_dev;

	struct ib_port_immutable immutable;

	spinlock_t pkey_list_lock;

	spinlock_t netdev_lock;

	struct list_head pkey_list;

	struct ib_port_cache cache;

	struct net_device __rcu *netdev;
	netdevice_tracker netdev_tracker;
	struct hlist_node ndev_hash_link;
	struct rdma_port_counter port_counter;
	struct ib_port *sysfs;
};

/* rdma netdev type - specifies protocol type */
enum rdma_netdev_t {
	RDMA_NETDEV_OPA_VNIC,
	RDMA_NETDEV_IPOIB,
};

/**
 * struct rdma_netdev - rdma netdev
 * For cases where netstack interfacing is required.
 */
struct rdma_netdev {
	void              *clnt_priv;
	struct ib_device  *hca;
	u32		   port_num;
	int                mtu;

	/*
	 * cleanup function must be specified.
	 * FIXME: This is only used for OPA_VNIC and that usage should be
	 * removed too.
	 */
	void (*free_rdma_netdev)(struct net_device *netdev);

	/* control functions */
	void (*set_id)(struct net_device *netdev, int id);
	/* send packet */
	int (*send)(struct net_device *dev, struct sk_buff *skb,
		    struct ib_ah *address, u32 dqpn);
	/* multicast */
	int (*attach_mcast)(struct net_device *dev, struct ib_device *hca,
			    union ib_gid *gid, u16 mlid,
			    int set_qkey, u32 qkey);
	int (*detach_mcast)(struct net_device *dev, struct ib_device *hca,
			    union ib_gid *gid, u16 mlid);
	/* timeout */
	void (*tx_timeout)(struct net_device *dev, unsigned int txqueue);
};

struct rdma_netdev_alloc_params {
	size_t sizeof_priv;
	unsigned int txqs;
	unsigned int rxqs;
	void *param;

	int (*initialize_rdma_netdev)(struct ib_device *device, u32 port_num,
				      struct net_device *netdev, void *param);
};

struct ib_odp_counters {
	atomic64_t faults;
	atomic64_t faults_handled;
	atomic64_t invalidations;
	atomic64_t invalidations_handled;
	atomic64_t prefetch;
};

struct ib_counters {
	struct ib_device	*device;
	struct ib_uobject	*uobject;
	/* num of objects attached */
	atomic_t	usecnt;
};

struct ib_counters_read_attr {
	u64	*counters_buff;
	u32	ncounters;
	u32	flags; /* use enum ib_read_counters_flags */
};

struct uverbs_attr_bundle;
struct iw_cm_id;
struct iw_cm_conn_param;

#define INIT_RDMA_OBJ_SIZE(ib_struct, drv_struct, member)                      \
	.size_##ib_struct =                                                    \
		(sizeof(struct drv_struct) +                                   \
		 BUILD_BUG_ON_ZERO(offsetof(struct drv_struct, member)) +      \
		 BUILD_BUG_ON_ZERO(                                            \
			 !__same_type(((struct drv_struct *)NULL)->member,     \
				      struct ib_struct)))

#define rdma_zalloc_drv_obj_gfp(ib_dev, ib_type, gfp)                          \
	((struct ib_type *)rdma_zalloc_obj(ib_dev, ib_dev->ops.size_##ib_type, \
					   gfp, false))

#define rdma_zalloc_drv_obj_numa(ib_dev, ib_type)                              \
	((struct ib_type *)rdma_zalloc_obj(ib_dev, ib_dev->ops.size_##ib_type, \
					   GFP_KERNEL, true))

#define rdma_zalloc_drv_obj(ib_dev, ib_type)                                   \
	rdma_zalloc_drv_obj_gfp(ib_dev, ib_type, GFP_KERNEL)

#define DECLARE_RDMA_OBJ_SIZE(ib_struct) size_t size_##ib_struct

struct rdma_user_mmap_entry {
	struct kref ref;
	struct ib_ucontext *ucontext;
	unsigned long start_pgoff;
	size_t npages;
	bool driver_removed;
};

/* Return the offset (in bytes) the user should pass to libc's mmap() */
static inline u64
rdma_user_mmap_get_offset(const struct rdma_user_mmap_entry *entry)
{
	return (u64)entry->start_pgoff << PAGE_SHIFT;
}

/**
 * struct ib_device_ops - InfiniBand device operations
 * This structure defines all the InfiniBand device operations, providers will
 * need to define the supported operations, otherwise they will be set to null.
 */
struct ib_device_ops {
	struct module *owner;
	enum rdma_driver_id driver_id;
	u32 uverbs_abi_ver;
	unsigned int uverbs_no_driver_id_binding:1;

	/*
	 * NOTE: New drivers should not make use of device_group; instead new
	 * device parameter should be exposed via netlink command. This
	 * mechanism exists only for existing drivers.
	 */
	const struct attribute_group *device_group;
	const struct attribute_group **port_groups;

	int (*post_send)(struct ib_qp *qp, const struct ib_send_wr *send_wr,
			 const struct ib_send_wr **bad_send_wr);
	int (*post_recv)(struct ib_qp *qp, const struct ib_recv_wr *recv_wr,
			 const struct ib_recv_wr **bad_recv_wr);
	void (*drain_rq)(struct ib_qp *qp);
	void (*drain_sq)(struct ib_qp *qp);
	int (*poll_cq)(struct ib_cq *cq, int num_entries, struct ib_wc *wc);
	int (*peek_cq)(struct ib_cq *cq, int wc_cnt);
	int (*req_notify_cq)(struct ib_cq *cq, enum ib_cq_notify_flags flags);
	int (*post_srq_recv)(struct ib_srq *srq,
			     const struct ib_recv_wr *recv_wr,
			     const struct ib_recv_wr **bad_recv_wr);
	int (*process_mad)(struct ib_device *device, int process_mad_flags,
			   u32 port_num, const struct ib_wc *in_wc,
			   const struct ib_grh *in_grh,
			   const struct ib_mad *in_mad, struct ib_mad *out_mad,
			   size_t *out_mad_size, u16 *out_mad_pkey_index);
	int (*query_device)(struct ib_device *device,
			    struct ib_device_attr *device_attr,
			    struct ib_udata *udata);
	int (*modify_device)(struct ib_device *device, int device_modify_mask,
			     struct ib_device_modify *device_modify);
	void (*get_dev_fw_str)(struct ib_device *device, char *str);
	const struct cpumask *(*get_vector_affinity)(struct ib_device *ibdev,
						     int comp_vector);
	int (*query_port)(struct ib_device *device, u32 port_num,
			  struct ib_port_attr *port_attr);
	int (*modify_port)(struct ib_device *device, u32 port_num,
			   int port_modify_mask,
			   struct ib_port_modify *port_modify);
	/*
	 * The following mandatory functions are used only at device
	 * registration.  Keep functions such as these at the end of this
	 * structure to avoid cache line misses when accessing struct ib_device
	 * in fast paths.
	 */
	int (*get_port_immutable)(struct ib_device *device, u32 port_num,
				  struct ib_port_immutable *immutable);
	enum rdma_link_layer (*get_link_layer)(struct ib_device *device,
					       u32 port_num);
	/*
	 * When calling get_netdev, the HW vendor's driver should return the
	 * net device of device @device at port @port_num or NULL if such
	 * a net device doesn't exist. The vendor driver should call dev_hold
	 * on this net device. The HW vendor's device driver must guarantee
	 * that this function returns NULL before the net device has finished
	 * NETDEV_UNREGISTER state.
	 */
	struct net_device *(*get_netdev)(struct ib_device *device,
					 u32 port_num);
	/*
	 * rdma netdev operation
	 *
	 * Driver implementing alloc_rdma_netdev or rdma_netdev_get_params
	 * must return -EOPNOTSUPP if it doesn't support the specified type.
	 */
	struct net_device *(*alloc_rdma_netdev)(
		struct ib_device *device, u32 port_num, enum rdma_netdev_t type,
		const char *name, unsigned char name_assign_type,
		void (*setup)(struct net_device *));

	int (*rdma_netdev_get_params)(struct ib_device *device, u32 port_num,
				      enum rdma_netdev_t type,
				      struct rdma_netdev_alloc_params *params);
	/*
	 * query_gid should be return GID value for @device, when @port_num
	 * link layer is either IB or iWarp. It is no-op if @port_num port
	 * is RoCE link layer.
	 */
	int (*query_gid)(struct ib_device *device, u32 port_num, int index,
			 union ib_gid *gid);
	/*
	 * When calling add_gid, the HW vendor's driver should add the gid
	 * of device of port at gid index available at @attr. Meta-info of
	 * that gid (for example, the network device related to this gid) is
	 * available at @attr. @context allows the HW vendor driver to store
	 * extra information together with a GID entry. The HW vendor driver may
	 * allocate memory to contain this information and store it in @context
	 * when a new GID entry is written to. Params are consistent until the
	 * next call of add_gid or delete_gid. The function should return 0 on
	 * success or error otherwise. The function could be called
	 * concurrently for different ports. This function is only called when
	 * roce_gid_table is used.
	 */
	int (*add_gid)(const struct ib_gid_attr *attr, void **context);
	/*
	 * When calling del_gid, the HW vendor's driver should delete the
	 * gid of device @device at gid index gid_index of port port_num
	 * available in @attr.
	 * Upon the deletion of a GID entry, the HW vendor must free any
	 * allocated memory. The caller will clear @context afterwards.
	 * This function is only called when roce_gid_table is used.
	 */
	int (*del_gid)(const struct ib_gid_attr *attr, void **context);
	int (*query_pkey)(struct ib_device *device, u32 port_num, u16 index,
			  u16 *pkey);
	int (*alloc_ucontext)(struct ib_ucontext *context,
			      struct ib_udata *udata);
	void (*dealloc_ucontext)(struct ib_ucontext *context);
	int (*mmap)(struct ib_ucontext *context, struct vm_area_struct *vma);
	/*
	 * This will be called once refcount of an entry in mmap_xa reaches
	 * zero. The type of the memory that was mapped may differ between
	 * entries and is opaque to the rdma_user_mmap interface.
	 * Therefore needs to be implemented by the driver in mmap_free.
	 */
	void (*mmap_free)(struct rdma_user_mmap_entry *entry);
	void (*disassociate_ucontext)(struct ib_ucontext *ibcontext);
	int (*alloc_pd)(struct ib_pd *pd, struct ib_udata *udata);
	int (*dealloc_pd)(struct ib_pd *pd, struct ib_udata *udata);
	int (*create_ah)(struct ib_ah *ah, struct rdma_ah_init_attr *attr,
			 struct ib_udata *udata);
	int (*create_user_ah)(struct ib_ah *ah, struct rdma_ah_init_attr *attr,
			      struct ib_udata *udata);
	int (*modify_ah)(struct ib_ah *ah, struct rdma_ah_attr *ah_attr);
	int (*query_ah)(struct ib_ah *ah, struct rdma_ah_attr *ah_attr);
	int (*destroy_ah)(struct ib_ah *ah, u32 flags);
	int (*create_srq)(struct ib_srq *srq,
			  struct ib_srq_init_attr *srq_init_attr,
			  struct ib_udata *udata);
	int (*modify_srq)(struct ib_srq *srq, struct ib_srq_attr *srq_attr,
			  enum ib_srq_attr_mask srq_attr_mask,
			  struct ib_udata *udata);
	int (*query_srq)(struct ib_srq *srq, struct ib_srq_attr *srq_attr);
	int (*destroy_srq)(struct ib_srq *srq, struct ib_udata *udata);
	int (*create_qp)(struct ib_qp *qp, struct ib_qp_init_attr *qp_init_attr,
			 struct ib_udata *udata);
	int (*modify_qp)(struct ib_qp *qp, struct ib_qp_attr *qp_attr,
			 int qp_attr_mask, struct ib_udata *udata);
	int (*query_qp)(struct ib_qp *qp, struct ib_qp_attr *qp_attr,
			int qp_attr_mask, struct ib_qp_init_attr *qp_init_attr);
	int (*destroy_qp)(struct ib_qp *qp, struct ib_udata *udata);
	int (*create_cq)(struct ib_cq *cq, const struct ib_cq_init_attr *attr,
			 struct uverbs_attr_bundle *attrs);
	int (*create_cq_umem)(struct ib_cq *cq,
			      const struct ib_cq_init_attr *attr,
			      struct ib_umem *umem,
			      struct uverbs_attr_bundle *attrs);
	int (*modify_cq)(struct ib_cq *cq, u16 cq_count, u16 cq_period);
	int (*destroy_cq)(struct ib_cq *cq, struct ib_udata *udata);
	int (*resize_cq)(struct ib_cq *cq, int cqe, struct ib_udata *udata);
	/*
	 * pre_destroy_cq - Prevent a cq from generating any new work
	 * completions, but not free any kernel resources
	 */
	int (*pre_destroy_cq)(struct ib_cq *cq);
	/*
	 * post_destroy_cq - Free all kernel resources
	 */
	void (*post_destroy_cq)(struct ib_cq *cq);
	struct ib_mr *(*get_dma_mr)(struct ib_pd *pd, int mr_access_flags);
	struct ib_mr *(*reg_user_mr)(struct ib_pd *pd, u64 start, u64 length,
				     u64 virt_addr, int mr_access_flags,
				     struct ib_dmah *dmah,
				     struct ib_udata *udata);
	struct ib_mr *(*reg_user_mr_dmabuf)(struct ib_pd *pd, u64 offset,
					    u64 length, u64 virt_addr, int fd,
					    int mr_access_flags,
					    struct ib_dmah *dmah,
					    struct uverbs_attr_bundle *attrs);
	struct ib_mr *(*rereg_user_mr)(struct ib_mr *mr, int flags, u64 start,
				       u64 length, u64 virt_addr,
				       int mr_access_flags, struct ib_pd *pd,
				       struct ib_udata *udata);
	int (*dereg_mr)(struct ib_mr *mr, struct ib_udata *udata);
	struct ib_mr *(*alloc_mr)(struct ib_pd *pd, enum ib_mr_type mr_type,
				  u32 max_num_sg);
	struct ib_mr *(*alloc_mr_integrity)(struct ib_pd *pd,
					    u32 max_num_data_sg,
					    u32 max_num_meta_sg);
	int (*advise_mr)(struct ib_pd *pd,
			 enum ib_uverbs_advise_mr_advice advice, u32 flags,
			 struct ib_sge *sg_list, u32 num_sge,
			 struct uverbs_attr_bundle *attrs);

	/*
	 * Kernel users should universally support relaxed ordering (RO), as
	 * they are designed to read data only after observing the CQE and use
	 * the DMA API correctly.
	 *
	 * Some drivers implicitly enable RO if platform supports it.
	 */
	int (*map_mr_sg)(struct ib_mr *mr, struct scatterlist *sg, int sg_nents,
			 unsigned int *sg_offset);
	int (*check_mr_status)(struct ib_mr *mr, u32 check_mask,
			       struct ib_mr_status *mr_status);
	int (*alloc_mw)(struct ib_mw *mw, struct ib_udata *udata);
	int (*dealloc_mw)(struct ib_mw *mw);
	int (*attach_mcast)(struct ib_qp *qp, union ib_gid *gid, u16 lid);
	int (*detach_mcast)(struct ib_qp *qp, union ib_gid *gid, u16 lid);
	int (*alloc_xrcd)(struct ib_xrcd *xrcd, struct ib_udata *udata);
	int (*dealloc_xrcd)(struct ib_xrcd *xrcd, struct ib_udata *udata);
	struct ib_flow *(*create_flow)(struct ib_qp *qp,
				       struct ib_flow_attr *flow_attr,
				       struct ib_udata *udata);
	int (*destroy_flow)(struct ib_flow *flow_id);
	int (*destroy_flow_action)(struct ib_flow_action *action);
	int (*set_vf_link_state)(struct ib_device *device, int vf, u32 port,
				 int state);
	int (*get_vf_config)(struct ib_device *device, int vf, u32 port,
			     struct ifla_vf_info *ivf);
	int (*get_vf_stats)(struct ib_device *device, int vf, u32 port,
			    struct ifla_vf_stats *stats);
	int (*get_vf_guid)(struct ib_device *device, int vf, u32 port,
			    struct ifla_vf_guid *node_guid,
			    struct ifla_vf_guid *port_guid);
	int (*set_vf_guid)(struct ib_device *device, int vf, u32 port, u64 guid,
			   int type);
	struct ib_wq *(*create_wq)(struct ib_pd *pd,
				   struct ib_wq_init_attr *init_attr,
				   struct ib_udata *udata);
	int (*destroy_wq)(struct ib_wq *wq, struct ib_udata *udata);
	int (*modify_wq)(struct ib_wq *wq, struct ib_wq_attr *attr,
			 u32 wq_attr_mask, struct ib_udata *udata);
	int (*create_rwq_ind_table)(struct ib_rwq_ind_table *ib_rwq_ind_table,
				    struct ib_rwq_ind_table_init_attr *init_attr,
				    struct ib_udata *udata);
	int (*destroy_rwq_ind_table)(struct ib_rwq_ind_table *wq_ind_table);
	struct ib_dm *(*alloc_dm)(struct ib_device *device,
				  struct ib_ucontext *context,
				  struct ib_dm_alloc_attr *attr,
				  struct uverbs_attr_bundle *attrs);
	int (*dealloc_dm)(struct ib_dm *dm, struct uverbs_attr_bundle *attrs);
	int (*alloc_dmah)(struct ib_dmah *ibdmah,
			  struct uverbs_attr_bundle *attrs);
	int (*dealloc_dmah)(struct ib_dmah *dmah, struct uverbs_attr_bundle *attrs);
	struct ib_mr *(*reg_dm_mr)(struct ib_pd *pd, struct ib_dm *dm,
				   struct ib_dm_mr_attr *attr,
				   struct uverbs_attr_bundle *attrs);
	int (*create_counters)(struct ib_counters *counters,
			       struct uverbs_attr_bundle *attrs);
	int (*destroy_counters)(struct ib_counters *counters);
	int (*read_counters)(struct ib_counters *counters,
			     struct ib_counters_read_attr *counters_read_attr,
			     struct uverbs_attr_bundle *attrs);
	int (*map_mr_sg_pi)(struct ib_mr *mr, struct scatterlist *data_sg,
			    int data_sg_nents, unsigned int *data_sg_offset,
			    struct scatterlist *meta_sg, int meta_sg_nents,
			    unsigned int *meta_sg_offset);

	/*
	 * alloc_hw_[device,port]_stats - Allocate a struct rdma_hw_stats and
	 *   fill in the driver initialized data.  The struct is kfree()'ed by
	 *   the sysfs core when the device is removed.  A lifespan of -1 in the
	 *   return struct tells the core to set a default lifespan.
	 */
	struct rdma_hw_stats *(*alloc_hw_device_stats)(struct ib_device *device);
	struct rdma_hw_stats *(*alloc_hw_port_stats)(struct ib_device *device,
						     u32 port_num);
	/*
	 * get_hw_stats - Fill in the counter value(s) in the stats struct.
	 * @index - The index in the value array we wish to have updated, or
	 *   num_counters if we want all stats updated
	 * Return codes -
	 *   < 0 - Error, no counters updated
	 *   index - Updated the single counter pointed to by index
	 *   num_counters - Updated all counters (will reset the timestamp
	 *     and prevent further calls for lifespan milliseconds)
	 * Drivers are allowed to update all counters in leiu of just the
	 *   one given in index at their option
	 */
	int (*get_hw_stats)(struct ib_device *device,
			    struct rdma_hw_stats *stats, u32 port, int index);

	/*
	 * modify_hw_stat - Modify the counter configuration
	 * @enable: true/false when enable/disable a counter
	 * Return codes - 0 on success or error code otherwise.
	 */
	int (*modify_hw_stat)(struct ib_device *device, u32 port,
			      unsigned int counter_index, bool enable);
	/*
	 * Allows rdma drivers to add their own restrack attributes.
	 */
	int (*fill_res_mr_entry)(struct sk_buff *msg, struct ib_mr *ibmr);
	int (*fill_res_mr_entry_raw)(struct sk_buff *msg, struct ib_mr *ibmr);
	int (*fill_res_cq_entry)(struct sk_buff *msg, struct ib_cq *ibcq);
	int (*fill_res_cq_entry_raw)(struct sk_buff *msg, struct ib_cq *ibcq);
	int (*fill_res_qp_entry)(struct sk_buff *msg, struct ib_qp *ibqp);
	int (*fill_res_qp_entry_raw)(struct sk_buff *msg, struct ib_qp *ibqp);
	int (*fill_res_cm_id_entry)(struct sk_buff *msg, struct rdma_cm_id *id);
	int (*fill_res_srq_entry)(struct sk_buff *msg, struct ib_srq *ib_srq);
	int (*fill_res_srq_entry_raw)(struct sk_buff *msg, struct ib_srq *ib_srq);

	/* Device lifecycle callbacks */
	/*
	 * Called after the device becomes registered, before clients are
	 * attached
	 */
	int (*enable_driver)(struct ib_device *dev);
	/*
	 * This is called as part of ib_dealloc_device().
	 */
	void (*dealloc_driver)(struct ib_device *dev);

	/* iWarp CM callbacks */
	void (*iw_add_ref)(struct ib_qp *qp);
	void (*iw_rem_ref)(struct ib_qp *qp);
	struct ib_qp *(*iw_get_qp)(struct ib_device *device, int qpn);
	int (*iw_connect)(struct iw_cm_id *cm_id,
			  struct iw_cm_conn_param *conn_param);
	int (*iw_accept)(struct iw_cm_id *cm_id,
			 struct iw_cm_conn_param *conn_param);
	int (*iw_reject)(struct iw_cm_id *cm_id, const void *pdata,
			 u8 pdata_len);
	int (*iw_create_listen)(struct iw_cm_id *cm_id, int backlog);
	int (*iw_destroy_listen)(struct iw_cm_id *cm_id);
	/*
	 * counter_bind_qp - Bind a QP to a counter.
	 * @counter - The counter to be bound. If counter->id is zero then
	 *   the driver needs to allocate a new counter and set counter->id
	 */
	int (*counter_bind_qp)(struct rdma_counter *counter, struct ib_qp *qp,
			       u32 port);
	/*
	 * counter_unbind_qp - Unbind the qp from the dynamically-allocated
	 *   counter and bind it onto the default one
	 */
	int (*counter_unbind_qp)(struct ib_qp *qp, u32 port);
	/*
	 * counter_dealloc -De-allocate the hw counter
	 */
	int (*counter_dealloc)(struct rdma_counter *counter);
	/*
	 * counter_alloc_stats - Allocate a struct rdma_hw_stats and fill in
	 * the driver initialized data.
	 */
	struct rdma_hw_stats *(*counter_alloc_stats)(
		struct rdma_counter *counter);
	/*
	 * counter_update_stats - Query the stats value of this counter
	 */
	int (*counter_update_stats)(struct rdma_counter *counter);

	/*
	 * counter_init - Initialize the driver specific rdma counter struct.
	 */
	void (*counter_init)(struct rdma_counter *counter);

	/*
	 * Allows rdma drivers to add their own restrack attributes
	 * dumped via 'rdma stat' iproute2 command.
	 */
	int (*fill_stat_mr_entry)(struct sk_buff *msg, struct ib_mr *ibmr);

	/* query driver for its ucontext properties */
	int (*query_ucontext)(struct ib_ucontext *context,
			      struct uverbs_attr_bundle *attrs);

	/*
	 * Provide NUMA node. This API exists for rdmavt/hfi1 only.
	 * Everyone else relies on Linux memory management model.
	 */
	int (*get_numa_node)(struct ib_device *dev);

	/*
	 * add_sub_dev - Add a sub IB device
	 */
	struct ib_device *(*add_sub_dev)(struct ib_device *parent,
					 enum rdma_nl_dev_type type,
					 const char *name);

	/*
	 * del_sub_dev - Delete a sub IB device
	 */
	void (*del_sub_dev)(struct ib_device *sub_dev);

	/*
	 * ufile_cleanup - Attempt to cleanup ubojects HW resources inside
	 * the ufile.
	 */
	void (*ufile_hw_cleanup)(struct ib_uverbs_file *ufile);

	/*
	 * report_port_event - Drivers need to implement this if they have
	 * some private stuff to handle when link status changes.
	 */
	void (*report_port_event)(struct ib_device *ibdev,
				  struct net_device *ndev, unsigned long event);

	DECLARE_RDMA_OBJ_SIZE(ib_ah);
	DECLARE_RDMA_OBJ_SIZE(ib_counters);
	DECLARE_RDMA_OBJ_SIZE(ib_cq);
	DECLARE_RDMA_OBJ_SIZE(ib_dmah);
	DECLARE_RDMA_OBJ_SIZE(ib_mw);
	DECLARE_RDMA_OBJ_SIZE(ib_pd);
	DECLARE_RDMA_OBJ_SIZE(ib_qp);
	DECLARE_RDMA_OBJ_SIZE(ib_rwq_ind_table);
	DECLARE_RDMA_OBJ_SIZE(ib_srq);
	DECLARE_RDMA_OBJ_SIZE(ib_ucontext);
	DECLARE_RDMA_OBJ_SIZE(ib_xrcd);
	DECLARE_RDMA_OBJ_SIZE(rdma_counter);
};

struct ib_core_device {
	/* device must be the first element in structure until,
	 * union of ib_core_device and device exists in ib_device.
	 */
	struct device dev;
	possible_net_t rdma_net;
	struct kobject *ports_kobj;
	struct list_head port_list;
	struct ib_device *owner; /* reach back to owner ib_device */
};

struct rdma_restrack_root;
struct ib_device {
	/* Do not access @dma_device directly from ULP nor from HW drivers. */
	struct device                *dma_device;
	struct ib_device_ops	     ops;
	char                          name[IB_DEVICE_NAME_MAX];
	struct rcu_head rcu_head;

	struct list_head              event_handler_list;
	/* Protects event_handler_list */
	struct rw_semaphore event_handler_rwsem;

	/* Protects QP's event_handler calls and open_qp list */
	spinlock_t qp_open_list_lock;

	struct rw_semaphore	      client_data_rwsem;
	struct xarray                 client_data;
	struct mutex                  unregistration_lock;

	/* Synchronize GID, Pkey cache entries, subnet prefix, LMC */
	rwlock_t cache_lock;
	/**
	 * port_data is indexed by port number
	 */
	struct ib_port_data *port_data;

	int			      num_comp_vectors;

	union {
		struct device		dev;
		struct ib_core_device	coredev;
	};

	/* First group is for device attributes,
	 * Second group is for driver provided attributes (optional).
	 * Third group is for the hw_stats
	 * It is a NULL terminated array.
	 */
	const struct attribute_group	*groups[4];
	u8				hw_stats_attr_index;

	u64			     uverbs_cmd_mask;

	char			     node_desc[IB_DEVICE_NODE_DESC_MAX];
	__be64			     node_guid;
	u32			     local_dma_lkey;
	u16                          is_switch:1;
	/* Indicates kernel verbs support, should not be used in drivers */
	u16                          kverbs_provider:1;
	/* CQ adaptive moderation (RDMA DIM) */
	u16                          use_cq_dim:1;
	u8                           node_type;
	u32			     phys_port_cnt;
	struct ib_device_attr        attrs;
	struct hw_stats_device_data *hw_stats_data;

#ifdef CONFIG_CGROUP_RDMA
	struct rdmacg_device         cg_device;
#endif

	u32                          index;

	spinlock_t                   cq_pools_lock;
	struct list_head             cq_pools[IB_POLL_LAST_POOL_TYPE + 1];

	struct rdma_restrack_root *res;

	const struct uapi_definition   *driver_def;

	/*
	 * Positive refcount indicates that the device is currently
	 * registered and cannot be unregistered.
	 */
	refcount_t refcount;
	struct completion unreg_completion;
	struct work_struct unregistration_work;

	const struct rdma_link_ops *link_ops;

	/* Protects compat_devs xarray modifications */
	struct mutex compat_devs_mutex;
	/* Maintains compat devices for each net namespace */
	struct xarray compat_devs;

	/* Used by iWarp CM */
	char iw_ifname[IFNAMSIZ];
	u32 iw_driver_flags;
	u32 lag_flags;

	/* A parent device has a list of sub-devices */
	struct mutex subdev_lock;
	struct list_head subdev_list_head;

	/* A sub device has a type and a parent */
	enum rdma_nl_dev_type type;
	struct ib_device *parent;
	struct list_head subdev_list;

	enum rdma_nl_name_assign_type name_assign_type;
};

static inline void *rdma_zalloc_obj(struct ib_device *dev, size_t size,
				    gfp_t gfp, bool is_numa_aware)
{
	if (is_numa_aware && dev->ops.get_numa_node)
		return kzalloc_node(size, gfp, dev->ops.get_numa_node(dev));

	return kzalloc(size, gfp);
}

struct ib_client_nl_info;
struct ib_client {
	const char *name;
	int (*add)(struct ib_device *ibdev);
	void (*remove)(struct ib_device *, void *client_data);
	void (*rename)(struct ib_device *dev, void *client_data);
	int (*get_nl_info)(struct ib_device *ibdev, void *client_data,
			   struct ib_client_nl_info *res);
	int (*get_global_nl_info)(struct ib_client_nl_info *res);

	/* Returns the net_dev belonging to this ib_client and matching the
	 * given parameters.
	 * @dev:	 An RDMA device that the net_dev use for communication.
	 * @port:	 A physical port number on the RDMA device.
	 * @pkey:	 P_Key that the net_dev uses if applicable.
	 * @gid:	 A GID that the net_dev uses to communicate.
	 * @addr:	 An IP address the net_dev is configured with.
	 * @client_data: The device's client data set by ib_set_client_data().
	 *
	 * An ib_client that implements a net_dev on top of RDMA devices
	 * (such as IP over IB) should implement this callback, allowing the
	 * rdma_cm module to find the right net_dev for a given request.
	 *
	 * The caller is responsible for calling dev_put on the returned
	 * netdev. */
	struct net_device *(*get_net_dev_by_params)(
			struct ib_device *dev,
			u32 port,
			u16 pkey,
			const union ib_gid *gid,
			const struct sockaddr *addr,
			void *client_data);

	refcount_t uses;
	struct completion uses_zero;
	u32 client_id;

	/* kverbs are not required by the client */
	u8 no_kverbs_req:1;
};

/*
 * IB block DMA iterator
 *
 * Iterates the DMA-mapped SGL in contiguous memory blocks aligned
 * to a HW supported page size.
 */
struct ib_block_iter {
	/* internal states */
	struct scatterlist *__sg;	/* sg holding the current aligned block */
	dma_addr_t __dma_addr;		/* unaligned DMA address of this block */
	size_t __sg_numblocks;		/* ib_umem_num_dma_blocks() */
	unsigned int __sg_nents;	/* number of SG entries */
	unsigned int __sg_advance;	/* number of bytes to advance in sg in next step */
	unsigned int __pg_bit;		/* alignment of current block */
};

struct ib_device *_ib_alloc_device(size_t size, struct net *net);
#define ib_alloc_device(drv_struct, member)                                    \
	container_of(_ib_alloc_device(sizeof(struct drv_struct) +              \
				      BUILD_BUG_ON_ZERO(offsetof(              \
					      struct drv_struct, member)),     \
				      &init_net),			       \
		     struct drv_struct, member)

#define ib_alloc_device_with_net(drv_struct, member, net)		       \
	container_of(_ib_alloc_device(sizeof(struct drv_struct) +              \
				      BUILD_BUG_ON_ZERO(offsetof(              \
					struct drv_struct, member)), net),     \
		     struct drv_struct, member)

void ib_dealloc_device(struct ib_device *device);

void ib_get_device_fw_str(struct ib_device *device, char *str);

int ib_register_device(struct ib_device *device, const char *name,
		       struct device *dma_device);
void ib_unregister_device(struct ib_device *device);
void ib_unregister_driver(enum rdma_driver_id driver_id);
void ib_unregister_device_and_put(struct ib_device *device);
void ib_unregister_device_queued(struct ib_device *ib_dev);

int ib_register_client   (struct ib_client *client);
void ib_unregister_client(struct ib_client *client);

void __rdma_block_iter_start(struct ib_block_iter *biter,
			     struct scatterlist *sglist,
			     unsigned int nents,
			     unsigned long pgsz);
bool __rdma_block_iter_next(struct ib_block_iter *biter);

/**
 * rdma_block_iter_dma_address - get the aligned dma address of the current
 * block held by the block iterator.
 * @biter: block iterator holding the memory block
 */
static inline dma_addr_t
rdma_block_iter_dma_address(struct ib_block_iter *biter)
{
	return biter->__dma_addr & ~(BIT_ULL(biter->__pg_bit) - 1);
}

/**
 * rdma_for_each_block - iterate over contiguous memory blocks of the sg list
 * @sglist: sglist to iterate over
 * @biter: block iterator holding the memory block
 * @nents: maximum number of sg entries to iterate over
 * @pgsz: best HW supported page size to use
 *
 * Callers may use rdma_block_iter_dma_address() to get each
 * blocks aligned DMA address.
 */
#define rdma_for_each_block(sglist, biter, nents, pgsz)		\
	for (__rdma_block_iter_start(biter, sglist, nents,	\
				     pgsz);			\
	     __rdma_block_iter_next(biter);)

/**
 * ib_get_client_data - Get IB client context
 * @device:Device to get context for
 * @client:Client to get context for
 *
 * ib_get_client_data() returns the client context data set with
 * ib_set_client_data(). This can only be called while the client is
 * registered to the device, once the ib_client remove() callback returns this
 * cannot be called.
 */
static inline void *ib_get_client_data(struct ib_device *device,
				       struct ib_client *client)
{
	return xa_load(&device->client_data, client->client_id);
}
void  ib_set_client_data(struct ib_device *device, struct ib_client *client,
			 void *data);
void ib_set_device_ops(struct ib_device *device,
		       const struct ib_device_ops *ops);

int rdma_user_mmap_io(struct ib_ucontext *ucontext, struct vm_area_struct *vma,
		      unsigned long pfn, unsigned long size, pgprot_t prot,
		      struct rdma_user_mmap_entry *entry);
int rdma_user_mmap_entry_insert(struct ib_ucontext *ucontext,
				struct rdma_user_mmap_entry *entry,
				size_t length);
int rdma_user_mmap_entry_insert_range(struct ib_ucontext *ucontext,
				      struct rdma_user_mmap_entry *entry,
				      size_t length, u32 min_pgoff,
				      u32 max_pgoff);

#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS)
void rdma_user_mmap_disassociate(struct ib_device *device);
#else
static inline void rdma_user_mmap_disassociate(struct ib_device *device)
{
}
#endif

static inline int
rdma_user_mmap_entry_insert_exact(struct ib_ucontext *ucontext,
				  struct rdma_user_mmap_entry *entry,
				  size_t length, u32 pgoff)
{
	return rdma_user_mmap_entry_insert_range(ucontext, entry, length, pgoff,
						 pgoff);
}

struct rdma_user_mmap_entry *
rdma_user_mmap_entry_get_pgoff(struct ib_ucontext *ucontext,
			       unsigned long pgoff);
struct rdma_user_mmap_entry *
rdma_user_mmap_entry_get(struct ib_ucontext *ucontext,
			 struct vm_area_struct *vma);
void rdma_user_mmap_entry_put(struct rdma_user_mmap_entry *entry);

void rdma_user_mmap_entry_remove(struct rdma_user_mmap_entry *entry);

static inline int ib_copy_from_udata(void *dest, struct ib_udata *udata, size_t len)
{
	return copy_from_user(dest, udata->inbuf, len) ? -EFAULT : 0;
}

static inline int ib_copy_to_udata(struct ib_udata *udata, void *src, size_t len)
{
	return copy_to_user(udata->outbuf, src, len) ? -EFAULT : 0;
}

static inline bool ib_is_buffer_cleared(const void __user *p,
					size_t len)
{
	bool ret;
	u8 *buf;

	if (len > USHRT_MAX)
		return false;

	buf = memdup_user(p, len);
	if (IS_ERR(buf))
		return false;

	ret = !memchr_inv(buf, 0, len);
	kfree(buf);
	return ret;
}

static inline bool ib_is_udata_cleared(struct ib_udata *udata,
				       size_t offset,
				       size_t len)
{
	return ib_is_buffer_cleared(udata->inbuf + offset, len);
}

/**
 * ib_modify_qp_is_ok - Check that the supplied attribute mask
 * contains all required attributes and no attributes not allowed for
 * the given QP state transition.
 * @cur_state: Current QP state
 * @next_state: Next QP state
 * @type: QP type
 * @mask: Mask of supplied QP attributes
 *
 * This function is a helper function that a low-level driver's
 * modify_qp method can use to validate the consumer's input.  It
 * checks that cur_state and next_state are valid QP states, that a
 * transition from cur_state to next_state is allowed by the IB spec,
 * and that the attribute mask supplied is allowed for the transition.
 */
bool ib_modify_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state next_state,
			enum ib_qp_type type, enum ib_qp_attr_mask mask);

void ib_register_event_handler(struct ib_event_handler *event_handler);
void ib_unregister_event_handler(struct ib_event_handler *event_handler);
void ib_dispatch_event(const struct ib_event *event);

int ib_query_port(struct ib_device *device,
		  u32 port_num, struct ib_port_attr *port_attr);

enum rdma_link_layer rdma_port_get_link_layer(struct ib_device *device,
					       u32 port_num);

/**
 * rdma_cap_ib_switch - Check if the device is IB switch
 * @device: Device to check
 *
 * Device driver is responsible for setting is_switch bit on
 * in ib_device structure at init time.
 *
 * Return: true if the device is IB switch.
 */
static inline bool rdma_cap_ib_switch(const struct ib_device *device)
{
	return device->is_switch;
}

/**
 * rdma_start_port - Return the first valid port number for the device
 * specified
 *
 * @device: Device to be checked
 *
 * Return start port number
 */
static inline u32 rdma_start_port(const struct ib_device *device)
{
	return rdma_cap_ib_switch(device) ? 0 : 1;
}

/**
 * rdma_for_each_port - Iterate over all valid port numbers of the IB device
 * @device: The struct ib_device * to iterate over
 * @iter: The unsigned int to store the port number
 */
#define rdma_for_each_port(device, iter)                                       \
	for (iter = rdma_start_port(device +				       \
				    BUILD_BUG_ON_ZERO(!__same_type(u32,	       \
								   iter)));    \
	     iter <= rdma_end_port(device); iter++)

/**
 * rdma_end_port - Return the last valid port number for the device
 * specified
 *
 * @device: Device to be checked
 *
 * Return last port number
 */
static inline u32 rdma_end_port(const struct ib_device *device)
{
	return rdma_cap_ib_switch(device) ? 0 : device->phys_port_cnt;
}

static inline int rdma_is_port_valid(const struct ib_device *device,
				     unsigned int port)
{
	return (port >= rdma_start_port(device) &&
		port <= rdma_end_port(device));
}

static inline bool rdma_is_grh_required(const struct ib_device *device,
					u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_PORT_IB_GRH_REQUIRED;
}

static inline bool rdma_protocol_ib(const struct ib_device *device,
				    u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_IB;
}

static inline bool rdma_protocol_roce(const struct ib_device *device,
				      u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       (RDMA_CORE_CAP_PROT_ROCE | RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP);
}

static inline bool rdma_protocol_roce_udp_encap(const struct ib_device *device,
						u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP;
}

static inline bool rdma_protocol_roce_eth_encap(const struct ib_device *device,
						u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_ROCE;
}

static inline bool rdma_protocol_iwarp(const struct ib_device *device,
				       u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_IWARP;
}

static inline bool rdma_ib_or_roce(const struct ib_device *device,
				   u32 port_num)
{
	return rdma_protocol_ib(device, port_num) ||
		rdma_protocol_roce(device, port_num);
}

static inline bool rdma_protocol_raw_packet(const struct ib_device *device,
					    u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_RAW_PACKET;
}

static inline bool rdma_protocol_usnic(const struct ib_device *device,
				       u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_PROT_USNIC;
}

/**
 * rdma_cap_ib_mad - Check if the port of a device supports Infiniband
 * Management Datagrams.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * Management Datagrams (MAD) are a required part of the InfiniBand
 * specification and are supported on all InfiniBand devices.  A slightly
 * extended version are also supported on OPA interfaces.
 *
 * Return: true if the port supports sending/receiving of MAD packets.
 */
static inline bool rdma_cap_ib_mad(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_IB_MAD;
}

/**
 * rdma_cap_opa_mad - Check if the port of device provides support for OPA
 * Management Datagrams.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * Intel OmniPath devices extend and/or replace the InfiniBand Management
 * datagrams with their own versions.  These OPA MADs share many but not all of
 * the characteristics of InfiniBand MADs.
 *
 * OPA MADs differ in the following ways:
 *
 *    1) MADs are variable size up to 2K
 *       IBTA defined MADs remain fixed at 256 bytes
 *    2) OPA SMPs must carry valid PKeys
 *    3) OPA SMP packets are a different format
 *
 * Return: true if the port supports OPA MAD packet formats.
 */
static inline bool rdma_cap_opa_mad(struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
		RDMA_CORE_CAP_OPA_MAD;
}

/**
 * rdma_cap_ib_smi - Check if the port of a device provides an Infiniband
 * Subnet Management Agent (SMA) on the Subnet Management Interface (SMI).
 * @device: Device to check
 * @port_num: Port number to check
 *
 * Each InfiniBand node is required to provide a Subnet Management Agent
 * that the subnet manager can access.  Prior to the fabric being fully
 * configured by the subnet manager, the SMA is accessed via a well known
 * interface called the Subnet Management Interface (SMI).  This interface
 * uses directed route packets to communicate with the SM to get around the
 * chicken and egg problem of the SM needing to know what's on the fabric
 * in order to configure the fabric, and needing to configure the fabric in
 * order to send packets to the devices on the fabric.  These directed
 * route packets do not need the fabric fully configured in order to reach
 * their destination.  The SMI is the only method allowed to send
 * directed route packets on an InfiniBand fabric.
 *
 * Return: true if the port provides an SMI.
 */
static inline bool rdma_cap_ib_smi(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_IB_SMI;
}

/**
 * rdma_cap_ib_cm - Check if the port of device has the capability Infiniband
 * Communication Manager.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * The InfiniBand Communication Manager is one of many pre-defined General
 * Service Agents (GSA) that are accessed via the General Service
 * Interface (GSI).  It's role is to facilitate establishment of connections
 * between nodes as well as other management related tasks for established
 * connections.
 *
 * Return: true if the port supports an IB CM (this does not guarantee that
 * a CM is actually running however).
 */
static inline bool rdma_cap_ib_cm(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_IB_CM;
}

/**
 * rdma_cap_iw_cm - Check if the port of device has the capability IWARP
 * Communication Manager.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * Similar to above, but specific to iWARP connections which have a different
 * managment protocol than InfiniBand.
 *
 * Return: true if the port supports an iWARP CM (this does not guarantee that
 * a CM is actually running however).
 */
static inline bool rdma_cap_iw_cm(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_IW_CM;
}

/**
 * rdma_cap_ib_sa - Check if the port of device has the capability Infiniband
 * Subnet Administration.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * An InfiniBand Subnet Administration (SA) service is a pre-defined General
 * Service Agent (GSA) provided by the Subnet Manager (SM).  On InfiniBand
 * fabrics, devices should resolve routes to other hosts by contacting the
 * SA to query the proper route.
 *
 * Return: true if the port should act as a client to the fabric Subnet
 * Administration interface.  This does not imply that the SA service is
 * running locally.
 */
static inline bool rdma_cap_ib_sa(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_IB_SA;
}

/**
 * rdma_cap_ib_mcast - Check if the port of device has the capability Infiniband
 * Multicast.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * InfiniBand multicast registration is more complex than normal IPv4 or
 * IPv6 multicast registration.  Each Host Channel Adapter must register
 * with the Subnet Manager when it wishes to join a multicast group.  It
 * should do so only once regardless of how many queue pairs it subscribes
 * to this group.  And it should leave the group only after all queue pairs
 * attached to the group have been detached.
 *
 * Return: true if the port must undertake the additional adminstrative
 * overhead of registering/unregistering with the SM and tracking of the
 * total number of queue pairs attached to the multicast group.
 */
static inline bool rdma_cap_ib_mcast(const struct ib_device *device,
				     u32 port_num)
{
	return rdma_cap_ib_sa(device, port_num);
}

/**
 * rdma_cap_af_ib - Check if the port of device has the capability
 * Native Infiniband Address.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * InfiniBand addressing uses a port's GUID + Subnet Prefix to make a default
 * GID.  RoCE uses a different mechanism, but still generates a GID via
 * a prescribed mechanism and port specific data.
 *
 * Return: true if the port uses a GID address to identify devices on the
 * network.
 */
static inline bool rdma_cap_af_ib(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_AF_IB;
}

/**
 * rdma_cap_eth_ah - Check if the port of device has the capability
 * Ethernet Address Handle.
 * @device: Device to check
 * @port_num: Port number to check
 *
 * RoCE is InfiniBand over Ethernet, and it uses a well defined technique
 * to fabricate GIDs over Ethernet/IP specific addresses native to the
 * port.  Normally, packet headers are generated by the sending host
 * adapter, but when sending connectionless datagrams, we must manually
 * inject the proper headers for the fabric we are communicating over.
 *
 * Return: true if we are running as a RoCE port and must force the
 * addition of a Global Route Header built from our Ethernet Address
 * Handle into our header list for connectionless packets.
 */
static inline bool rdma_cap_eth_ah(const struct ib_device *device, u32 port_num)
{
	return device->port_data[port_num].immutable.core_cap_flags &
	       RDMA_CORE_CAP_ETH_AH;
}

/**
 * rdma_cap_opa_ah - Check if the port of device supports
 * OPA Address handles
 * @device: Device to check
 * @port_num: Port number to check
 *
 * Return: true if we are running on an OPA device which supports
 * the extended OPA addressing.
 */
static inline bool rdma_cap_opa_ah(struct ib_device *device, u32 port_num)
{
	return (device->port_data[port_num].immutable.core_cap_flags &
		RDMA_CORE_CAP_OPA_AH) == RDMA_CORE_CAP_OPA_AH;
}

/**
 * rdma_max_mad_size - Return the max MAD size required by this RDMA Port.
 *
 * @device: Device
 * @port_num: Port number
 *
 * This MAD size includes the MAD headers and MAD payload.  No other headers
 * are included.
 *
 * Return the max MAD size required by the Port.  Will return 0 if the port
 * does not support MADs
 */
static inline size_t rdma_max_mad_size(const struct ib_device *device,
				       u32 port_num)
{
	return device->port_data[port_num].immutable.max_mad_size;
}

/**
 * rdma_cap_roce_gid_table - Check if the port of device uses roce_gid_table
 * @device: Device to check
 * @port_num: Port number to check
 *
 * RoCE GID table mechanism manages the various GIDs for a device.
 *
 * NOTE: if allocating the port's GID table has failed, this call will still
 * return true, but any RoCE GID table API will fail.
 *
 * Return: true if the port uses RoCE GID table mechanism in order to manage
 * its GIDs.
 */
static inline bool rdma_cap_roce_gid_table(const struct ib_device *device,
					   u32 port_num)
{
	return rdma_protocol_roce(device, port_num) &&
		device->ops.add_gid && device->ops.del_gid;
}

/*
 * Check if the device supports READ W/ INVALIDATE.
 */
static inline bool rdma_cap_read_inv(struct ib_device *dev, u32 port_num)
{
	/*
	 * iWarp drivers must support READ W/ INVALIDATE.  No other protocol
	 * has support for it yet.
	 */
	return rdma_protocol_iwarp(dev, port_num);
}

/**
 * rdma_core_cap_opa_port - Return whether the RDMA Port is OPA or not.
 * @device: Device
 * @port_num: 1 based Port number
 *
 * Return true if port is an Intel OPA port , false if not
 */
static inline bool rdma_core_cap_opa_port(struct ib_device *device,
					  u32 port_num)
{
	return (device->port_data[port_num].immutable.core_cap_flags &
		RDMA_CORE_PORT_INTEL_OPA) == RDMA_CORE_PORT_INTEL_OPA;
}

/**
 * rdma_mtu_enum_to_int - Return the mtu of the port as an integer value.
 * @device: Device
 * @port: Port number
 * @mtu: enum value of MTU
 *
 * Return the MTU size supported by the port as an integer value. Will return
 * -1 if enum value of mtu is not supported.
 */
static inline int rdma_mtu_enum_to_int(struct ib_device *device, u32 port,
				       int mtu)
{
	if (rdma_core_cap_opa_port(device, port))
		return opa_mtu_enum_to_int((enum opa_mtu)mtu);
	else
		return ib_mtu_enum_to_int((enum ib_mtu)mtu);
}

/**
 * rdma_mtu_from_attr - Return the mtu of the port from the port attribute.
 * @device: Device
 * @port: Port number
 * @attr: port attribute
 *
 * Return the MTU size supported by the port as an integer value.
 */
static inline int rdma_mtu_from_attr(struct ib_device *device, u32 port,
				     struct ib_port_attr *attr)
{
	if (rdma_core_cap_opa_port(device, port))
		return attr->phys_mtu;
	else
		return ib_mtu_enum_to_int(attr->max_mtu);
}

int ib_set_vf_link_state(struct ib_device *device, int vf, u32 port,
			 int state);
int ib_get_vf_config(struct ib_device *device, int vf, u32 port,
		     struct ifla_vf_info *info);
int ib_get_vf_stats(struct ib_device *device, int vf, u32 port,
		    struct ifla_vf_stats *stats);
int ib_get_vf_guid(struct ib_device *device, int vf, u32 port,
		    struct ifla_vf_guid *node_guid,
		    struct ifla_vf_guid *port_guid);
int ib_set_vf_guid(struct ib_device *device, int vf, u32 port, u64 guid,
		   int type);

int ib_query_pkey(struct ib_device *device,
		  u32 port_num, u16 index, u16 *pkey);

int ib_modify_device(struct ib_device *device,
		     int device_modify_mask,
		     struct ib_device_modify *device_modify);

int ib_modify_port(struct ib_device *device,
		   u32 port_num, int port_modify_mask,
		   struct ib_port_modify *port_modify);

int ib_find_gid(struct ib_device *device, union ib_gid *gid,
		u32 *port_num, u16 *index);

int ib_find_pkey(struct ib_device *device,
		 u32 port_num, u16 pkey, u16 *index);

enum ib_pd_flags {
	/*
	 * Create a memory registration for all memory in the system and place
	 * the rkey for it into pd->unsafe_global_rkey.  This can be used by
	 * ULPs to avoid the overhead of dynamic MRs.
	 *
	 * This flag is generally considered unsafe and must only be used in
	 * extremly trusted environments.  Every use of it will log a warning
	 * in the kernel log.
	 */
	IB_PD_UNSAFE_GLOBAL_RKEY	= 0x01,
};

struct ib_pd *__ib_alloc_pd(struct ib_device *device, unsigned int flags,
		const char *caller);

/**
 * ib_alloc_pd - Allocates an unused protection domain.
 * @device: The device on which to allocate the protection domain.
 * @flags: protection domain flags
 *
 * A protection domain object provides an association between QPs, shared
 * receive queues, address handles, memory regions, and memory windows.
 *
 * Every PD has a local_dma_lkey which can be used as the lkey value for local
 * memory operations.
 */
#define ib_alloc_pd(device, flags) \
	__ib_alloc_pd((device), (flags), KBUILD_MODNAME)

int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_udata *udata);

/**
 * ib_dealloc_pd - Deallocate kernel PD
 * @pd: The protection domain
 *
 * NOTE: for user PD use ib_dealloc_pd_user with valid udata!
 */
static inline void ib_dealloc_pd(struct ib_pd *pd)
{
	int ret = ib_dealloc_pd_user(pd, NULL);

	WARN_ONCE(ret, "Destroy of kernel PD shouldn't fail");
}

enum rdma_create_ah_flags {
	/* In a sleepable context */
	RDMA_CREATE_AH_SLEEPABLE = BIT(0),
};

/**
 * rdma_create_ah - Creates an address handle for the given address vector.
 * @pd: The protection domain associated with the address handle.
 * @ah_attr: The attributes of the address vector.
 * @flags: Create address handle flags (see enum rdma_create_ah_flags).
 *
 * The address handle is used to reference a local or global destination
 * in all UD QP post sends.
 */
struct ib_ah *rdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr,
			     u32 flags);

/**
 * rdma_create_user_ah - Creates an address handle for the given address vector.
 * It resolves destination mac address for ah attribute of RoCE type.
 * @pd: The protection domain associated with the address handle.
 * @ah_attr: The attributes of the address vector.
 * @udata: pointer to user's input output buffer information need by
 *         provider driver.
 *
 * It returns 0 on success and returns appropriate error code on error.
 * The address handle is used to reference a local or global destination
 * in all UD QP post sends.
 */
struct ib_ah *rdma_create_user_ah(struct ib_pd *pd,
				  struct rdma_ah_attr *ah_attr,
				  struct ib_udata *udata);
/**
 * ib_get_gids_from_rdma_hdr - Get sgid and dgid from GRH or IPv4 header
 *   work completion.
 * @hdr: the L3 header to parse
 * @net_type: type of header to parse
 * @sgid: place to store source gid
 * @dgid: place to store destination gid
 */
int ib_get_gids_from_rdma_hdr(const union rdma_network_hdr *hdr,
			      enum rdma_network_type net_type,
			      union ib_gid *sgid, union ib_gid *dgid);

/**
 * ib_get_rdma_header_version - Get the header version
 * @hdr: the L3 header to parse
 */
int ib_get_rdma_header_version(const union rdma_network_hdr *hdr);

/**
 * ib_init_ah_attr_from_wc - Initializes address handle attributes from a
 *   work completion.
 * @device: Device on which the received message arrived.
 * @port_num: Port on which the received message arrived.
 * @wc: Work completion associated with the received message.
 * @grh: References the received global route header.  This parameter is
 *   ignored unless the work completion indicates that the GRH is valid.
 * @ah_attr: Returned attributes that can be used when creating an address
 *   handle for replying to the message.
 * When ib_init_ah_attr_from_wc() returns success,
 * (a) for IB link layer it optionally contains a reference to SGID attribute
 * when GRH is present for IB link layer.
 * (b) for RoCE link layer it contains a reference to SGID attribute.
 * User must invoke rdma_cleanup_ah_attr_gid_attr() to release reference to SGID
 * attributes which are initialized using ib_init_ah_attr_from_wc().
 *
 */
int ib_init_ah_attr_from_wc(struct ib_device *device, u32 port_num,
			    const struct ib_wc *wc, const struct ib_grh *grh,
			    struct rdma_ah_attr *ah_attr);

/**
 * ib_create_ah_from_wc - Creates an address handle associated with the
 *   sender of the specified work completion.
 * @pd: The protection domain associated with the address handle.
 * @wc: Work completion information associated with a received message.
 * @grh: References the received global route header.  This parameter is
 *   ignored unless the work completion indicates that the GRH is valid.
 * @port_num: The outbound port number to associate with the address.
 *
 * The address handle is used to reference a local or global destination
 * in all UD QP post sends.
 */
struct ib_ah *ib_create_ah_from_wc(struct ib_pd *pd, const struct ib_wc *wc,
				   const struct ib_grh *grh, u32 port_num);

/**
 * rdma_modify_ah - Modifies the address vector associated with an address
 *   handle.
 * @ah: The address handle to modify.
 * @ah_attr: The new address vector attributes to associate with the
 *   address handle.
 */
int rdma_modify_ah(struct ib_ah *ah, struct rdma_ah_attr *ah_attr);

/**
 * rdma_query_ah - Queries the address vector associated with an address
 *   handle.
 * @ah: The address handle to query.
 * @ah_attr: The address vector attributes associated with the address
 *   handle.
 */
int rdma_query_ah(struct ib_ah *ah, struct rdma_ah_attr *ah_attr);

enum rdma_destroy_ah_flags {
	/* In a sleepable context */
	RDMA_DESTROY_AH_SLEEPABLE = BIT(0),
};

/**
 * rdma_destroy_ah_user - Destroys an address handle.
 * @ah: The address handle to destroy.
 * @flags: Destroy address handle flags (see enum rdma_destroy_ah_flags).
 * @udata: Valid user data or NULL for kernel objects
 */
int rdma_destroy_ah_user(struct ib_ah *ah, u32 flags, struct ib_udata *udata);

/**
 * rdma_destroy_ah - Destroys an kernel address handle.
 * @ah: The address handle to destroy.
 * @flags: Destroy address handle flags (see enum rdma_destroy_ah_flags).
 *
 * NOTE: for user ah use rdma_destroy_ah_user with valid udata!
 */
static inline void rdma_destroy_ah(struct ib_ah *ah, u32 flags)
{
	int ret = rdma_destroy_ah_user(ah, flags, NULL);

	WARN_ONCE(ret, "Destroy of kernel AH shouldn't fail");
}

struct ib_srq *ib_create_srq_user(struct ib_pd *pd,
				  struct ib_srq_init_attr *srq_init_attr,
				  struct ib_usrq_object *uobject,
				  struct ib_udata *udata);
static inline struct ib_srq *
ib_create_srq(struct ib_pd *pd, struct ib_srq_init_attr *srq_init_attr)
{
	if (!pd->device->ops.create_srq)
		return ERR_PTR(-EOPNOTSUPP);

	return ib_create_srq_user(pd, srq_init_attr, NULL, NULL);
}

/**
 * ib_modify_srq - Modifies the attributes for the specified SRQ.
 * @srq: The SRQ to modify.
 * @srq_attr: On input, specifies the SRQ attributes to modify.  On output,
 *   the current values of selected SRQ attributes are returned.
 * @srq_attr_mask: A bit-mask used to specify which attributes of the SRQ
 *   are being modified.
 *
 * The mask may contain IB_SRQ_MAX_WR to resize the SRQ and/or
 * IB_SRQ_LIMIT to set the SRQ's limit and request notification when
 * the number of receives queued drops below the limit.
 */
int ib_modify_srq(struct ib_srq *srq,
		  struct ib_srq_attr *srq_attr,
		  enum ib_srq_attr_mask srq_attr_mask);

/**
 * ib_query_srq - Returns the attribute list and current values for the
 *   specified SRQ.
 * @srq: The SRQ to query.
 * @srq_attr: The attributes of the specified SRQ.
 */
int ib_query_srq(struct ib_srq *srq,
		 struct ib_srq_attr *srq_attr);

/**
 * ib_destroy_srq_user - Destroys the specified SRQ.
 * @srq: The SRQ to destroy.
 * @udata: Valid user data or NULL for kernel objects
 */
int ib_destroy_srq_user(struct ib_srq *srq, struct ib_udata *udata);

/**
 * ib_destroy_srq - Destroys the specified kernel SRQ.
 * @srq: The SRQ to destroy.
 *
 * NOTE: for user srq use ib_destroy_srq_user with valid udata!
 */
static inline void ib_destroy_srq(struct ib_srq *srq)
{
	int ret = ib_destroy_srq_user(srq, NULL);

	WARN_ONCE(ret, "Destroy of kernel SRQ shouldn't fail");
}

/**
 * ib_post_srq_recv - Posts a list of work requests to the specified SRQ.
 * @srq: The SRQ to post the work request on.
 * @recv_wr: A list of work requests to post on the receive queue.
 * @bad_recv_wr: On an immediate failure, this parameter will reference
 *   the work request that failed to be posted on the QP.
 */
static inline int ib_post_srq_recv(struct ib_srq *srq,
				   const struct ib_recv_wr *recv_wr,
				   const struct ib_recv_wr **bad_recv_wr)
{
	const struct ib_recv_wr *dummy;

	return srq->device->ops.post_srq_recv(srq, recv_wr,
					      bad_recv_wr ? : &dummy);
}

struct ib_qp *ib_create_qp_kernel(struct ib_pd *pd,
				  struct ib_qp_init_attr *qp_init_attr,
				  const char *caller);
/**
 * ib_create_qp - Creates a kernel QP associated with the specific protection
 * domain.
 * @pd: The protection domain associated with the QP.
 * @init_attr: A list of initial attributes required to create the
 *   QP.  If QP creation succeeds, then the attributes are updated to
 *   the actual capabilities of the created QP.
 */
static inline struct ib_qp *ib_create_qp(struct ib_pd *pd,
					 struct ib_qp_init_attr *init_attr)
{
	return ib_create_qp_kernel(pd, init_attr, KBUILD_MODNAME);
}

/**
 * ib_modify_qp_with_udata - Modifies the attributes for the specified QP.
 * @qp: The QP to modify.
 * @attr: On input, specifies the QP attributes to modify.  On output,
 *   the current values of selected QP attributes are returned.
 * @attr_mask: A bit-mask used to specify which attributes of the QP
 *   are being modified.
 * @udata: pointer to user's input output buffer information
 *   are being modified.
 * It returns 0 on success and returns appropriate error code on error.
 */
int ib_modify_qp_with_udata(struct ib_qp *qp,
			    struct ib_qp_attr *attr,
			    int attr_mask,
			    struct ib_udata *udata);

/**
 * ib_modify_qp - Modifies the attributes for the specified QP and then
 *   transitions the QP to the given state.
 * @qp: The QP to modify.
 * @qp_attr: On input, specifies the QP attributes to modify.  On output,
 *   the current values of selected QP attributes are returned.
 * @qp_attr_mask: A bit-mask used to specify which attributes of the QP
 *   are being modified.
 */
int ib_modify_qp(struct ib_qp *qp,
		 struct ib_qp_attr *qp_attr,
		 int qp_attr_mask);

/**
 * ib_query_qp - Returns the attribute list and current values for the
 *   specified QP.
 * @qp: The QP to query.
 * @qp_attr: The attributes of the specified QP.
 * @qp_attr_mask: A bit-mask used to select specific attributes to query.
 * @qp_init_attr: Additional attributes of the selected QP.
 *
 * The qp_attr_mask may be used to limit the query to gathering only the
 * selected attributes.
 */
int ib_query_qp(struct ib_qp *qp,
		struct ib_qp_attr *qp_attr,
		int qp_attr_mask,
		struct ib_qp_init_attr *qp_init_attr);

/**
 * ib_destroy_qp - Destroys the specified QP.
 * @qp: The QP to destroy.
 * @udata: Valid udata or NULL for kernel objects
 */
int ib_destroy_qp_user(struct ib_qp *qp, struct ib_udata *udata);

/**
 * ib_destroy_qp - Destroys the specified kernel QP.
 * @qp: The QP to destroy.
 *
 * NOTE: for user qp use ib_destroy_qp_user with valid udata!
 */
static inline int ib_destroy_qp(struct ib_qp *qp)
{
	return ib_destroy_qp_user(qp, NULL);
}

/**
 * ib_open_qp - Obtain a reference to an existing sharable QP.
 * @xrcd: XRC domain
 * @qp_open_attr: Attributes identifying the QP to open.
 *
 * Returns a reference to a sharable QP.
 */
struct ib_qp *ib_open_qp(struct ib_xrcd *xrcd,
			 struct ib_qp_open_attr *qp_open_attr);

/**
 * ib_close_qp - Release an external reference to a QP.
 * @qp: The QP handle to release
 *
 * The opened QP handle is released by the caller.  The underlying
 * shared QP is not destroyed until all internal references are released.
 */
int ib_close_qp(struct ib_qp *qp);

/**
 * ib_post_send - Posts a list of work requests to the send queue of
 *   the specified QP.
 * @qp: The QP to post the work request on.
 * @send_wr: A list of work requests to post on the send queue.
 * @bad_send_wr: On an immediate failure, this parameter will reference
 *   the work request that failed to be posted on the QP.
 *
 * While IBA Vol. 1 section 11.4.1.1 specifies that if an immediate
 * error is returned, the QP state shall not be affected,
 * ib_post_send() will return an immediate error after queueing any
 * earlier work requests in the list.
 */
static inline int ib_post_send(struct ib_qp *qp,
			       const struct ib_send_wr *send_wr,
			       const struct ib_send_wr **bad_send_wr)
{
	const struct ib_send_wr *dummy;

	return qp->device->ops.post_send(qp, send_wr, bad_send_wr ? : &dummy);
}

/**
 * ib_post_recv - Posts a list of work requests to the receive queue of
 *   the specified QP.
 * @qp: The QP to post the work request on.
 * @recv_wr: A list of work requests to post on the receive queue.
 * @bad_recv_wr: On an immediate failure, this parameter will reference
 *   the work request that failed to be posted on the QP.
 */
static inline int ib_post_recv(struct ib_qp *qp,
			       const struct ib_recv_wr *recv_wr,
			       const struct ib_recv_wr **bad_recv_wr)
{
	const struct ib_recv_wr *dummy;

	return qp->device->ops.post_recv(qp, recv_wr, bad_recv_wr ? : &dummy);
}

struct ib_cq *__ib_alloc_cq(struct ib_device *dev, void *private, int nr_cqe,
			    int comp_vector, enum ib_poll_context poll_ctx,
			    const char *caller);
static inline struct ib_cq *ib_alloc_cq(struct ib_device *dev, void *private,
					int nr_cqe, int comp_vector,
					enum ib_poll_context poll_ctx)
{
	return __ib_alloc_cq(dev, private, nr_cqe, comp_vector, poll_ctx,
			     KBUILD_MODNAME);
}

struct ib_cq *__ib_alloc_cq_any(struct ib_device *dev, void *private,
				int nr_cqe, enum ib_poll_context poll_ctx,
				const char *caller);

/**
 * ib_alloc_cq_any: Allocate kernel CQ
 * @dev: The IB device
 * @private: Private data attached to the CQE
 * @nr_cqe: Number of CQEs in the CQ
 * @poll_ctx: Context used for polling the CQ
 */
static inline struct ib_cq *ib_alloc_cq_any(struct ib_device *dev,
					    void *private, int nr_cqe,
					    enum ib_poll_context poll_ctx)
{
	return __ib_alloc_cq_any(dev, private, nr_cqe, poll_ctx,
				 KBUILD_MODNAME);
}

void ib_free_cq(struct ib_cq *cq);
int ib_process_cq_direct(struct ib_cq *cq, int budget);

/**
 * ib_create_cq - Creates a CQ on the specified device.
 * @device: The device on which to create the CQ.
 * @comp_handler: A user-specified callback that is invoked when a
 *   completion event occurs on the CQ.
 * @event_handler: A user-specified callback that is invoked when an
 *   asynchronous event not associated with a completion occurs on the CQ.
 * @cq_context: Context associated with the CQ returned to the user via
 *   the associated completion and event handlers.
 * @cq_attr: The attributes the CQ should be created upon.
 *
 * Users can examine the cq structure to determine the actual CQ size.
 */
struct ib_cq *__ib_create_cq(struct ib_device *device,
			     ib_comp_handler comp_handler,
			     void (*event_handler)(struct ib_event *, void *),
			     void *cq_context,
			     const struct ib_cq_init_attr *cq_attr,
			     const char *caller);
#define ib_create_cq(device, cmp_hndlr, evt_hndlr, cq_ctxt, cq_attr) \
	__ib_create_cq((device), (cmp_hndlr), (evt_hndlr), (cq_ctxt), (cq_attr), KBUILD_MODNAME)

/**
 * ib_resize_cq - Modifies the capacity of the CQ.
 * @cq: The CQ to resize.
 * @cqe: The minimum size of the CQ.
 *
 * Users can examine the cq structure to determine the actual CQ size.
 */
int ib_resize_cq(struct ib_cq *cq, int cqe);

/**
 * rdma_set_cq_moderation - Modifies moderation params of the CQ
 * @cq: The CQ to modify.
 * @cq_count: number of CQEs that will trigger an event
 * @cq_period: max period of time in usec before triggering an event
 *
 */
int rdma_set_cq_moderation(struct ib_cq *cq, u16 cq_count, u16 cq_period);

/**
 * ib_destroy_cq_user - Destroys the specified CQ.
 * @cq: The CQ to destroy.
 * @udata: Valid user data or NULL for kernel objects
 */
int ib_destroy_cq_user(struct ib_cq *cq, struct ib_udata *udata);

/**
 * ib_destroy_cq - Destroys the specified kernel CQ.
 * @cq: The CQ to destroy.
 *
 * NOTE: for user cq use ib_destroy_cq_user with valid udata!
 */
static inline void ib_destroy_cq(struct ib_cq *cq)
{
	int ret = ib_destroy_cq_user(cq, NULL);

	WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail");
}

/**
 * ib_poll_cq - poll a CQ for completion(s)
 * @cq:the CQ being polled
 * @num_entries:maximum number of completions to return
 * @wc:array of at least @num_entries &struct ib_wc where completions
 *   will be returned
 *
 * Poll a CQ for (possibly multiple) completions.  If the return value
 * is < 0, an error occurred.  If the return value is >= 0, it is the
 * number of completions returned.  If the return value is
 * non-negative and < num_entries, then the CQ was emptied.
 */
static inline int ib_poll_cq(struct ib_cq *cq, int num_entries,
			     struct ib_wc *wc)
{
	return cq->device->ops.poll_cq(cq, num_entries, wc);
}

/**
 * ib_req_notify_cq - Request completion notification on a CQ.
 * @cq: The CQ to generate an event for.
 * @flags:
 *   Must contain exactly one of %IB_CQ_SOLICITED or %IB_CQ_NEXT_COMP
 *   to request an event on the next solicited event or next work
 *   completion at any type, respectively. %IB_CQ_REPORT_MISSED_EVENTS
 *   may also be |ed in to request a hint about missed events, as
 *   described below.
 *
 * Return Value:
 *    < 0 means an error occurred while requesting notification
 *   == 0 means notification was requested successfully, and if
 *        IB_CQ_REPORT_MISSED_EVENTS was passed in, then no events
 *        were missed and it is safe to wait for another event.  In
 *        this case is it guaranteed that any work completions added
 *        to the CQ since the last CQ poll will trigger a completion
 *        notification event.
 *    > 0 is only returned if IB_CQ_REPORT_MISSED_EVENTS was passed
 *        in.  It means that the consumer must poll the CQ again to
 *        make sure it is empty to avoid missing an event because of a
 *        race between requesting notification and an entry being
 *        added to the CQ.  This return value means it is possible
 *        (but not guaranteed) that a work completion has been added
 *        to the CQ since the last poll without triggering a
 *        completion notification event.
 */
static inline int ib_req_notify_cq(struct ib_cq *cq,
				   enum ib_cq_notify_flags flags)
{
	return cq->device->ops.req_notify_cq(cq, flags);
}

struct ib_cq *ib_cq_pool_get(struct ib_device *dev, unsigned int nr_cqe,
			     int comp_vector_hint,
			     enum ib_poll_context poll_ctx);

void ib_cq_pool_put(struct ib_cq *cq, unsigned int nr_cqe);

/*
 * Drivers that don't need a DMA mapping at the RDMA layer, set dma_device to
 * NULL. This causes the ib_dma* helpers to just stash the kernel virtual
 * address into the dma address.
 */
static inline bool ib_uses_virt_dma(struct ib_device *dev)
{
	return IS_ENABLED(CONFIG_INFINIBAND_VIRT_DMA) && !dev->dma_device;
}

/*
 * Check if a IB device's underlying DMA mapping supports P2PDMA transfers.
 */
static inline bool ib_dma_pci_p2p_dma_supported(struct ib_device *dev)
{
	if (ib_uses_virt_dma(dev))
		return false;

	return dma_pci_p2pdma_supported(dev->dma_device);
}

/**
 * ib_virt_dma_to_ptr - Convert a dma_addr to a kernel pointer
 * @dma_addr: The DMA address
 *
 * Used by ib_uses_virt_dma() devices to get back to the kernel pointer after
 * going through the dma_addr marshalling.
 */
static inline void *ib_virt_dma_to_ptr(u64 dma_addr)
{
	/* virt_dma mode maps the kvs's directly into the dma addr */
	return (void *)(uintptr_t)dma_addr;
}

/**
 * ib_virt_dma_to_page - Convert a dma_addr to a struct page
 * @dma_addr: The DMA address
 *
 * Used by ib_uses_virt_dma() device to get back to the struct page after going
 * through the dma_addr marshalling.
 */
static inline struct page *ib_virt_dma_to_page(u64 dma_addr)
{
	return virt_to_page(ib_virt_dma_to_ptr(dma_addr));
}

/**
 * ib_dma_mapping_error - check a DMA addr for error
 * @dev: The device for which the dma_addr was created
 * @dma_addr: The DMA address to check
 */
static inline int ib_dma_mapping_error(struct ib_device *dev, u64 dma_addr)
{
	if (ib_uses_virt_dma(dev))
		return 0;
	return dma_mapping_error(dev->dma_device, dma_addr);
}

/**
 * ib_dma_map_single - Map a kernel virtual address to DMA address
 * @dev: The device for which the dma_addr is to be created
 * @cpu_addr: The kernel virtual address
 * @size: The size of the region in bytes
 * @direction: The direction of the DMA
 */
static inline u64 ib_dma_map_single(struct ib_device *dev,
				    void *cpu_addr, size_t size,
				    enum dma_data_direction direction)
{
	if (ib_uses_virt_dma(dev))
		return (uintptr_t)cpu_addr;
	return dma_map_single(dev->dma_device, cpu_addr, size, direction);
}

/**
 * ib_dma_unmap_single - Destroy a mapping created by ib_dma_map_single()
 * @dev: The device for which the DMA address was created
 * @addr: The DMA address
 * @size: The size of the region in bytes
 * @direction: The direction of the DMA
 */
static inline void ib_dma_unmap_single(struct ib_device *dev,
				       u64 addr, size_t size,
				       enum dma_data_direction direction)
{
	if (!ib_uses_virt_dma(dev))
		dma_unmap_single(dev->dma_device, addr, size, direction);
}

/**
 * ib_dma_map_page - Map a physical page to DMA address
 * @dev: The device for which the dma_addr is to be created
 * @page: The page to be mapped
 * @offset: The offset within the page
 * @size: The size of the region in bytes
 * @direction: The direction of the DMA
 */
static inline u64 ib_dma_map_page(struct ib_device *dev,
				  struct page *page,
				  unsigned long offset,
				  size_t size,
					 enum dma_data_direction direction)
{
	if (ib_uses_virt_dma(dev))
		return (uintptr_t)(page_address(page) + offset);
	return dma_map_page(dev->dma_device, page, offset, size, direction);
}

/**
 * ib_dma_unmap_page - Destroy a mapping created by ib_dma_map_page()
 * @dev: The device for which the DMA address was created
 * @addr: The DMA address
 * @size: The size of the region in bytes
 * @direction: The direction of the DMA
 */
static inline void ib_dma_unmap_page(struct ib_device *dev,
				     u64 addr, size_t size,
				     enum dma_data_direction direction)
{
	if (!ib_uses_virt_dma(dev))
		dma_unmap_page(dev->dma_device, addr, size, direction);
}

int ib_dma_virt_map_sg(struct ib_device *dev, struct scatterlist *sg, int nents);
static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
				      struct scatterlist *sg, int nents,
				      enum dma_data_direction direction,
				      unsigned long dma_attrs)
{
	if (ib_uses_virt_dma(dev))
		return ib_dma_virt_map_sg(dev, sg, nents);
	return dma_map_sg_attrs(dev->dma_device, sg, nents, direction,
				dma_attrs);
}

static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
					 struct scatterlist *sg, int nents,
					 enum dma_data_direction direction,
					 unsigned long dma_attrs)
{
	if (!ib_uses_virt_dma(dev))
		dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction,
				   dma_attrs);
}

/**
 * ib_dma_map_sgtable_attrs - Map a scatter/gather table to DMA addresses
 * @dev: The device for which the DMA addresses are to be created
 * @sgt: The sg_table object describing the buffer
 * @direction: The direction of the DMA
 * @dma_attrs: Optional DMA attributes for the map operation
 */
static inline int ib_dma_map_sgtable_attrs(struct ib_device *dev,
					   struct sg_table *sgt,
					   enum dma_data_direction direction,
					   unsigned long dma_attrs)
{
	int nents;

	if (ib_uses_virt_dma(dev)) {
		nents = ib_dma_virt_map_sg(dev, sgt->sgl, sgt->orig_nents);
		if (!nents)
			return -EIO;
		sgt->nents = nents;
		return 0;
	}
	return dma_map_sgtable(dev->dma_device, sgt, direction, dma_attrs);
}

static inline void ib_dma_unmap_sgtable_attrs(struct ib_device *dev,
					      struct sg_table *sgt,
					      enum dma_data_direction direction,
					      unsigned long dma_attrs)
{
	if (!ib_uses_virt_dma(dev))
		dma_unmap_sgtable(dev->dma_device, sgt, direction, dma_attrs);
}

/**
 * ib_dma_map_sg - Map a scatter/gather list to DMA addresses
 * @dev: The device for which the DMA addresses are to be created
 * @sg: The array of scatter/gather entries
 * @nents: The number of scatter/gather entries
 * @direction: The direction of the DMA
 */
static inline int ib_dma_map_sg(struct ib_device *dev,
				struct scatterlist *sg, int nents,
				enum dma_data_direction direction)
{
	return ib_dma_map_sg_attrs(dev, sg, nents, direction, 0);
}

/**
 * ib_dma_unmap_sg - Unmap a scatter/gather list of DMA addresses
 * @dev: The device for which the DMA addresses were created
 * @sg: The array of scatter/gather entries
 * @nents: The number of scatter/gather entries
 * @direction: The direction of the DMA
 */
static inline void ib_dma_unmap_sg(struct ib_device *dev,
				   struct scatterlist *sg, int nents,
				   enum dma_data_direction direction)
{
	ib_dma_unmap_sg_attrs(dev, sg, nents, direction, 0);
}

/**
 * ib_dma_max_seg_size - Return the size limit of a single DMA transfer
 * @dev: The device to query
 *
 * The returned value represents a size in bytes.
 */
static inline unsigned int ib_dma_max_seg_size(struct ib_device *dev)
{
	if (ib_uses_virt_dma(dev))
		return UINT_MAX;
	return dma_get_max_seg_size(dev->dma_device);
}

/**
 * ib_dma_sync_single_for_cpu - Prepare DMA region to be accessed by CPU
 * @dev: The device for which the DMA address was created
 * @addr: The DMA address
 * @size: The size of the region in bytes
 * @dir: The direction of the DMA
 */
static inline void ib_dma_sync_single_for_cpu(struct ib_device *dev,
					      u64 addr,
					      size_t size,
					      enum dma_data_direction dir)
{
	if (!ib_uses_virt_dma(dev))
		dma_sync_single_for_cpu(dev->dma_device, addr, size, dir);
}

/**
 * ib_dma_sync_single_for_device - Prepare DMA region to be accessed by device
 * @dev: The device for which the DMA address was created
 * @addr: The DMA address
 * @size: The size of the region in bytes
 * @dir: The direction of the DMA
 */
static inline void ib_dma_sync_single_for_device(struct ib_device *dev,
						 u64 addr,
						 size_t size,
						 enum dma_data_direction dir)
{
	if (!ib_uses_virt_dma(dev))
		dma_sync_single_for_device(dev->dma_device, addr, size, dir);
}

/* ib_reg_user_mr - register a memory region for virtual addresses from kernel
 * space. This function should be called when 'current' is the owning MM.
 */
struct ib_mr *ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
			     u64 virt_addr, int mr_access_flags);

/* ib_advise_mr -  give an advice about an address range in a memory region */
int ib_advise_mr(struct ib_pd *pd, enum ib_uverbs_advise_mr_advice advice,
		 u32 flags, struct ib_sge *sg_list, u32 num_sge);
/**
 * ib_dereg_mr_user - Deregisters a memory region and removes it from the
 *   HCA translation table.
 * @mr: The memory region to deregister.
 * @udata: Valid user data or NULL for kernel object
 *
 * This function can fail, if the memory region has memory windows bound to it.
 */
int ib_dereg_mr_user(struct ib_mr *mr, struct ib_udata *udata);

/**
 * ib_dereg_mr - Deregisters a kernel memory region and removes it from the
 *   HCA translation table.
 * @mr: The memory region to deregister.
 *
 * This function can fail, if the memory region has memory windows bound to it.
 *
 * NOTE: for user mr use ib_dereg_mr_user with valid udata!
 */
static inline int ib_dereg_mr(struct ib_mr *mr)
{
	return ib_dereg_mr_user(mr, NULL);
}

struct ib_mr *ib_alloc_mr(struct ib_pd *pd, enum ib_mr_type mr_type,
			  u32 max_num_sg);

struct ib_mr *ib_alloc_mr_integrity(struct ib_pd *pd,
				    u32 max_num_data_sg,
				    u32 max_num_meta_sg);

/**
 * ib_update_fast_reg_key - updates the key portion of the fast_reg MR
 *   R_Key and L_Key.
 * @mr: struct ib_mr pointer to be updated.
 * @newkey: new key to be used.
 */
static inline void ib_update_fast_reg_key(struct ib_mr *mr, u8 newkey)
{
	mr->lkey = (mr->lkey & 0xffffff00) | newkey;
	mr->rkey = (mr->rkey & 0xffffff00) | newkey;
}

/**
 * ib_inc_rkey - increments the key portion of the given rkey. Can be used
 * for calculating a new rkey for type 2 memory windows.
 * @rkey: the rkey to increment.
 */
static inline u32 ib_inc_rkey(u32 rkey)
{
	const u32 mask = 0x000000ff;
	return ((rkey + 1) & mask) | (rkey & ~mask);
}

/**
 * ib_attach_mcast - Attaches the specified QP to a multicast group.
 * @qp: QP to attach to the multicast group.  The QP must be type
 *   IB_QPT_UD.
 * @gid: Multicast group GID.
 * @lid: Multicast group LID in host byte order.
 *
 * In order to send and receive multicast packets, subnet
 * administration must have created the multicast group and configured
 * the fabric appropriately.  The port associated with the specified
 * QP must also be a member of the multicast group.
 */
int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid);

/**
 * ib_detach_mcast - Detaches the specified QP from a multicast group.
 * @qp: QP to detach from the multicast group.
 * @gid: Multicast group GID.
 * @lid: Multicast group LID in host byte order.
 */
int ib_detach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid);

struct ib_xrcd *ib_alloc_xrcd_user(struct ib_device *device,
				   struct inode *inode, struct ib_udata *udata);
int ib_dealloc_xrcd_user(struct ib_xrcd *xrcd, struct ib_udata *udata);

static inline int ib_check_mr_access(struct ib_device *ib_dev,
				     unsigned int flags)
{
	u64 device_cap = ib_dev->attrs.device_cap_flags;

	/*
	 * Local write permission is required if remote write or
	 * remote atomic permission is also requested.
	 */
	if (flags & (IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_REMOTE_WRITE) &&
	    !(flags & IB_ACCESS_LOCAL_WRITE))
		return -EINVAL;

	if (flags & ~IB_ACCESS_SUPPORTED)
		return -EINVAL;

	if (flags & IB_ACCESS_ON_DEMAND &&
	    !(ib_dev->attrs.kernel_cap_flags & IBK_ON_DEMAND_PAGING))
		return -EOPNOTSUPP;

	if ((flags & IB_ACCESS_FLUSH_GLOBAL &&
	    !(device_cap & IB_DEVICE_FLUSH_GLOBAL)) ||
	    (flags & IB_ACCESS_FLUSH_PERSISTENT &&
	    !(device_cap & IB_DEVICE_FLUSH_PERSISTENT)))
		return -EOPNOTSUPP;

	return 0;
}

static inline bool ib_access_writable(int access_flags)
{
	/*
	 * We have writable memory backing the MR if any of the following
	 * access flags are set.  "Local write" and "remote write" obviously
	 * require write access.  "Remote atomic" can do things like fetch and
	 * add, which will modify memory, and "MW bind" can change permissions
	 * by binding a window.
	 */
	return access_flags &
		(IB_ACCESS_LOCAL_WRITE   | IB_ACCESS_REMOTE_WRITE |
		 IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND);
}

/**
 * ib_check_mr_status: lightweight check of MR status.
 *     This routine may provide status checks on a selected
 *     ib_mr. first use is for signature status check.
 *
 * @mr: A memory region.
 * @check_mask: Bitmask of which checks to perform from
 *     ib_mr_status_check enumeration.
 * @mr_status: The container of relevant status checks.
 *     failed checks will be indicated in the status bitmask
 *     and the relevant info shall be in the error item.
 */
int ib_check_mr_status(struct ib_mr *mr, u32 check_mask,
		       struct ib_mr_status *mr_status);

/**
 * ib_device_try_get: Hold a registration lock
 * @dev: The device to lock
 *
 * A device under an active registration lock cannot become unregistered. It
 * is only possible to obtain a registration lock on a device that is fully
 * registered, otherwise this function returns false.
 *
 * The registration lock is only necessary for actions which require the
 * device to still be registered. Uses that only require the device pointer to
 * be valid should use get_device(&ibdev->dev) to hold the memory.
 *
 */
static inline bool ib_device_try_get(struct ib_device *dev)
{
	return refcount_inc_not_zero(&dev->refcount);
}

void ib_device_put(struct ib_device *device);
struct ib_device *ib_device_get_by_netdev(struct net_device *ndev,
					  enum rdma_driver_id driver_id);
struct ib_device *ib_device_get_by_name(const char *name,
					enum rdma_driver_id driver_id);
struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u32 port,
					    u16 pkey, const union ib_gid *gid,
					    const struct sockaddr *addr);
int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,
			 unsigned int port);
struct net_device *ib_device_get_netdev(struct ib_device *ib_dev,
					u32 port);
int ib_query_netdev_port(struct ib_device *ibdev, struct net_device *ndev,
			 u32 *port);

static inline enum ib_port_state ib_get_curr_port_state(struct net_device *net_dev)
{
	return (netif_running(net_dev) && netif_carrier_ok(net_dev)) ?
		IB_PORT_ACTIVE : IB_PORT_DOWN;
}

void ib_dispatch_port_state_event(struct ib_device *ibdev,
				  struct net_device *ndev);
struct ib_wq *ib_create_wq(struct ib_pd *pd,
			   struct ib_wq_init_attr *init_attr);
int ib_destroy_wq_user(struct ib_wq *wq, struct ib_udata *udata);

int ib_map_mr_sg(struct ib_mr *mr, struct scatterlist *sg, int sg_nents,
		 unsigned int *sg_offset, unsigned int page_size);
int ib_map_mr_sg_pi(struct ib_mr *mr, struct scatterlist *data_sg,
		    int data_sg_nents, unsigned int *data_sg_offset,
		    struct scatterlist *meta_sg, int meta_sg_nents,
		    unsigned int *meta_sg_offset, unsigned int page_size);

static inline int
ib_map_mr_sg_zbva(struct ib_mr *mr, struct scatterlist *sg, int sg_nents,
		  unsigned int *sg_offset, unsigned int page_size)
{
	int n;

	n = ib_map_mr_sg(mr, sg, sg_nents, sg_offset, page_size);
	mr->iova = 0;

	return n;
}

int ib_sg_to_pages(struct ib_mr *mr, struct scatterlist *sgl, int sg_nents,
		unsigned int *sg_offset, int (*set_page)(struct ib_mr *, u64));

void ib_drain_rq(struct ib_qp *qp);
void ib_drain_sq(struct ib_qp *qp);
void ib_drain_qp(struct ib_qp *qp);

int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed,
		     u8 *width);

static inline u8 *rdma_ah_retrieve_dmac(struct rdma_ah_attr *attr)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_ROCE)
		return attr->roce.dmac;
	return NULL;
}

static inline void rdma_ah_set_dlid(struct rdma_ah_attr *attr, u32 dlid)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_IB)
		attr->ib.dlid = (u16)dlid;
	else if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		attr->opa.dlid = dlid;
}

static inline u32 rdma_ah_get_dlid(const struct rdma_ah_attr *attr)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_IB)
		return attr->ib.dlid;
	else if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		return attr->opa.dlid;
	return 0;
}

static inline void rdma_ah_set_sl(struct rdma_ah_attr *attr, u8 sl)
{
	attr->sl = sl;
}

static inline u8 rdma_ah_get_sl(const struct rdma_ah_attr *attr)
{
	return attr->sl;
}

static inline void rdma_ah_set_path_bits(struct rdma_ah_attr *attr,
					 u8 src_path_bits)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_IB)
		attr->ib.src_path_bits = src_path_bits;
	else if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		attr->opa.src_path_bits = src_path_bits;
}

static inline u8 rdma_ah_get_path_bits(const struct rdma_ah_attr *attr)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_IB)
		return attr->ib.src_path_bits;
	else if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		return attr->opa.src_path_bits;
	return 0;
}

static inline void rdma_ah_set_make_grd(struct rdma_ah_attr *attr,
					bool make_grd)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		attr->opa.make_grd = make_grd;
}

static inline bool rdma_ah_get_make_grd(const struct rdma_ah_attr *attr)
{
	if (attr->type == RDMA_AH_ATTR_TYPE_OPA)
		return attr->opa.make_grd;
	return false;
}

static inline void rdma_ah_set_port_num(struct rdma_ah_attr *attr, u32 port_num)
{
	attr->port_num = port_num;
}

static inline u32 rdma_ah_get_port_num(const struct rdma_ah_attr *attr)
{
	return attr->port_num;
}

static inline void rdma_ah_set_static_rate(struct rdma_ah_attr *attr,
					   u8 static_rate)
{
	attr->static_rate = static_rate;
}

static inline u8 rdma_ah_get_static_rate(const struct rdma_ah_attr *attr)
{
	return attr->static_rate;
}

static inline void rdma_ah_set_ah_flags(struct rdma_ah_attr *attr,
					enum ib_ah_flags flag)
{
	attr->ah_flags = flag;
}

static inline enum ib_ah_flags
		rdma_ah_get_ah_flags(const struct rdma_ah_attr *attr)
{
	return attr->ah_flags;
}

static inline const struct ib_global_route
		*rdma_ah_read_grh(const struct rdma_ah_attr *attr)
{
	return &attr->grh;
}

/*To retrieve and modify the grh */
static inline struct ib_global_route
		*rdma_ah_retrieve_grh(struct rdma_ah_attr *attr)
{
	return &attr->grh;
}

static inline void rdma_ah_set_dgid_raw(struct rdma_ah_attr *attr, void *dgid)
{
	struct ib_global_route *grh = rdma_ah_retrieve_grh(attr);

	memcpy(grh->dgid.raw, dgid, sizeof(grh->dgid));
}

static inline void rdma_ah_set_subnet_prefix(struct rdma_ah_attr *attr,
					     __be64 prefix)
{
	struct ib_global_route *grh = rdma_ah_retrieve_grh(attr);

	grh->dgid.global.subnet_prefix = prefix;
}

static inline void rdma_ah_set_interface_id(struct rdma_ah_attr *attr,
					    __be64 if_id)
{
	struct ib_global_route *grh = rdma_ah_retrieve_grh(attr);

	grh->dgid.global.interface_id = if_id;
}

static inline void rdma_ah_set_grh(struct rdma_ah_attr *attr,
				   union ib_gid *dgid, u32 flow_label,
				   u8 sgid_index, u8 hop_limit,
				   u8 traffic_class)
{
	struct ib_global_route *grh = rdma_ah_retrieve_grh(attr);

	attr->ah_flags = IB_AH_GRH;
	if (dgid)
		grh->dgid = *dgid;
	grh->flow_label = flow_label;
	grh->sgid_index = sgid_index;
	grh->hop_limit = hop_limit;
	grh->traffic_class = traffic_class;
	grh->sgid_attr = NULL;
}

void rdma_destroy_ah_attr(struct rdma_ah_attr *ah_attr);
void rdma_move_grh_sgid_attr(struct rdma_ah_attr *attr, union ib_gid *dgid,
			     u32 flow_label, u8 hop_limit, u8 traffic_class,
			     const struct ib_gid_attr *sgid_attr);
void rdma_copy_ah_attr(struct rdma_ah_attr *dest,
		       const struct rdma_ah_attr *src);
void rdma_replace_ah_attr(struct rdma_ah_attr *old,
			  const struct rdma_ah_attr *new);
void rdma_move_ah_attr(struct rdma_ah_attr *dest, struct rdma_ah_attr *src);

/**
 * rdma_ah_find_type - Return address handle type.
 *
 * @dev: Device to be checked
 * @port_num: Port number
 */
static inline enum rdma_ah_attr_type rdma_ah_find_type(struct ib_device *dev,
						       u32 port_num)
{
	if (rdma_protocol_roce(dev, port_num))
		return RDMA_AH_ATTR_TYPE_ROCE;
	if (rdma_protocol_ib(dev, port_num)) {
		if (rdma_cap_opa_ah(dev, port_num))
			return RDMA_AH_ATTR_TYPE_OPA;
		return RDMA_AH_ATTR_TYPE_IB;
	}
	if (dev->type == RDMA_DEVICE_TYPE_SMI)
		return RDMA_AH_ATTR_TYPE_IB;

	return RDMA_AH_ATTR_TYPE_UNDEFINED;
}

/**
 * ib_lid_cpu16 - Return lid in 16bit CPU encoding.
 *     In the current implementation the only way to
 *     get the 32bit lid is from other sources for OPA.
 *     For IB, lids will always be 16bits so cast the
 *     value accordingly.
 *
 * @lid: A 32bit LID
 */
static inline u16 ib_lid_cpu16(u32 lid)
{
	WARN_ON_ONCE(lid & 0xFFFF0000);
	return (u16)lid;
}

/**
 * ib_lid_be16 - Return lid in 16bit BE encoding.
 *
 * @lid: A 32bit LID
 */
static inline __be16 ib_lid_be16(u32 lid)
{
	WARN_ON_ONCE(lid & 0xFFFF0000);
	return cpu_to_be16((u16)lid);
}

/**
 * ib_get_vector_affinity - Get the affinity mappings of a given completion
 *   vector
 * @device:         the rdma device
 * @comp_vector:    index of completion vector
 *
 * Returns NULL on failure, otherwise a corresponding cpu map of the
 * completion vector (returns all-cpus map if the device driver doesn't
 * implement get_vector_affinity).
 */
static inline const struct cpumask *
ib_get_vector_affinity(struct ib_device *device, int comp_vector)
{
	if (comp_vector < 0 || comp_vector >= device->num_comp_vectors ||
	    !device->ops.get_vector_affinity)
		return NULL;

	return device->ops.get_vector_affinity(device, comp_vector);

}

/**
 * rdma_roce_rescan_device - Rescan all of the network devices in the system
 * and add their gids, as needed, to the relevant RoCE devices.
 *
 * @ibdev:         the rdma device
 */
void rdma_roce_rescan_device(struct ib_device *ibdev);
void rdma_roce_rescan_port(struct ib_device *ib_dev, u32 port);
void roce_del_all_netdev_gids(struct ib_device *ib_dev,
			      u32 port, struct net_device *ndev);

struct ib_ucontext *ib_uverbs_get_ucontext_file(struct ib_uverbs_file *ufile);

#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS)
int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs);
bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs);
#else
static inline int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs)
{
	return 0;
}
static inline bool
rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs)
{
	return false;
}
#endif

struct net_device *rdma_alloc_netdev(struct ib_device *device, u32 port_num,
				     enum rdma_netdev_t type, const char *name,
				     unsigned char name_assign_type,
				     void (*setup)(struct net_device *));

int rdma_init_netdev(struct ib_device *device, u32 port_num,
		     enum rdma_netdev_t type, const char *name,
		     unsigned char name_assign_type,
		     void (*setup)(struct net_device *),
		     struct net_device *netdev);

/**
 * rdma_device_to_ibdev - Get ib_device pointer from device pointer
 *
 * @device:	device pointer for which ib_device pointer to retrieve
 *
 * rdma_device_to_ibdev() retrieves ib_device pointer from device.
 *
 */
static inline struct ib_device *rdma_device_to_ibdev(struct device *device)
{
	struct ib_core_device *coredev =
		container_of(device, struct ib_core_device, dev);

	return coredev->owner;
}

/**
 * ibdev_to_node - return the NUMA node for a given ib_device
 * @ibdev:	device to get the NUMA node for.
 */
static inline int ibdev_to_node(struct ib_device *ibdev)
{
	struct device *parent = ibdev->dev.parent;

	if (!parent)
		return NUMA_NO_NODE;
	return dev_to_node(parent);
}

/**
 * rdma_device_to_drv_device - Helper macro to reach back to driver's
 *			       ib_device holder structure from device pointer.
 *
 * NOTE: New drivers should not make use of this API; This API is only for
 * existing drivers who have exposed sysfs entries using
 * ops->device_group.
 */
#define rdma_device_to_drv_device(dev, drv_dev_struct, ibdev_member)           \
	container_of(rdma_device_to_ibdev(dev), drv_dev_struct, ibdev_member)

bool rdma_dev_access_netns(const struct ib_device *device,
			   const struct net *net);

bool rdma_dev_has_raw_cap(const struct ib_device *dev);
static inline struct net *rdma_dev_net(struct ib_device *device)
{
	return read_pnet(&device->coredev.rdma_net);
}

#define IB_ROCE_UDP_ENCAP_VALID_PORT_MIN (0xC000)
#define IB_ROCE_UDP_ENCAP_VALID_PORT_MAX (0xFFFF)
#define IB_GRH_FLOWLABEL_MASK (0x000FFFFF)

/**
 * rdma_flow_label_to_udp_sport - generate a RoCE v2 UDP src port value based
 *                               on the flow_label
 * @fl: flow_label value
 *
 * This function will convert the 20 bit flow_label input to a valid RoCE v2
 * UDP src port 14 bit value. All RoCE V2 drivers should use this same
 * convention.
 */
static inline u16 rdma_flow_label_to_udp_sport(u32 fl)
{
	u32 fl_low = fl & 0x03fff, fl_high = fl & 0xFC000;

	fl_low ^= fl_high >> 14;
	return (u16)(fl_low | IB_ROCE_UDP_ENCAP_VALID_PORT_MIN);
}

/**
 * rdma_calc_flow_label - generate a RDMA symmetric flow label value based on
 *                        local and remote qpn values
 *
 * This function folded the multiplication results of two qpns, 24 bit each,
 * fields, and converts it to a 20 bit results.
 *
 * This function will create symmetric flow_label value based on the local
 * and remote qpn values. this will allow both the requester and responder
 * to calculate the same flow_label for a given connection.
 *
 * This helper function should be used by driver in case the upper layer
 * provide a zero flow_label value. This is to improve entropy of RDMA
 * traffic in the network.
 */
static inline u32 rdma_calc_flow_label(u32 lqpn, u32 rqpn)
{
	u64 v = (u64)lqpn * rqpn;

	v ^= v >> 20;
	v ^= v >> 40;

	return (u32)(v & IB_GRH_FLOWLABEL_MASK);
}

/**
 * rdma_get_udp_sport - Calculate and set UDP source port based on the flow
 *                      label. If flow label is not defined in GRH then
 *                      calculate it based on lqpn/rqpn.
 *
 * @fl:                 flow label from GRH
 * @lqpn:               local qp number
 * @rqpn:               remote qp number
 */
static inline u16 rdma_get_udp_sport(u32 fl, u32 lqpn, u32 rqpn)
{
	if (!fl)
		fl = rdma_calc_flow_label(lqpn, rqpn);

	return rdma_flow_label_to_udp_sport(fl);
}

const struct ib_port_immutable*
ib_port_immutable_read(struct ib_device *dev, unsigned int port);

/** ib_add_sub_device - Add a sub IB device on an existing one
 *
 * @parent: The IB device that needs to add a sub device
 * @type: The type of the new sub device
 * @name: The name of the new sub device
 *
 *
 * Return 0 on success, an error code otherwise
 */
int ib_add_sub_device(struct ib_device *parent,
		      enum rdma_nl_dev_type type,
		      const char *name);


/** ib_del_sub_device_and_put - Delect an IB sub device while holding a 'get'
 *
 * @sub: The sub device that is going to be deleted
 *
 * Return 0 on success, an error code otherwise
 */
int ib_del_sub_device_and_put(struct ib_device *sub);

static inline void ib_mark_name_assigned_by_user(struct ib_device *ibdev)
{
	ibdev->name_assign_type = RDMA_NAME_ASSIGN_TYPE_USER;
}

#endif /* IB_VERBS_H */
]

gemini-3.1-pro-preview

							input: 115073
							output: 48
							thoughts: 303
						

**RDMA and MAD Subtleties**

Okay, hold on a second. I just realized something about this `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP` define. It looks like it includes `RDMA_CORE_CAP_IB_MAD`. Let me just double-check that quick... Yup, there it is, clear as day.

```c
#define RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP			\
					(RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP \
					| RDMA_CORE_CAP_IB_MAD  \
					| RDMA_CORE_CAP_IB_CM   \
					| RDMA_CORE_CAP_AF_IB   \
					| RDMA_CORE_CAP_ETH_AH)
```

Alright, so that means `rxe` devices, by virtue of using RoCE over UDP encapsulation, *do* indeed have `RDMA_CORE_CAP_IB_MAD`. That has some implications. If they have `IB_MAD` capabilities, then `ib_mad_init_device` should call `ib_mad_port_open` for these `rxe` devices. And if that's the case, then that function is allocating a protection domain. Let me just confirm that quickly in the code...
Let's see:
```c
	port_priv->pd = ib_alloc_pd(device, 0);
```
Yep, there it is! `ib_mad_port_open` does allocate a PD! Now, I need to consider what happens when a device is unregistered.  I'm pretty sure `ib_mad_remove_device` is called, but let's just make sure.

map[ContextFile:drivers/infiniband/core/mad.c IncludeLines:true Name:ib_mad_remove_device]

map[SourceCode:3375:	static void ib_mad_remove_device(struct ib_device *device, void *client_data)
3376:	{
3377:		unsigned int i;
3378:	
3379:		rdma_for_each_port (device, i) {
3380:			if (!rdma_cap_ib_mad(device, i))
3381:				continue;
3382:	
3383:			if (ib_agent_port_close(device, i))
3384:				dev_err(&device->dev,
3385:					"Couldn't close port %u for agents\n", i);
3386:			if (ib_mad_port_close(device, i))
3387:				dev_err(&device->dev, "Couldn't close port %u\n", i);
3388:		}
3389:	}
 SourceFile:drivers/infiniband/core/mad.c]

gemini-3.1-pro-preview

							input: 116087
							output: 48
							thoughts: 15
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and presented as if it were my own internal monologue:

**Ensuring Resource Cleanup in InfiniBand**

Alright, so I'm thinking about the proper way to handle closing an InfiniBand port connection. Specifically, I'm focusing on the interaction between `ib_mad_port_close` and resource deallocation. I need to make sure everything's tidied up correctly to prevent leaks or conflicts. My primary concern is the Protection Domain (PD) associated with that closed port.

The critical point here is this: the function `ib_mad_port_close` *should* also handle freeing the Protection Domain that was in use. It's a fundamental aspect of resource management; if I'm shutting down the port connection and associated communication channel, the allocated protection domain should be released back to the system. This needs careful verification. If this doesn't happen it would lead to a serious memory leak. I need to review the code to confirm the behavior and ensure the design aligns with the goal of full resource reclamation.

map[ContextFile:drivers/infiniband/core/mad.c IncludeLines:true Name:ib_mad_port_close]

map[SourceCode:3293:	/*
3294:	 * Close the port
3295:	 * If there are no classes using the port, free the port
3296:	 * resources (CQ, MR, PD, QP) and remove the port's info structure
3297:	 */
3298:	static int ib_mad_port_close(struct ib_device *device, u32 port_num)
3299:	{
3300:		struct ib_mad_port_private *port_priv;
3301:		unsigned long flags;
3302:	
3303:		spin_lock_irqsave(&ib_mad_port_list_lock, flags);
3304:		port_priv = __ib_get_mad_port(device, port_num);
3305:		if (port_priv == NULL) {
3306:			spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3307:			dev_err(&device->dev, "Port %u not found\n", port_num);
3308:			return -ENODEV;
3309:		}
3310:		list_del_init(&port_priv->port_list);
3311:		spin_unlock_irqrestore(&ib_mad_port_list_lock, flags);
3312:	
3313:		destroy_workqueue(port_priv->wq);
3314:		destroy_mad_qp(&port_priv->qp_info[1]);
3315:		destroy_mad_qp(&port_priv->qp_info[0]);
3316:		ib_free_cq(port_priv->cq);
3317:		ib_dealloc_pd(port_priv->pd);
3318:		cleanup_recv_queue(&port_priv->qp_info[1]);
3319:		cleanup_recv_queue(&port_priv->qp_info[0]);
3320:		/* XXX: Handle deallocation of MAD registration tables */
3321:	
3322:		kfree(port_priv);
3323:	
3324:		return 0;
3325:	}
 SourceFile:drivers/infiniband/core/mad.c]

gemini-3.1-pro-preview

							input: 116982
							output: 47
							thoughts: 214
						

**Debugging a Potential Resource Leak**

Okay, so I'm digging into this code and something's not quite right. It looks like `ib_mad_port_close` is going to deallocate the protection domain (`pd`) with `ib_dealloc_pd(port_priv->pd)`. That makes sense. But then I'm seeing that the `pd_pool` isn't empty when `rxe_dealloc` is called. That's a red flag. Something is holding onto a reference.

Right, so `rxe_dealloc` gets called from `ib_dealloc_device`. Now I need to figure out *when* `ib_dealloc_device` is actually invoked. Let's see... tracing back, it's called from `__ib_unregister_device` which goes through `ib_unregister_device_and_put` and finally to `nldev_dellink`. Got it.

Okay, `ib_unregister_device_and_put` then calls `ib_device_put(device)`. That function is crucial. When the reference count on the device drops to zero, `ib_dealloc_device` will be called. That's the expected path for deallocation.

Hold on, though. `ib_unregister_device_and_put` *unregisters* the device. Does it have some mechanism to ensure that all clients are detached before triggering the deallocation? I need to know this for sure. I need to dive into `__ib_unregister_device` to verify that all the pieces are cleaned up. This feels like the key to solving the issue.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:__ib_unregister_device]

map[SourceCode:1529:	/* Callers must hold a get on the device. */
1530:	static void __ib_unregister_device(struct ib_device *ib_dev)
1531:	{
1532:		struct ib_device *sub, *tmp;
1533:	
1534:		mutex_lock(&ib_dev->subdev_lock);
1535:		list_for_each_entry_safe_reverse(sub, tmp,
1536:						 &ib_dev->subdev_list_head,
1537:						 subdev_list) {
1538:			list_del(&sub->subdev_list);
1539:			ib_dev->ops.del_sub_dev(sub);
1540:			ib_device_put(ib_dev);
1541:		}
1542:		mutex_unlock(&ib_dev->subdev_lock);
1543:	
1544:		/*
1545:		 * We have a registration lock so that all the calls to unregister are
1546:		 * fully fenced, once any unregister returns the device is truly
1547:		 * unregistered even if multiple callers are unregistering it at the
1548:		 * same time. This also interacts with the registration flow and
1549:		 * provides sane semantics if register and unregister are racing.
1550:		 */
1551:		mutex_lock(&ib_dev->unregistration_lock);
1552:		if (!refcount_read(&ib_dev->refcount))
1553:			goto out;
1554:	
1555:		disable_device(ib_dev);
1556:		rdma_nl_notify_event(ib_dev, 0, RDMA_UNREGISTER_EVENT);
1557:	
1558:		/* Expedite removing unregistered pointers from the hash table */
1559:		free_netdevs(ib_dev);
1560:	
1561:		ib_free_port_attrs(&ib_dev->coredev);
1562:		device_del(&ib_dev->dev);
1563:		ib_device_unregister_rdmacg(ib_dev);
1564:		ib_cache_cleanup_one(ib_dev);
1565:	
1566:		/*
1567:		 * Drivers using the new flow may not call ib_dealloc_device except
1568:		 * in error unwind prior to registration success.
1569:		 */
1570:		if (ib_dev->ops.dealloc_driver &&
1571:		    ib_dev->ops.dealloc_driver != prevent_dealloc_device) {
1572:			WARN_ON(kref_read(&ib_dev->dev.kobj.kref) <= 1);
1573:			ib_dealloc_device(ib_dev);
1574:		}
1575:	out:
1576:		mutex_unlock(&ib_dev->unregistration_lock);
1577:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 118423
							output: 44
							thoughts: 31
						

Here's my thought process, summarized as if I were considering the code:

**Analyzing `__ib_unregister_device` and `disable_device`**

Okay, so `__ib_unregister_device` is calling `disable_device(ib_dev)`. That's interesting, and important to keep in mind. The primary action of unregistering this device includes the implicit action of disabling it. Now, given that connection, my immediate next step is to drill down into the definition and functionality of `disable_device`. I need to understand precisely what it does in this context. What resources are being freed? What state changes are taking place? Are there any potential race conditions I should be looking out for, given that it's being called during unregistration?

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:disable_device]

map[SourceCode:1297:	static void disable_device(struct ib_device *device)
1298:	{
1299:		u32 cid;
1300:	
1301:		WARN_ON(!refcount_read(&device->refcount));
1302:	
1303:		down_write(&devices_rwsem);
1304:		xa_clear_mark(&devices, device->index, DEVICE_REGISTERED);
1305:		up_write(&devices_rwsem);
1306:	
1307:		/*
1308:		 * Remove clients in LIFO order, see assign_client_id. This could be
1309:		 * more efficient if xarray learns to reverse iterate. Since no new
1310:		 * clients can be added to this ib_device past this point we only need
1311:		 * the maximum possible client_id value here.
1312:		 */
1313:		down_read(&clients_rwsem);
1314:		cid = highest_client_id;
1315:		up_read(&clients_rwsem);
1316:		while (cid) {
1317:			cid--;
1318:			remove_client_context(device, cid);
1319:		}
1320:	
1321:		ib_cq_pool_cleanup(device);
1322:	
1323:		/* Pairs with refcount_set in enable_device */
1324:		ib_device_put(device);
1325:		wait_for_completion(&device->unreg_completion);
1326:	
1327:		/*
1328:		 * compat devices must be removed after device refcount drops to zero.
1329:		 * Otherwise init_net() may add more compatdevs after removing compat
1330:		 * devices and before device is disabled.
1331:		 */
1332:		remove_compat_devs(device);
1333:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 119218
							output: 46
							thoughts: 65
						

Okay, let me think this through.

**Analyzing the Device Disablement Procedure**

Alright, so `disable_device` is the function we're concerned with here. First, it seems to call `remove_client_context` for *every* client currently using the device. That makes sense, clean up all the active connections before doing anything drastic. Then, crucially, it calls `ib_device_put(device)`. I know that function; it's the one responsible for releasing the device resource. And it looks like it subsequently waits for `unreg_completion`. That's where things get interesting. The question now becomes: *when* exactly does `unreg_completion` complete? I need to understand the sequencing and the dependencies here, so that means I need to dig into `ib_device_put`. Let's go check the code for `ib_device_put`.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:ib_device_put]

map[SourceCode: 338:	/**
 339:	 * ib_device_put - Release IB device reference
 340:	 * @device: device whose reference to be released
 341:	 *
 342:	 * ib_device_put() releases reference to the IB device to allow it to be
 343:	 * unregistered and eventually free.
 344:	 */
 345:	void ib_device_put(struct ib_device *device)
 346:	{
 347:		if (refcount_dec_and_test(&device->refcount))
 348:			complete(&device->unreg_completion);
 349:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 119726
							output: 46
							thoughts: 135
						

Here's my thought process, as I delve into this code snippet:

**Debugging a Resource Leak in RDMA Device Deallocation**

Okay, so I'm looking at this `disable_device` function, and the first thing that jumps out is the implication that it's waiting for all references to the device to be gone. Essentially, it's a synchronization point. Then, `__ib_unregister_device` kicks in, and that calls `ib_dealloc_device(ib_dev)`. That seems logical, the deallocation should come *after* the unregistration.

But wait a minute… if `ib_dealloc_device` is being called, doesn't that inherently mean every client, every consumer, every last reference to the `ib_dev` should be gone? That's the expected behavior, right? It implies all the cleanup is done, all the usage is finished, and we're ready to free the underlying resources.

This is where the problem arises. I see that `rxe_dealloc` is called *within* `ib_dealloc_device`. And `rxe_dealloc` is complaining about the `pd_pool` – specifically, that it's not empty. This is a red flag. If all the clients are removed and `ib_dealloc_device` has been triggered, the pool *should* be empty. There's a fundamental disconnect here. Something is keeping those resources alive when they shouldn't be. I need to figure out why the pool isn't empty after we *think* we've removed everything.

So, the next step is clear. I need to trace this back. I need to look at `remove_client_context` because that's what's likely responsible for removing the clients. That's the key. I need to understand what's happening there, and identify which clients are *not* being correctly removed or deallocated. I'm thinking a potential reference counter leak could be the culprit, a race condition, or a logic error in `remove_client_context`. I'll need to dig into the implementation there to understand the control flow, and hopefully, I'll find my leak.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:remove_client_context]

map[SourceCode: 785:	static void remove_client_context(struct ib_device *device,
 786:					  unsigned int client_id)
 787:	{
 788:		struct ib_client *client;
 789:		void *client_data;
 790:	
 791:		down_write(&device->client_data_rwsem);
 792:		if (!xa_get_mark(&device->client_data, client_id,
 793:				 CLIENT_DATA_REGISTERED)) {
 794:			up_write(&device->client_data_rwsem);
 795:			return;
 796:		}
 797:		client_data = xa_load(&device->client_data, client_id);
 798:		xa_clear_mark(&device->client_data, client_id, CLIENT_DATA_REGISTERED);
 799:		client = xa_load(&clients, client_id);
 800:		up_write(&device->client_data_rwsem);
 801:	
 802:		/*
 803:		 * Notice we cannot be holding any exclusive locks when calling the
 804:		 * remove callback as the remove callback can recurse back into any
 805:		 * public functions in this module and thus try for any locks those
 806:		 * functions take.
 807:		 *
 808:		 * For this reason clients and drivers should not call the
 809:		 * unregistration functions will holdling any locks.
 810:		 */
 811:		if (client->remove)
 812:			client->remove(device, client_data);
 813:	
 814:		xa_erase(&device->client_data, client_id);
 815:		ib_device_put(device);
 816:		ib_client_put(client);
 817:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 120911
							output: 49
							thoughts: 164
						

**Analyzing a Potential Race Condition in the Infiniband MAD Removal Process**

Okay, so I'm tracing the removal process for this MAD (Management Datagram) device, and I'm seeing a potential issue. The code calls `client->remove`, which in turn leads to `ib_mad_remove_device`. From there, we go to `ib_mad_port_close`, which is where things get interesting. `ib_mad_port_close` ultimately calls `destroy_workqueue` on a `port_priv->wq`. Now, `destroy_workqueue` is designed to flush the workqueue, that's expected.

But here's the catch: what if there's a work item on that workqueue that *holds a reference* to the protection domain (PD)? Or, what if `ib_mad_port_close` *doesn't* free the protection domain explicitly? I need to be sure the PD isn't being used after the queue is destroyed. Fortunately, I see that `ib_mad_port_close` calls `ib_dealloc_pd(port_priv->pd)`. Okay, that's promising. Now, I need to check `ib_dealloc_pd` to make sure there's no problem.

map[ContextFile:drivers/infiniband/core/verbs.c IncludeLines:true Name:ib_dealloc_pd_user]

map[SourceCode: 328:	/**
 329:	 * ib_dealloc_pd_user - Deallocates a protection domain.
 330:	 * @pd: The protection domain to deallocate.
 331:	 * @udata: Valid user data or NULL for kernel object
 332:	 *
 333:	 * It is an error to call this function while any resources in the pd still
 334:	 * exist.  The caller is responsible to synchronously destroy them and
 335:	 * guarantee no new allocations will happen.
 336:	 */
 337:	int ib_dealloc_pd_user(struct ib_pd *pd, struct ib_udata *udata)
 338:	{
 339:		int ret;
 340:	
 341:		if (pd->__internal_mr) {
 342:			ret = pd->device->ops.dereg_mr(pd->__internal_mr, NULL);
 343:			WARN_ON(ret);
 344:			pd->__internal_mr = NULL;
 345:		}
 346:	
 347:		ret = pd->device->ops.dealloc_pd(pd, udata);
 348:		if (ret)
 349:			return ret;
 350:	
 351:		rdma_restrack_del(&pd->res);
 352:		kfree(pd);
 353:		return ret;
 354:	}
 SourceFile:drivers/infiniband/core/verbs.c]

gemini-3.1-pro-preview

							input: 121823
							output: 54
							thoughts: 53
						

Okay, let me break this down.

**Deallocating Protection Domains: A Quick Dive into the RDMA Ecosystem**

Alright, so I'm thinking through the memory management within this RDMA framework, specifically concerning Protection Domains. I see that `ib_dealloc_pd_user` is the key function here. Now, it seems like this function isn't doing the deallocation directly. Instead, it's acting as a sort of dispatcher, calling `pd->device->ops.dealloc_pd(pd, udata)`. This is standard, I suppose; using function pointers for a device-specific approach is common.

The real meat of the operation, the actual deallocation, is delegated to the `dealloc_pd` function, which is, in turn, dependent on the underlying RDMA device. Aha! For the `rxe` path, which I'm very familiar with, it’s calling `rxe_dealloc_pd`. So, it goes to the `rxe` module, which will have its own specific implementation. That makes sense, keeps things modular and allows for proper device integration. No big surprises here, just standard RDMA procedure, but good to refresh on what's going on.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_verbs.c IncludeLines:true Name:rxe_dealloc_pd]

map[SourceCode: 269:	static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 270:	{
 271:		struct rxe_pd *pd = to_rpd(ibpd);
 272:		int err;
 273:	
 274:		err = rxe_cleanup(pd);
 275:		if (err)
 276:			rxe_err_pd(pd, "cleanup failed, err = %d\n", err);
 277:	
 278:		return 0;
 279:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 122395
							output: 51
							thoughts: 23
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Debugging an `rxe_cleanup` Error**

Okay, wait a minute... `rxe_cleanup` actually *returns* an error? That's not what I was expecting. I'd assumed it was a void function and any failures would manifest elsewhere, maybe through a global error code or something. Hmm, this is interesting. I'll need to go back and double-check how `rxe_cleanup` is implemented. I'll have to investigate the return value to understand what's actually happening when things go sideways. Let's dive into the code for `rxe_cleanup` and see what the function is telling me.

requested entity does not exist

map[ContextFile:drivers/infiniband/sw/rxe/rxe_pool.c IncludeLines:true Name:rxe_cleanup]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 122645
							output: 18
							thoughts: 26
						

Here's my thought process, summarized as you requested:

**Investigating RXE Cleanup in the Infiniband Driver**

Okay, so I need to dive into the `rxe_cleanup` functionality within the RXE subsystem of the Infiniband driver. My initial instinct is to go directly to the source code, specifically the `drivers/infiniband/sw/rxe/` directory. That's where I'd expect to find the relevant implementation. I'm assuming that function is pretty important so it should be easy enough to track down. This looks like a cleanup or teardown function in the RXE, so it should be fairly self contained.

map[Expression:rxe_cleanup]

map[Output:drivers/infiniband/sw/rxe/rxe_loc.h=39=int rxe_detach_mcast(struct ib_qp *ibqp, union ib_gid *mgid, u16 mlid);
drivers/infiniband/sw/rxe/rxe_loc.h:40:void rxe_cleanup_mcg(struct kref *kref);
drivers/infiniband/sw/rxe/rxe_loc.h-41-
--
drivers/infiniband/sw/rxe/rxe_mcast.c=206=static struct rxe_mcg *rxe_get_mcg(struct rxe_dev *rxe, union ib_gid *mgid)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-256-/**
drivers/infiniband/sw/rxe/rxe_mcast.c:257: * rxe_cleanup_mcg - cleanup mcg for kref_put
drivers/infiniband/sw/rxe/rxe_mcast.c-258- * @kref: struct kref embnedded in mcg
drivers/infiniband/sw/rxe/rxe_mcast.c-259- */
drivers/infiniband/sw/rxe/rxe_mcast.c:260:void rxe_cleanup_mcg(struct kref *kref)
drivers/infiniband/sw/rxe/rxe_mcast.c-261-{
--
drivers/infiniband/sw/rxe/rxe_mcast.c=274=static void __rxe_destroy_mcg(struct rxe_mcg *mcg)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-279-	__rxe_remove_mcg(mcg);
drivers/infiniband/sw/rxe/rxe_mcast.c:280:	kref_put(&mcg->ref_cnt, rxe_cleanup_mcg);
drivers/infiniband/sw/rxe/rxe_mcast.c-281-
--
drivers/infiniband/sw/rxe/rxe_mcast.c=349=static int rxe_attach_mcg(struct rxe_mcg *mcg, struct rxe_qp *qp)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-388-/**
drivers/infiniband/sw/rxe/rxe_mcast.c:389: * __rxe_cleanup_mca - cleanup mca object holding lock
drivers/infiniband/sw/rxe/rxe_mcast.c-390- * @mca: mca object
--
drivers/infiniband/sw/rxe/rxe_mcast.c-394- */
drivers/infiniband/sw/rxe/rxe_mcast.c:395:static void __rxe_cleanup_mca(struct rxe_mca *mca, struct rxe_mcg *mcg)
drivers/infiniband/sw/rxe/rxe_mcast.c-396-{
--
drivers/infiniband/sw/rxe/rxe_mcast.c=414=static int rxe_detach_mcg(struct rxe_mcg *mcg, struct rxe_qp *qp)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-421-		if (mca->qp == qp) {
drivers/infiniband/sw/rxe/rxe_mcast.c:422:			__rxe_cleanup_mca(mca, mcg);
drivers/infiniband/sw/rxe/rxe_mcast.c-423-
--
drivers/infiniband/sw/rxe/rxe_mcast.c=451=int rxe_attach_mcast(struct ib_qp *ibqp, union ib_gid *mgid, u16 mlid)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-468-
drivers/infiniband/sw/rxe/rxe_mcast.c:469:	kref_put(&mcg->ref_cnt, rxe_cleanup_mcg);
drivers/infiniband/sw/rxe/rxe_mcast.c-470-
--
drivers/infiniband/sw/rxe/rxe_mcast.c=482=int rxe_detach_mcast(struct ib_qp *ibqp, union ib_gid *mgid, u16 mlid)
--
drivers/infiniband/sw/rxe/rxe_mcast.c-493-	err = rxe_detach_mcg(mcg, qp);
drivers/infiniband/sw/rxe/rxe_mcast.c:494:	kref_put(&mcg->ref_cnt, rxe_cleanup_mcg);
drivers/infiniband/sw/rxe/rxe_mcast.c-495-
--
drivers/infiniband/sw/rxe/rxe_mw.c=41=int rxe_dealloc_mw(struct ib_mw *ibmw)
--
drivers/infiniband/sw/rxe/rxe_mw.c-44-
drivers/infiniband/sw/rxe/rxe_mw.c:45:	rxe_cleanup(mw);
drivers/infiniband/sw/rxe/rxe_mw.c-46-
--
drivers/infiniband/sw/rxe/rxe_pool.c=170=static void rxe_elem_release(struct kref *kref)
--
drivers/infiniband/sw/rxe/rxe_pool.c-176-
drivers/infiniband/sw/rxe/rxe_pool.c:177:int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable)
drivers/infiniband/sw/rxe/rxe_pool.c-178-{
--
drivers/infiniband/sw/rxe/rxe_pool.h=70=int __rxe_put(struct rxe_pool_elem *elem);
--
drivers/infiniband/sw/rxe/rxe_pool.h-72-
drivers/infiniband/sw/rxe/rxe_pool.h:73:int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable);
drivers/infiniband/sw/rxe/rxe_pool.h:74:#define rxe_cleanup(obj) __rxe_cleanup(&(obj)->elem, true)
drivers/infiniband/sw/rxe/rxe_pool.h:75:#define rxe_cleanup_ah(obj, sleepable) __rxe_cleanup(&(obj)->elem, sleepable)
drivers/infiniband/sw/rxe/rxe_pool.h-76-
--
drivers/infiniband/sw/rxe/rxe_qp.c=853=static void rxe_qp_do_cleanup(struct work_struct *work)
--
drivers/infiniband/sw/rxe/rxe_qp.c-873-	if (qp->recv_task.func)
drivers/infiniband/sw/rxe/rxe_qp.c:874:		rxe_cleanup_task(&qp->recv_task);
drivers/infiniband/sw/rxe/rxe_qp.c-875-
drivers/infiniband/sw/rxe/rxe_qp.c-876-	if (qp->send_task.func)
drivers/infiniband/sw/rxe/rxe_qp.c:877:		rxe_cleanup_task(&qp->send_task);
drivers/infiniband/sw/rxe/rxe_qp.c-878-
--
drivers/infiniband/sw/rxe/rxe_recv.c=190=static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
--
drivers/infiniband/sw/rxe/rxe_recv.c-259-
drivers/infiniband/sw/rxe/rxe_recv.c:260:	kref_put(&mcg->ref_cnt, rxe_cleanup_mcg);
drivers/infiniband/sw/rxe/rxe_recv.c-261-
--
drivers/infiniband/sw/rxe/rxe_task.c=36=static bool __reserve_if_idle(struct rxe_task *task)
--
drivers/infiniband/sw/rxe/rxe_task.c-54- * scheduled in the work queue. This routine is
drivers/infiniband/sw/rxe/rxe_task.c:55: * called by rxe_cleanup_task or rxe_disable_task to
drivers/infiniband/sw/rxe/rxe_task.c-56- * see if the queue is empty.
--
drivers/infiniband/sw/rxe/rxe_task.c=74=static bool is_done(struct rxe_task *task)
--
drivers/infiniband/sw/rxe/rxe_task.c-91- * calling or scheduling. The task can also be moved to
drivers/infiniband/sw/rxe/rxe_task.c:92: * drained or invalid by calls to rxe_cleanup_task or
drivers/infiniband/sw/rxe/rxe_task.c-93- * rxe_disable_task. In that case tasks which get here
--
drivers/infiniband/sw/rxe/rxe_task.c=194=int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp,
--
drivers/infiniband/sw/rxe/rxe_task.c-207-
drivers/infiniband/sw/rxe/rxe_task.c:208:/* rxe_cleanup_task is only called from rxe_do_qp_cleanup in
drivers/infiniband/sw/rxe/rxe_task.c-209- * process context. The qp is already completed with no
--
drivers/infiniband/sw/rxe/rxe_task.c-215- */
drivers/infiniband/sw/rxe/rxe_task.c:216:void rxe_cleanup_task(struct rxe_task *task)
drivers/infiniband/sw/rxe/rxe_task.c-217-{
--
drivers/infiniband/sw/rxe/rxe_task.h=44=int rxe_init_task(struct rxe_task *task, struct rxe_qp *qp,
--
drivers/infiniband/sw/rxe/rxe_task.h-47-/* cleanup task */
drivers/infiniband/sw/rxe/rxe_task.h:48:void rxe_cleanup_task(struct rxe_task *task);
drivers/infiniband/sw/rxe/rxe_task.h-49-
--
drivers/infiniband/sw/rxe/rxe_verbs.c=239=static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-243-
drivers/infiniband/sw/rxe/rxe_verbs.c:244:	err = rxe_cleanup(uc);
drivers/infiniband/sw/rxe/rxe_verbs.c-245-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=269=static int rxe_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-273-
drivers/infiniband/sw/rxe/rxe_verbs.c:274:	err = rxe_cleanup(pd);
drivers/infiniband/sw/rxe/rxe_verbs.c-275-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=282=static int rxe_create_ah(struct ib_ah *ibah,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-335-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:336:	cleanup_err = rxe_cleanup(ah);
drivers/infiniband/sw/rxe/rxe_verbs.c-337-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=375=static int rxe_destroy_ah(struct ib_ah *ibah, u32 flags)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-379-
drivers/infiniband/sw/rxe/rxe_verbs.c:380:	err = rxe_cleanup_ah(ah, flags & RDMA_DESTROY_AH_SLEEPABLE);
drivers/infiniband/sw/rxe/rxe_verbs.c-381-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=388=static int rxe_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-436-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:437:	cleanup_err = rxe_cleanup(srq);
drivers/infiniband/sw/rxe/rxe_verbs.c-438-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=535=static int rxe_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-539-
drivers/infiniband/sw/rxe/rxe_verbs.c:540:	err = rxe_cleanup(srq);
drivers/infiniband/sw/rxe/rxe_verbs.c-541-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=548=static int rxe_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-603-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:604:	cleanup_err = rxe_cleanup(qp);
drivers/infiniband/sw/rxe/rxe_verbs.c-605-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=661=static int rxe_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-671-
drivers/infiniband/sw/rxe/rxe_verbs.c:672:	err = rxe_cleanup(qp);
drivers/infiniband/sw/rxe/rxe_verbs.c-673-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=1075=static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-1121-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:1122:	cleanup_err = rxe_cleanup(cq);
drivers/infiniband/sw/rxe/rxe_verbs.c-1123-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=1215=static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-1228-
drivers/infiniband/sw/rxe/rxe_verbs.c:1229:	err = rxe_cleanup(cq);
drivers/infiniband/sw/rxe/rxe_verbs.c-1230-	if (err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=1272=static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, u64 start,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-1317-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:1318:	cleanup_err = rxe_cleanup(mr);
drivers/infiniband/sw/rxe/rxe_verbs.c-1319-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=1361=static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
--
drivers/infiniband/sw/rxe/rxe_verbs.c-1397-err_cleanup:
drivers/infiniband/sw/rxe/rxe_verbs.c:1398:	cleanup_err = rxe_cleanup(mr);
drivers/infiniband/sw/rxe/rxe_verbs.c-1399-	if (cleanup_err)
--
drivers/infiniband/sw/rxe/rxe_verbs.c=1408=static int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
--
drivers/infiniband/sw/rxe/rxe_verbs.c-1419-
drivers/infiniband/sw/rxe/rxe_verbs.c:1420:	cleanup_err = rxe_cleanup(mr);
drivers/infiniband/sw/rxe/rxe_verbs.c-1421-	if (cleanup_err)
]

gemini-3.1-pro-preview

							input: 127617
							output: 52
							thoughts: 31
						

Here's my thought process, summarized as if I were considering the code location:

**Code Dive: Finding `__rxe_cleanup`**

Okay, so I'm trying to track down where this `__rxe_cleanup` function lives. I know it's related to the rxe (Reliable eXpress Ethernet) module, specifically within the Infiniband subsystem, but I'm just quickly trying to remember the exact path. Let me see... yes, I believe that function should be in `drivers/infiniband/sw/rxe/rxe_pool.c`. That makes sense; it's likely involved with cleaning up resources managed by the RXE pool. Good, I've got the likely location. I'll take a look in that file.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_pool.c IncludeLines:true Name:__rxe_cleanup]

map[SourceCode: 177:	int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable)
 178:	{
 179:		struct rxe_pool *pool = elem->pool;
 180:		struct xarray *xa = &pool->xa;
 181:		int ret, err = 0;
 182:		void *xa_ret;
 183:	
 184:		if (sleepable)
 185:			might_sleep();
 186:	
 187:		/* erase xarray entry to prevent looking up
 188:		 * the pool elem from its index
 189:		 */
 190:		xa_ret = xa_erase(xa, elem->index);
 191:		WARN_ON(xa_err(xa_ret));
 192:	
 193:		/* if this is the last call to rxe_put complete the
 194:		 * object. It is safe to touch obj->elem after this since
 195:		 * it is freed below
 196:		 */
 197:		__rxe_put(elem);
 198:	
 199:		/* wait until all references to the object have been
 200:		 * dropped before final object specific cleanup and
 201:		 * return to rdma-core
 202:		 */
 203:		if (sleepable) {
 204:			if (!completion_done(&elem->complete)) {
 205:				ret = wait_for_completion_timeout(&elem->complete,
 206:						msecs_to_jiffies(50000));
 207:	
 208:				/* Shouldn't happen. There are still references to
 209:				 * the object but, rather than deadlock, free the
 210:				 * object or pass back to rdma-core.
 211:				 */
 212:				if (WARN_ON(!ret))
 213:					err = -ETIMEDOUT;
 214:			}
 215:		} else {
 216:			unsigned long until = jiffies + RXE_POOL_TIMEOUT;
 217:	
 218:			/* AH objects are unique in that the destroy_ah verb
 219:			 * can be called in atomic context. This delay
 220:			 * replaces the wait_for_completion call above
 221:			 * when the destroy_ah call is not sleepable
 222:			 */
 223:			while (!completion_done(&elem->complete) &&
 224:					time_before(jiffies, until))
 225:				mdelay(1);
 226:	
 227:			if (WARN_ON(!completion_done(&elem->complete)))
 228:				err = -ETIMEDOUT;
 229:		}
 230:	
 231:		if (pool->cleanup)
 232:			pool->cleanup(elem);
 233:	
 234:		atomic_dec(&pool->num_elem);
 235:	
 236:		return err;
 237:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_pool.c]

gemini-3.1-pro-preview

							input: 128751
							output: 53
							thoughts: 820
						

**Debugging a Persistent RDMA Resource Leak**

Okay, let's break this down. My initial observation is that `__rxe_cleanup` uses `xa_erase` to remove an element from an xarray. This makes sense; if `rxe_dealloc_pd` is called, it triggers `rxe_cleanup`, which in turn calls `__rxe_cleanup`, logically removing the Protection Domain (PD) from the array. The problem is, sometimes `pool->xa` isn't empty in `rxe_pool_cleanup`. `rxe_pool_cleanup` is called within `rxe_dealloc`, which itself is called from `ib_dealloc_device`. So, if the PD pool isn't empty, it means there's a PD that *wasn't* deallocated, which is a leak.

Now, who's allocating PDs? `ib_mad_port_open` is a likely candidate; it *does* allocate a PD. Crucially, it should also deallocate it in `ib_mad_port_close`. I need to confirm if `ib_mad_port_close` is called for every port. Yes, it's called in `ib_mad_remove_device`. Good. However, `ib_mad_remove_device` is only called when a client is removed.

Wait, the key is this `rdma_for_each_port` loop within `ib_mad_remove_device`. What happens if `rdma_cap_ib_mad(device, i)` returns false inside that loop? That would skip the close calls. But why would it return false? `device->port_data[port_num].immutable.core_cap_flags` are immutable, so that isn't it. Could `ib_mad_init_device` fail? But that *should* handle cleanup and return an error. `ib_mad_init_device` is called from `ib_mad_client.add`. If `client->add` fails, the client isn't added anyway.

I'm starting to suspect a race condition. What if the device is unregistered *while* `ib_mad_init_device` is running? The `add_client_context` function holds `device->client_data_rwsem` in read mode. It downgrades the lock when it calls `client->add`, but what about the PD? Is the PD allocated by someone else?

Alright, let's re-examine the reproducer. The `syscall(__NR_sendmsg...)` indicates a `RDMA_NLDEV_CMD_NEWLINK` call. This is followed by USB device creation, then a `RDMA_NLDEV_CMD_PORT_GET` command, followed by BPF program loading. Wait a minute... Could `RDMA_NLDEV_CMD_PORT_GET` be the culprit? Let me check the handler for `RDMA_NLDEV_CMD_PORT_GET`. It seems like I need to dig deeper into the code path triggered by this Netlink command. This might be where the PD is being allocated and not correctly deallocated, or something is interfering with the clean up.

map[ContextFile:drivers/infiniband/core/nldev.c IncludeLines:true Name:nldev_port_get_doit]

map[SourceCode:1210:	static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
1211:				       struct netlink_ext_ack *extack)
1212:	{
1213:		struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
1214:		struct ib_device *device;
1215:		struct sk_buff *msg;
1216:		u32 index;
1217:		u32 port;
1218:		int err;
1219:	
1220:		err = __nlmsg_parse(nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
1221:				    nldev_policy, NL_VALIDATE_LIBERAL, extack);
1222:		if (err ||
1223:		    !tb[RDMA_NLDEV_ATTR_DEV_INDEX] ||
1224:		    !tb[RDMA_NLDEV_ATTR_PORT_INDEX])
1225:			return -EINVAL;
1226:	
1227:		index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
1228:		device = ib_device_get_by_index(sock_net(skb->sk), index);
1229:		if (!device)
1230:			return -EINVAL;
1231:	
1232:		port = nla_get_u32(tb[RDMA_NLDEV_ATTR_PORT_INDEX]);
1233:		if (!rdma_is_port_valid(device, port)) {
1234:			err = -EINVAL;
1235:			goto err;
1236:		}
1237:	
1238:		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1239:		if (!msg) {
1240:			err = -ENOMEM;
1241:			goto err;
1242:		}
1243:	
1244:		nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
1245:				RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
1246:				0, 0);
1247:		if (!nlh) {
1248:			err = -EMSGSIZE;
1249:			goto err_free;
1250:		}
1251:	
1252:		err = fill_port_info(msg, device, port, sock_net(skb->sk));
1253:		if (err)
1254:			goto err_free;
1255:	
1256:		nlmsg_end(msg, nlh);
1257:		ib_device_put(device);
1258:	
1259:		return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);
1260:	
1261:	err_free:
1262:		nlmsg_free(msg);
1263:	err:
1264:		ib_device_put(device);
1265:		return err;
1266:	}
 SourceFile:drivers/infiniband/core/nldev.c]

gemini-3.1-pro-preview

							input: 131247
							output: 55
							thoughts: 1399
						

**Deconstructing the Reproducer's Actions**

Okay, so I'm looking at this reproducer, and initially, it doesn't seem to be doing anything overtly interesting. Then, I see the `syz_usb_connect` call, which creates a USB Raw Gadget. That's a bit peculiar. I'm wondering why it needs to do that in the context of this bug report, especially since the title references a UDC issue. The title mentions the specific error: "UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy", along with other related messages.

The crucial clue, however, is the "smc: removing ib device syz0" message, which appears when `smc_ib_remove_dev` is called. This indicates that `ib_unregister_device` is being invoked. I need to understand *why* `ib_unregister_device` is called. Typically, this happens when the reproducer exits, a net namespace is destroyed, or, potentially, a `bond0` device is destroyed. I note the reproducer creates `syz0` on `bond0`. If the reproducer were destroying a net namespace, that would be a likely culprit. However, this reproducer doesn't seem to create a net namespace.

Aha! Now I remember: `rxe` devices are destroyed when the underlying netdev is destroyed or when `RDMA_NLDEV_CMD_DELLINK` is called.

The stack trace clarifies things: `nldev_dellink` is being called, which then traces to `rdma_nl_rcv_msg`. So, `nldev_dellink` is the key.

This points to the reproducer sending a `RDMA_NLDEV_CMD_DELLINK` command! Time to double-check the reproducer code. Let me examine the `sendmsg` call...

Okay, I'm checking the byte array constructed for the netlink message. The relevant part looks like this: `20 00 00 00` gives a length of 32 bytes and `04 14` which, when reversed, is 0x1404. Now, the type is set to `0x1404` where the command is 4, which corresponds to `RDMA_NLDEV_CMD_DELLINK`. The value of `RDMA_NLDEV_CMD_DELLINK` is 4. Yep, it is sending the command!

So, the reproducer directly sends a netlink message to delete the device. Now, I have a clearer picture.

requested entity does not exist

map[ContextFile:include/uapi/rdma/rdma_netlink.h IncludeLines:true Name:RDMA_NLDEV_CMD_DELLINK]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 133292
							output: 25
							thoughts: 18
						

Here's my take on those thoughts, tailored for an expert audience:

**Investigating `RDMA_NLDEV_CMD_DELLINK`**

Okay, so I need to dig into this `RDMA_NLDEV_CMD_DELLINK` command. It seems likely that this involves removing or unlinking an RDMA device or some component associated with it, probably from the netlink interface, if it’s a command. I want to understand the implications of this, particularly in the context of our existing network stack and how it interacts with the verbs. I'm immediately considering potential race conditions – are there any locking primitives that could be missed or where contention could be an issue if a device is being unlinked while other processes are attempting to use it?

I need to understand what state the kernel is in when this command is called and how the kernel handles the removal. I'll need to figure out which structures are affected (e.g., ib_device, net_device, any associated sysfs files), and what the cleanup procedures look like. I'll look for memory leaks too. I'm wondering if this ties into hotplug handling at all. If so, I need to see if it works with the hotplug interfaces, udev rules, and the like.

My first thought is to grab the source code and use `grep` to quickly identify all instances where this command is referenced. I need to understand where it's defined, how it's handled in the netlink message processing, and which functions get called downstream. Let's see what `grep` turns up and start there. From there, I'll dive into the details, and cross-reference relevant data structures and any related documentation. I want to see this implemented in the actual code.

map[Expression:RDMA_NLDEV_CMD_DELLINK]

map[Output:drivers/infiniband/core/nldev.c=2640=static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
--
drivers/infiniband/core/nldev.c-2655-	},
drivers/infiniband/core/nldev.c:2656:	[RDMA_NLDEV_CMD_DELLINK] = {
drivers/infiniband/core/nldev.c-2657-		.doit = nldev_dellink,
--
include/rdma/ib_verbs.h=277=enum ib_kernel_cap_flags {
--
include/rdma/ib_verbs.h-291-	IBK_SG_GAPS_REG = 1 << 3,
include/rdma/ib_verbs.h:292:	/* Driver supports RDMA_NLDEV_CMD_DELLINK */
include/rdma/ib_verbs.h-293-	IBK_ALLOW_USER_UNREG = 1 << 4,
--
include/uapi/rdma/rdma_netlink.h=254=enum rdma_nldev_command {
--
include/uapi/rdma/rdma_netlink.h-261-
include/uapi/rdma/rdma_netlink.h:262:	RDMA_NLDEV_CMD_DELLINK,
include/uapi/rdma/rdma_netlink.h-263-
]

gemini-3.1-pro-preview

							input: 134104
							output: 52
							thoughts: 33
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Diving into the RDMA Netlink Enumeration**

Right, let's take a quick look at that `enum rdma_nldev_command`. I need to get a handle on the available commands used for interacting with RDMA devices over netlink. Specifically, I'll be referencing `include/uapi/rdma/rdma_netlink.h` to see how the userspace programs will interface with the kernel for managing RDMA. Gotta see what sort of actions are possible there. I need to refresh my memory on what options are presented.

map[ContextFile:include/uapi/rdma/rdma_netlink.h IncludeLines:true Name:rdma_nldev_command]

map[SourceCode: 254:	enum rdma_nldev_command {
 255:		RDMA_NLDEV_CMD_UNSPEC,
 256:	
 257:		RDMA_NLDEV_CMD_GET, /* can dump */
 258:		RDMA_NLDEV_CMD_SET,
 259:	
 260:		RDMA_NLDEV_CMD_NEWLINK,
 261:	
 262:		RDMA_NLDEV_CMD_DELLINK,
 263:	
 264:		RDMA_NLDEV_CMD_PORT_GET, /* can dump */
 265:	
 266:		RDMA_NLDEV_CMD_SYS_GET,
 267:		RDMA_NLDEV_CMD_SYS_SET,
 268:	
 269:		/* 8 is free to use */
 270:	
 271:		RDMA_NLDEV_CMD_RES_GET = 9, /* can dump */
 272:	
 273:		RDMA_NLDEV_CMD_RES_QP_GET, /* can dump */
 274:	
 275:		RDMA_NLDEV_CMD_RES_CM_ID_GET, /* can dump */
 276:	
 277:		RDMA_NLDEV_CMD_RES_CQ_GET, /* can dump */
 278:	
 279:		RDMA_NLDEV_CMD_RES_MR_GET, /* can dump */
 280:	
 281:		RDMA_NLDEV_CMD_RES_PD_GET, /* can dump */
 282:	
 283:		RDMA_NLDEV_CMD_GET_CHARDEV,
 284:	
 285:		RDMA_NLDEV_CMD_STAT_SET,
 286:	
 287:		RDMA_NLDEV_CMD_STAT_GET, /* can dump */
 288:	
 289:		RDMA_NLDEV_CMD_STAT_DEL,
 290:	
 291:		RDMA_NLDEV_CMD_RES_QP_GET_RAW,
 292:	
 293:		RDMA_NLDEV_CMD_RES_CQ_GET_RAW,
 294:	
 295:		RDMA_NLDEV_CMD_RES_MR_GET_RAW,
 296:	
 297:		RDMA_NLDEV_CMD_RES_CTX_GET, /* can dump */
 298:	
 299:		RDMA_NLDEV_CMD_RES_SRQ_GET, /* can dump */
 300:	
 301:		RDMA_NLDEV_CMD_STAT_GET_STATUS,
 302:	
 303:		RDMA_NLDEV_CMD_RES_SRQ_GET_RAW,
 304:	
 305:		RDMA_NLDEV_CMD_NEWDEV,
 306:	
 307:		RDMA_NLDEV_CMD_DELDEV,
 308:	
 309:		RDMA_NLDEV_CMD_MONITOR,
 310:	
 311:		RDMA_NLDEV_NUM_OPS
 312:	};
 SourceFile:include/uapi/rdma/rdma_netlink.h]

gemini-3.1-pro-preview

							input: 135220
							output: 51
							thoughts: 873
						

**Decoding the RDMA Device Deletion Sequence**

Okay, so I'm looking at this reproducer and the byte array. The initial assumption from syzkaller was `RDMA_NLDEV_CMD_PORT_GET` (5), but the data tells a different story. The actual command being sent is `RDMA_NLDEV_CMD_DELLINK` (4). This makes sense, given the byte representation and the context. `RDMA_NLDEV_CMD_DELLINK` is a link deletion command, which lines up with the stack trace that shows `nldev_dellink` being invoked, followed by the unregistration of the device.

The stack trace clearly indicates that the driver is calling `rxe_dealloc`, which in turn leads to calls to `ib_dealloc_device`, `__ib_unregister_device`, and ultimately, `nldev_dellink`. This confirms my suspicion that we're dealing with a device unregistration process. The critical point is that within this process, `pd_pool` is not empty. But *why* is the protection domain pool (`pd_pool`) still non-empty?

My thoughts are leading me to the connection between `ib_mad_port_close` being called from `ib_mad_remove_device`, which is invoked from `remove_client_context`. I need to follow the thread... `remove_client_context` triggers `client->remove`, and subsequently `ib_device_put(device)`. Then, `ib_mad_port_close` leads to `destroy_workqueue(port_priv->wq)`.

`destroy_workqueue` normally waits for work items to complete before destroying the queue, which would then trigger the freeing of the protection domain with `ib_dealloc_pd(port_priv->pd)`. But `ib_dealloc_pd` appears to be a direct synchronous call, not asynchronous as I first thought. `ib_dealloc_pd` actually calls the device-specific deallocation function, in this case, `rxe_dealloc_pd`. In the `rxe` driver, `rxe_dealloc_pd` calls `rxe_cleanup`, which then calls `__rxe_cleanup` with the `true` flag.

The important call here is that `__rxe_cleanup` calls `xa_erase(xa, elem->index)`. This removes the element from the xarray. So, the crucial point is that after this, `!xa_empty(&pool->xa)` should evaluate to FALSE because the element is *removed* from the xarray.

Given this, I have to ask: if the element is removed from the xarray, why does the code trigger `WARN_ON(!xa_empty(&pool->xa))`? This indicates that there might be another PD still present in the pool. I need to check if there are other places where the `rxe` driver internally allocates protection domains.

requested entity does not exist

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeSnippetLines:0 Name:ib_alloc_pd]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 136798
							output: 52
							thoughts: 20
						

Okay, here's my summary, taking the perspective of someone thinking through this code:

**Checking Direct Calls to `rxe_alloc_pd`**

Alright, let's get down to brass tacks. I need to understand how `rxe` handles memory protection domains, specifically the allocation. My current hunch is that `rxe` might be calling `rxe_alloc_pd` directly. I need to verify that and see if it's the only way, or are there any other functions involved. Let's trace through the code and confirm that. Knowing this will help understand how the underlying memory protection domain is created and managed by `rxe`.

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeSnippetLines:0 Name:rxe_alloc_pd]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 137028
							output: 52
							thoughts: 257
						

**My Thought Process on `rxe_alloc_pd` and Potential Callers**

Okay, let's break this down. I'm focusing on `rxe_alloc_pd` and where it's being called. My initial thought is that it's only invoked through `device->ops.alloc_pd`. That's the typical structure, and I'd expect it to be. But the real question is, who's actually calling `ib_alloc_pd` which seems to be the underlying function. I know I've got a lot of code bases that *could* be using it.

I've already gone through and checked quite a few modules, specifically: `ib_mad_port_open`, `ipoib_dev_init`, `smc_ib_create_protection_domain`, and then several within different RDMA transport layers like `smbdirect.c`, `transport_rdma.c`, `9p/trans_rdma.c`, `rds/ib.c`, `sunrpc/xprtrdma/svc_rdma_transport.c`, `sunrpc/xprtrdma/verbs.c`, and a number of NVMe RDMA implementations, including `nvme/host/rdma.c`, and `nvme/target/rdma.c`. I also have to consider SRP, with `srp/ib_srp.c`, and `srpt/ib_srpt.c` covered, as well as `rtrs/rtrs.c`, `isert/ib_isert.c`, and `iser/iser_verbs.c`.

Hold on, I need to consider a different angle. What if `ib_alloc_pd` *isn't* solely a kernel-space call? What if userspace is able to directly trigger it? That would change the scope of what I need to watch. Bingo, it looks like userspace can allocate a protection domain via `ib_uverbs_alloc_pd`. This definitely changes things, so I need to factor that into my analysis.

map[ContextFile:drivers/infiniband/core/uverbs_cmd.c IncludeLines:true Name:ib_uverbs_alloc_pd]

map[SourceCode: 438:	static int ib_uverbs_alloc_pd(struct uverbs_attr_bundle *attrs)
 439:	{
 440:		struct ib_uverbs_alloc_pd_resp resp = {};
 441:		struct ib_uverbs_alloc_pd      cmd;
 442:		struct ib_uobject             *uobj;
 443:		struct ib_pd                  *pd;
 444:		int                            ret;
 445:		struct ib_device *ib_dev;
 446:	
 447:		ret = uverbs_request(attrs, &cmd, sizeof(cmd));
 448:		if (ret)
 449:			return ret;
 450:	
 451:		uobj = uobj_alloc(UVERBS_OBJECT_PD, attrs, &ib_dev);
 452:		if (IS_ERR(uobj))
 453:			return PTR_ERR(uobj);
 454:	
 455:		pd = rdma_zalloc_drv_obj(ib_dev, ib_pd);
 456:		if (!pd) {
 457:			ret = -ENOMEM;
 458:			goto err;
 459:		}
 460:	
 461:		pd->device  = ib_dev;
 462:		pd->uobject = uobj;
 463:		atomic_set(&pd->usecnt, 0);
 464:	
 465:		rdma_restrack_new(&pd->res, RDMA_RESTRACK_PD);
 466:		rdma_restrack_set_name(&pd->res, NULL);
 467:	
 468:		ret = ib_dev->ops.alloc_pd(pd, &attrs->driver_udata);
 469:		if (ret)
 470:			goto err_alloc;
 471:		rdma_restrack_add(&pd->res);
 472:	
 473:		uobj->object = pd;
 474:		uobj_finalize_uobj_create(uobj, attrs);
 475:	
 476:		resp.pd_handle = uobj->id;
 477:		return uverbs_response(attrs, &resp, sizeof(resp));
 478:	
 479:	err_alloc:
 480:		rdma_restrack_put(&pd->res);
 481:		kfree(pd);
 482:	err:
 483:		uobj_alloc_abort(uobj, attrs);
 484:		return ret;
 485:	}
 SourceFile:drivers/infiniband/core/uverbs_cmd.c]

gemini-3.1-pro-preview

							input: 138533
							output: 52
							thoughts: 1070
						

**Debugging the InfiniBand PD Leak**

Okay, so the reproducer isn't even touching `/dev/infiniband/uverbsX`. That's not the culprit. It's using `RDMA_NLDEV_CMD_NEWLINK`, `RDMA_NLDEV_CMD_PORT_GET`, and `RDMA_NLDEV_CMD_DELLINK`, and then creates a USB Raw Gadget. The `RDMA_NLDEV_CMD_NEWLINK` call creates an `rxe` device, `PORT_GET` gets port info and `DELLINK` deletes it. I need to figure out where the protection domain (PD) is coming from. 

Could it be `ib_mad_port_open`? Yes, that's called when the device is registered and `ib_mad_port_close` gets called when it's unregistered. Wait, `ib_mad_port_close` calls `ib_dealloc_pd`, which *should* remove the PD from the xarray. So why isn't the xarray empty? Am I certain `ib_mad_port_close` is always being called? Let's check `ib_mad_remove_device`.

Okay, the `rdma_for_each_port` loop iterates across ports, and calls `ib_mad_port_close`. Let's see... `rdma_start_port` and `rdma_end_port`... for `rxe`, this loop should run with `i = 1`. Then,  `rdma_cap_ib_mad(device, 1)` should return true, as `RDMA_CORE_PORT_IBA_ROCE_UDP_ENCAP` includes `RDMA_CORE_CAP_IB_MAD`.

Wait, what if `ib_mad_init_device` failed during initialization? That's a possibility. But, `add_client_context` ignores the error from the `client->add` function! If the client add fails, the client is *not* registered. So `remove_client_context` will NOT call `client->remove`! But, if `ib_mad_init_device` fails, it *does* clean up what it allocated. Same goes for failures from `ib_mad_port_open`. So, it looks like there shouldn't be a leak *from* the MAD layer.

Alright, so the MAD layer isn't the culprit... what about the Secure Multi-Connect (smc) layer? Does it allocate a PD? `smc_ib_add_dev` does *not* allocate a PD directly. It schedules `smcibdev->port_event_work`, which calls `smcr_port_add`... and that, in turn, calls `smc_llc_add_link_local`. Let's see if *that* allocates a PD. I'll check that next.

map[ContextFile:net/smc/smc_llc.c IncludeLines:true Name:smc_llc_add_link_local]

map[SourceCode:1547:	/* enqueue a local add_link req to trigger a new add_link flow */
1548:	void smc_llc_add_link_local(struct smc_link *link)
1549:	{
1550:		struct smc_llc_msg_add_link add_llc = {};
1551:	
1552:		add_llc.hd.common.llc_type = SMC_LLC_ADD_LINK;
1553:		smc_llc_init_msg_hdr(&add_llc.hd, link->lgr, sizeof(add_llc));
1554:		/* no dev and port needed */
1555:		smc_llc_enqueue(link, (union smc_llc_msg *)&add_llc);
1556:	}
 SourceFile:net/smc/smc_llc.c]

gemini-3.1-pro-preview

							input: 140540
							output: 51
							thoughts: 34
						

Okay, let me think this through.

**Analyzing the Protection Domain Creation**

Right, so `smc_ib_create_protection_domain`... that function, if I'm not mistaken, is responsible for allocating a Protection Domain, or PD. That seems pretty straightforward, it sets up the basic memory protection environment within the InfiniBand hardware, giving us a controlled area to play with. But, wait, I need to dig deeper. If the function's creating the PD, who, precisely, is calling `smc_ib_create_protection_domain`? Is it the driver? A higher-level application? Understanding the caller is key to understanding the purpose of the created protection domain in the bigger picture. It'll give me context to why it's being created and what the caller wants to achieve through using the PD.

map[ContextFile:net/smc/smc_ib.c IncludeSnippetLines:0 Name:smc_ib_create_protection_domain]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smcr_link_init SourceFile:net/smc/smc_core.c SourceLine:841]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 140876
							output: 47
							thoughts: 23
						

Here's a summary of my thought process, as requested:

**Tracing the Call Stack: `smcr_link_init`**

Okay, so `smcr_link_init` has been flagged as significant. My initial thought process is to understand the context. The crucial piece is *who* is calling this function. Knowing the caller is absolutely fundamental. Without that, I'm just looking at an isolated piece of code, devoid of its operational meaning. I need to trace back from this function to the point of invocation. This means diving deep into the code and examining where the `smcr_link_init` function is being called. My expertise tells me that this is the crucial starting point for understanding its purpose and potential impact, which relies on understanding the function's place in a bigger sequence.

map[ContextFile:net/smc/smc_core.c IncludeSnippetLines:0 Name:smcr_link_init]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_lgr_create SourceFile:net/smc/smc_core.c SourceLine:985] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_llc_cli_add_link SourceFile:net/smc/smc_llc.c SourceLine:1081] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_llc_srv_add_link SourceFile:net/smc/smc_llc.c SourceLine:1461]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 141312
							output: 48
							thoughts: 25
						

Here's my thought process, as if I were analyzing this code:

**Analyzing the Call Stack: Where Does This Logging Start?**

Okay, so `smc_lgr_create` is the function of interest. That's where some kind of logging or logging system setup begins. The immediate question, the one I *need* to answer first, is: **who calls it?** I need to trace back through the call stack to understand the context. Knowing *where* `smc_lgr_create` is invoked tells me a huge amount about *why* it's being invoked. Is it part of initialization? Is it called in response to a specific event? The answer shapes my understanding of the system's behavior. Time to fire up the debugger or static analysis tools and trace that call.

map[ContextFile:net/smc/smc_core.c IncludeSnippetLines:0 Name:smc_lgr_create]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_conn_create SourceFile:net/smc/smc_core.c SourceLine:2039]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 141632
							output: 47
							thoughts: 23
						

Here's my thought process, as requested:

**Tracing the Caller of `smc_conn_create`**

Okay, so `smc_conn_create` is the function of interest. The immediate question is, where does it originate from? The context I have is that `smc_conn_create` is *called* somewhere, but I need to identify the calling function, that is the "caller." I need to understand the call stack, at least at this point. Knowing the caller is fundamental to understanding the purpose and context of `smc_conn_create`. My mental gears are already turning, searching the codebase (or my internal understanding of it) for possible locations. I'm thinking about the various modules and subsystems that might be responsible for establishing connections. What pieces of the system interact with connections? The network stack? Some user-space application? The device driver? I need to narrow down the search and identify the source of the `smc_conn_create` call. So, let me find out where that call originates. Let's dig in.

map[ContextFile:net/smc/smc_core.c IncludeSnippetLines:0 Name:smc_conn_create]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_connect_ism SourceFile:net/smc/af_smc.c SourceLine:1435] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_connect_rdma SourceFile:net/smc/af_smc.c SourceLine:1275] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_listen_ism_init SourceFile:net/smc/af_smc.c SourceLine:2088] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_listen_rdma_init SourceFile:net/smc/af_smc.c SourceLine:2069]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 142175
							output: 51
							thoughts: 72
						

Okay, let's break this down.

**Investigating Potential PD Allocation**

Right, so we're looking at socket creation and connection. This triggers specific routines, but the reproducer isn't even touching SMC sockets, so SMC isn't the culprit for PD allocation. That narrows the focus.

Hang on a second… what about `rxe_alloc_pd`? Could *RXE* itself be responsible for the allocation? That's a definite possibility that needs investigating. Let's go straight to `rxe_register_device` and see if the allocation logic is located there. That's the most logical place to start digging deeper.

map[ContextFile:drivers/infiniband/sw/rxe/rxe.c IncludeLines:true Name:rxe_register_device]

map[SourceCode:1533:	int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name,
1534:							struct net_device *ndev)
1535:	{
1536:		int err;
1537:		struct ib_device *dev = &rxe->ib_dev;
1538:	
1539:		strscpy(dev->node_desc, "rxe", sizeof(dev->node_desc));
1540:	
1541:		dev->node_type = RDMA_NODE_IB_CA;
1542:		dev->phys_port_cnt = 1;
1543:		dev->num_comp_vectors = num_possible_cpus();
1544:		dev->local_dma_lkey = 0;
1545:		addrconf_addr_eui48((unsigned char *)&dev->node_guid,
1546:				    rxe->raw_gid);
1547:	
1548:		dev->uverbs_cmd_mask |= BIT_ULL(IB_USER_VERBS_CMD_POST_SEND) |
1549:					BIT_ULL(IB_USER_VERBS_CMD_REQ_NOTIFY_CQ);
1550:	
1551:		ib_set_device_ops(dev, &rxe_dev_ops);
1552:		err = ib_device_set_netdev(&rxe->ib_dev, ndev, 1);
1553:		if (err)
1554:			return err;
1555:	
1556:		err = ib_register_device(dev, ibdev_name, NULL);
1557:		if (err)
1558:			rxe_dbg_dev(rxe, "failed with error %d\n", err);
1559:	
1560:		/*
1561:		 * Note that rxe may be invalid at this point if another thread
1562:		 * unregistered it.
1563:		 */
1564:		return err;
1565:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 143027
							output: 47
							thoughts: 1045
						

**Debugging a Potential Resource Leak**

Okay, let's break this down. I'm seeing a potential issue in how we're handling Protection Domains (PDs) within the RDMA stack. My initial thought is that the registration of the device via `rxe_register_device` is the starting point, and that if `ib_register_device` fails, we get an error. My next train of thought is to check what happens if `ib_mad_port_close` doesn't wait for the PD to be deallocated.

So, let me follow the PD deallocation path. `ib_dealloc_pd` eventually calls `ib_dealloc_pd_user`, which in turn calls the device-specific deallocation function, in our case, `rxe_dealloc_pd`.  `rxe_dealloc_pd` calls `rxe_cleanup`, and that, in turn, calls `__rxe_cleanup` with the `true` flag.  `__rxe_cleanup` calls `xa_erase`, which should remove the element from the xarray.  After the `xa_erase` call, it calls `__rxe_put`, and then it waits for the `completion_done` signal.  But hang on! If `xa_erase` is called, the element should be gone from the xarray! Therefore, `!xa_empty(&pool->xa)` should be `TRUE`.

But wait a minute... why isn't `pool->xa` empty after `xa_erase`? Something doesn't make sense here. If `xa_erase` removed it, then there must be another PD in the pool. I'm going to determine if there are any other PD allocators in the kernel.

Aha! `ib_mad_port_open` allocates a PD, but it also allocates a Completion Queue (CQ), two Queue Pairs (QPs), and a workqueue. Okay, I'll need to check if `ib_mad_port_close` is called to deallocate all of these resources.

Wait a second, what if `ib_mad_port_close` is *not* called? When does that happen?  `ib_mad_remove_device` iterates over `rdma_for_each_port`, and if `rdma_cap_ib_mad(device, i)` returns false, it skips the port.  I need to check if that `rdma_cap_ib_mad` function could possibly return false during the remove operation, but true during the initialization. However, `core_cap_flags` is immutable, so it should not be the case.

Okay, let's think about this: what if `ib_mad_init_device` is still running when `ib_mad_remove_device` is called? The `add_client_context` and `remove_client_context` functions serialize access with the `device->client_data_rwsem` semaphore. I need to understand that better. `add_client_context` downgrades to a read lock before calling the client's `add` function.  And `remove_client_context` takes a write lock.  If it gets the lock, it looks for the `CLIENT_DATA_REGISTERED` flag.

Wait... `add_client_context` sets `CLIENT_DATA_REGISTERED` *after* the `client->add` function returns! This means if `remove_client_context` is called while `client->add` is still running, it will block on the write lock, which is held by `add_client_context` during `client->add`.  But no! `add_client_context` is holding a *read* lock while calling the `client->add` function. Therefore, `remove_client_context` will block on the `down_write` call until `add_client_context` finishes and releases the read lock. So after, it will acquire the write lock, find `CLIENT_DATA_REGISTERED`, and call `client->remove`. It looks like these are properly serialized.

What if `client->add` fails, though? If `client->add` fails, `add_client_context` erases the client data and returns 0.  Then, `remove_client_context` will *not* see `CLIENT_DATA_REGISTERED` and will return immediately. So if `client->add` fails, it does *not* call `client->remove`. However, I need to verify that `client->add` cleans up after itself if it fails.

Okay, I need to see if there are other clients that allocate a PD to be sure. Let me trace who calls `ib_register_client`.

map[ContextFile:drivers/infiniband/core/device.c IncludeSnippetLines:0 Name:ib_register_client]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cma_init SourceFile:drivers/infiniband/core/cma.c SourceLine:5482] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_cm_init SourceFile:drivers/infiniband/core/cm.c SourceLine:4526] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_mad_init SourceFile:drivers/infiniband/core/mad.c SourceLine:3407] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_sa_init SourceFile:drivers/infiniband/core/sa_query.c SourceLine:2518] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_umad_init SourceFile:drivers/infiniband/core/user_mad.c SourceLine:1477] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_umad_init SourceFile:drivers/infiniband/core/user_mad.c SourceLine:1481] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ib_uverbs_init SourceFile:drivers/infiniband/core/uverbs_main.c SourceLine:1318] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ipoib_init_module SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c SourceLine:2768] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:mcast_init SourceFile:drivers/infiniband/core/multicast.c SourceLine:890] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nvme_rdma_init_module SourceFile:drivers/nvme/host/rdma.c SourceLine:2402] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:nvmet_rdma_init SourceFile:drivers/nvme/target/rdma.c SourceLine:2102] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rds_ib_init SourceFile:net/rds/ib.c SourceLine:576] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:smc_ib_register_client SourceFile:net/smc/smc_ib.c SourceLine:1019] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:srp_init_module SourceFile:drivers/infiniband/ulp/srp/ib_srp.c SourceLine:4190] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ucma_init SourceFile:drivers/infiniband/core/ucma.c SourceLine:1984]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 146005
							output: 48
							thoughts: 96
						

Okay, let's see. My first thought is to dig into `ib_uverbs_init`. I need to understand what's happening there. So, that function registers a `uverbs_client`. Right, and now I'm thinking, does this client, this `uverbs_client`, directly allocate a Protection Domain, a PD? No, a quick mental review tells me it's `uverbs_add_one` that handles the character device creation. 

Alright, hold on a second. What about the CMA side of things? My memory is triggered to jump over to `cma_init`. And *that* registers a `cma_client`. Okay, the question now is, similar to the above line of thinking, does `cma_add_one` allocate a PD? I'll need to confirm that.

map[ContextFile:drivers/infiniband/core/cma.c IncludeLines:true Name:cma_add_one]

map[SourceCode:5331:	static int cma_add_one(struct ib_device *device)
5332:	{
5333:		struct rdma_id_private *to_destroy;
5334:		struct cma_device *cma_dev;
5335:		struct rdma_id_private *id_priv;
5336:		unsigned long supported_gids = 0;
5337:		int ret;
5338:		u32 i;
5339:	
5340:		if (!cma_supported(device))
5341:			return -EOPNOTSUPP;
5342:	
5343:		cma_dev = kmalloc(sizeof(*cma_dev), GFP_KERNEL);
5344:		if (!cma_dev)
5345:			return -ENOMEM;
5346:	
5347:		cma_dev->device = device;
5348:		cma_dev->default_gid_type = kcalloc(device->phys_port_cnt,
5349:						    sizeof(*cma_dev->default_gid_type),
5350:						    GFP_KERNEL);
5351:		if (!cma_dev->default_gid_type) {
5352:			ret = -ENOMEM;
5353:			goto free_cma_dev;
5354:		}
5355:	
5356:		cma_dev->default_roce_tos = kcalloc(device->phys_port_cnt,
5357:						    sizeof(*cma_dev->default_roce_tos),
5358:						    GFP_KERNEL);
5359:		if (!cma_dev->default_roce_tos) {
5360:			ret = -ENOMEM;
5361:			goto free_gid_type;
5362:		}
5363:	
5364:		rdma_for_each_port (device, i) {
5365:			supported_gids = roce_gid_type_mask_support(device, i);
5366:			WARN_ON(!supported_gids);
5367:			if (supported_gids & (1 << CMA_PREFERRED_ROCE_GID_TYPE))
5368:				cma_dev->default_gid_type[i - rdma_start_port(device)] =
5369:					CMA_PREFERRED_ROCE_GID_TYPE;
5370:			else
5371:				cma_dev->default_gid_type[i - rdma_start_port(device)] =
5372:					find_first_bit(&supported_gids, BITS_PER_LONG);
5373:			cma_dev->default_roce_tos[i - rdma_start_port(device)] = 0;
5374:		}
5375:	
5376:		init_completion(&cma_dev->comp);
5377:		refcount_set(&cma_dev->refcount, 1);
5378:		INIT_LIST_HEAD(&cma_dev->id_list);
5379:		ib_set_client_data(device, &cma_client, cma_dev);
5380:	
5381:		mutex_lock(&lock);
5382:		list_add_tail(&cma_dev->list, &dev_list);
5383:		list_for_each_entry(id_priv, &listen_any_list, listen_any_item) {
5384:			ret = cma_listen_on_dev(id_priv, cma_dev, &to_destroy);
5385:			if (ret)
5386:				goto free_listen;
5387:		}
5388:		mutex_unlock(&lock);
5389:	
5390:		trace_cm_add_one(device);
5391:		return 0;
5392:	
5393:	free_listen:
5394:		list_del(&cma_dev->list);
5395:		mutex_unlock(&lock);
5396:	
5397:		/* cma_process_remove() will delete to_destroy */
5398:		cma_process_remove(cma_dev);
5399:		kfree(cma_dev->default_roce_tos);
5400:	free_gid_type:
5401:		kfree(cma_dev->default_gid_type);
5402:	
5403:	free_cma_dev:
5404:		kfree(cma_dev);
5405:		return ret;
5406:	}
 SourceFile:drivers/infiniband/core/cma.c]

gemini-3.1-pro-preview

							input: 147607
							output: 43
							thoughts: 204
						

Okay, let's see. I'm going through this code, trying to pinpoint where a Protection Domain (PD) is allocated. My initial scan... nothing obvious. Let me quickly think back... no, I'm not seeing any PD allocation happening right off the bat. Hmm, what about `ib_cm_init`? Nope, it looks like `cm_add_one` doesn't do the PD allocation. Okay, moving on. `ib_sa_init`? Nah, `sa_add_one` doesn't allocate it either. Okay, another strike. How about `ib_umad_init`? Nope. `umad_add_one` isn't it. Let's see, what about `mcast_init`? No, no PD allocation there in `mcast_add_one`. Same story with `nvme_rdma_init_module`. It seems `nvme_rdma_add_one` doesn't do it either. Ok, let me try `nvmet_rdma_init`. No PD allocated by `nvmet_rdma_add_one`. Let's give `rds_ib_init` a shot... Aha! The function `rds_ib_add_one` *does* allocate a PD!

map[ContextFile:net/rds/ib.c IncludeLines:true Name:rds_ib_add_one]

map[SourceCode: 128:	static int rds_ib_add_one(struct ib_device *device)
 129:	{
 130:		struct rds_ib_device *rds_ibdev;
 131:		int ret;
 132:	
 133:		/* Only handle IB (no iWARP) devices */
 134:		if (device->node_type != RDMA_NODE_IB_CA)
 135:			return -EOPNOTSUPP;
 136:	
 137:		/* Device must support FRWR */
 138:		if (!(device->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
 139:			return -EOPNOTSUPP;
 140:	
 141:		rds_ibdev = kzalloc_node(sizeof(struct rds_ib_device), GFP_KERNEL,
 142:					 ibdev_to_node(device));
 143:		if (!rds_ibdev)
 144:			return -ENOMEM;
 145:	
 146:		spin_lock_init(&rds_ibdev->spinlock);
 147:		refcount_set(&rds_ibdev->refcount, 1);
 148:		INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
 149:	
 150:		INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
 151:		INIT_LIST_HEAD(&rds_ibdev->conn_list);
 152:	
 153:		rds_ibdev->max_wrs = device->attrs.max_qp_wr;
 154:		rds_ibdev->max_sge = min(device->attrs.max_send_sge, RDS_IB_MAX_SGE);
 155:	
 156:		rds_ibdev->odp_capable =
 157:			!!(device->attrs.kernel_cap_flags &
 158:			   IBK_ON_DEMAND_PAGING) &&
 159:			!!(device->attrs.odp_caps.per_transport_caps.rc_odp_caps &
 160:			   IB_ODP_SUPPORT_WRITE) &&
 161:			!!(device->attrs.odp_caps.per_transport_caps.rc_odp_caps &
 162:			   IB_ODP_SUPPORT_READ);
 163:	
 164:		rds_ibdev->max_1m_mrs = device->attrs.max_mr ?
 165:			min_t(unsigned int, (device->attrs.max_mr / 2),
 166:			      rds_ib_mr_1m_pool_size) : rds_ib_mr_1m_pool_size;
 167:	
 168:		rds_ibdev->max_8k_mrs = device->attrs.max_mr ?
 169:			min_t(unsigned int, ((device->attrs.max_mr / 2) * RDS_MR_8K_SCALE),
 170:			      rds_ib_mr_8k_pool_size) : rds_ib_mr_8k_pool_size;
 171:	
 172:		rds_ibdev->max_initiator_depth = device->attrs.max_qp_init_rd_atom;
 173:		rds_ibdev->max_responder_resources = device->attrs.max_qp_rd_atom;
 174:	
 175:		rds_ibdev->vector_load = kcalloc(device->num_comp_vectors,
 176:						 sizeof(int),
 177:						 GFP_KERNEL);
 178:		if (!rds_ibdev->vector_load) {
 179:			pr_err("RDS/IB: %s failed to allocate vector memory\n",
 180:				__func__);
 181:			ret = -ENOMEM;
 182:			goto put_dev;
 183:		}
 184:	
 185:		rds_ibdev->dev = device;
 186:		rds_ibdev->pd = ib_alloc_pd(device, 0);
 187:		if (IS_ERR(rds_ibdev->pd)) {
 188:			ret = PTR_ERR(rds_ibdev->pd);
 189:			rds_ibdev->pd = NULL;
 190:			goto put_dev;
 191:		}
 192:	
 193:		rds_ibdev->mr_1m_pool =
 194:			rds_ib_create_mr_pool(rds_ibdev, RDS_IB_MR_1M_POOL);
 195:		if (IS_ERR(rds_ibdev->mr_1m_pool)) {
 196:			ret = PTR_ERR(rds_ibdev->mr_1m_pool);
 197:			rds_ibdev->mr_1m_pool = NULL;
 198:			goto put_dev;
 199:		}
 200:	
 201:		rds_ibdev->mr_8k_pool =
 202:			rds_ib_create_mr_pool(rds_ibdev, RDS_IB_MR_8K_POOL);
 203:		if (IS_ERR(rds_ibdev->mr_8k_pool)) {
 204:			ret = PTR_ERR(rds_ibdev->mr_8k_pool);
 205:			rds_ibdev->mr_8k_pool = NULL;
 206:			goto put_dev;
 207:		}
 208:	
 209:		rdsdebug("RDS/IB: max_mr = %d, max_wrs = %d, max_sge = %d, max_1m_mrs = %d, max_8k_mrs = %d\n",
 210:			 device->attrs.max_mr, rds_ibdev->max_wrs, rds_ibdev->max_sge,
 211:			 rds_ibdev->max_1m_mrs, rds_ibdev->max_8k_mrs);
 212:	
 213:		pr_info("RDS/IB: %s: added\n", device->name);
 214:	
 215:		down_write(&rds_ib_devices_lock);
 216:		list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices);
 217:		up_write(&rds_ib_devices_lock);
 218:		refcount_inc(&rds_ibdev->refcount);
 219:	
 220:		ib_set_client_data(device, &rds_ib_client, rds_ibdev);
 221:	
 222:		rds_ib_nodev_connect();
 223:		return 0;
 224:	
 225:	put_dev:
 226:		rds_ib_dev_put(rds_ibdev);
 227:		return ret;
 228:	}
 SourceFile:net/rds/ib.c]

gemini-3.1-pro-preview

							input: 150038
							output: 43
							thoughts: 114
						

**Analyzing the Infiniband Device Lifecycle in RDS**

Okay, so I'm looking at this `rds_ib_add_one` function, and it's suddenly hitting me – it's allocating a protection domain (PD). Right, that makes sense for memory protection. Now, I'm tracing the corresponding removal process with `rds_ib_remove_one`, and it's calling `rds_ib_dev_put(rds_ibdev)`. That's where things get interesting. `rds_ib_dev_put` *decrements* the reference count, as expected. And if that refcount drops to zero... wait for it... it *queues* `rds_ib_dev_free` work. 

A workqueue item! Right, this is how the Infiniband device resource cleanup is likely deferred. We don't want to block in a potentially interrupt context. I need to take a closer look at that function. Let me check what's going on in `rds_ib_dev_free`. Time to dive into the details.

map[ContextFile:net/rds/ib.c IncludeLines:true Name:rds_ib_dev_free]

map[SourceCode:  94:	/*
  95:	 * rds_ib_destroy_mr_pool() blocks on a few things and mrs drop references
  96:	 * from interrupt context so we push freing off into a work struct in krdsd.
  97:	 */
  98:	static void rds_ib_dev_free(struct work_struct *work)
  99:	{
 100:		struct rds_ib_ipaddr *i_ipaddr, *i_next;
 101:		struct rds_ib_device *rds_ibdev = container_of(work,
 102:						struct rds_ib_device, free_work);
 103:	
 104:		if (rds_ibdev->mr_8k_pool)
 105:			rds_ib_destroy_mr_pool(rds_ibdev->mr_8k_pool);
 106:		if (rds_ibdev->mr_1m_pool)
 107:			rds_ib_destroy_mr_pool(rds_ibdev->mr_1m_pool);
 108:		if (rds_ibdev->pd)
 109:			ib_dealloc_pd(rds_ibdev->pd);
 110:	
 111:		list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) {
 112:			list_del(&i_ipaddr->list);
 113:			kfree(i_ipaddr);
 114:		}
 115:	
 116:		kfree(rds_ibdev->vector_load);
 117:	
 118:		kfree(rds_ibdev);
 119:	}
 SourceFile:net/rds/ib.c]

gemini-3.1-pro-preview

							input: 150910
							output: 43
							thoughts: 71
						

Here's a summary of my thought process, as requested:

**Diving into the RDMA Cleanup Process**

Aha! I've just realized something critical: `rds_ib_dev_free` is actually a workqueue item. That's a key piece of information. This means it's not executed immediately. My immediate next thought is that it calls `ib_dealloc_pd(rds_ibdev->pd)`. Okay, standard cleanup for an IB protection domain. But wait a minute... I have to consider the implications here. The critical part is that `remove_client_context` isn't waiting for this `rds_ib_dev_free` workqueue item to complete! The context removal is happening concurrently. This smells like a potential race condition and I need to verify what can happen here. The lack of a wait mechanism in this flow has my brain racing and I need to understand it fully. Now I need to dig into `rds_ib_remove_one` to see if that gives me any more clues as to what's going on. I need to understand how the deallocation is coordinated to ensure we don't end up with use-after-free or double-free situations.

map[ContextFile:net/rds/ib.c IncludeLines:true Name:rds_ib_remove_one]

map[SourceCode: 258:	/*
 259:	 * The IB stack is letting us know that a device is going away.  This can
 260:	 * happen if the underlying HCA driver is removed or if PCI hotplug is removing
 261:	 * the pci function, for example.
 262:	 *
 263:	 * This can be called at any time and can be racing with any other RDS path.
 264:	 */
 265:	static void rds_ib_remove_one(struct ib_device *device, void *client_data)
 266:	{
 267:		struct rds_ib_device *rds_ibdev = client_data;
 268:	
 269:		rds_ib_dev_shutdown(rds_ibdev);
 270:	
 271:		/* stop connection attempts from getting a reference to this device. */
 272:		ib_set_client_data(device, &rds_ib_client, NULL);
 273:	
 274:		down_write(&rds_ib_devices_lock);
 275:		list_del_rcu(&rds_ibdev->list);
 276:		up_write(&rds_ib_devices_lock);
 277:	
 278:		/*
 279:		 * This synchronize rcu is waiting for readers of both the ib
 280:		 * client data and the devices list to finish before we drop
 281:		 * both of those references.
 282:		 */
 283:		synchronize_rcu();
 284:		rds_ib_dev_put(rds_ibdev);
 285:		rds_ib_dev_put(rds_ibdev);
 286:	}
 SourceFile:net/rds/ib.c]

gemini-3.1-pro-preview

							input: 151771
							output: 47
							thoughts: 285
						

**Analyzing the InfiniBand Device Removal Process**

Okay, so I'm looking at this `rds_ib_remove_one` function, and something immediately jumps out. It's calling `rds_ib_dev_put` *twice*. Why twice? And, digging deeper into `rds_ib_dev_put`, I see it's queuing `rds_ib_dev_free` as a work item using `queue_work`. This means `rds_ib_remove_one` is going to return pretty quickly, and that `rds_ib_dev_free` is going to be handled asynchronously on `rds_wq`.

So, `rds_ib_remove_one` returns, then `remove_client_context` returns, and then we hit `disable_device`, which is waiting for `unreg_completion`. Okay, so `unreg_completion` is signaled when the reference count of the `ib_device` goes to zero.  That's the key. Now the question is, *does* `rds_ibdev` hold a reference to `ib_device`? I need to figure out where that reference count is being managed.

Let's look at `rds_ib_add_one`.  Aha! It doesn't call `ib_device_get` or anything like it to increment a reference!  That's very important. Which means there's no inherent reference that `rds_ibdev` is holding on `ib_device`. I was expecting to find something like that.

Wait a second, doesn't `ib_alloc_pd` do something similar? I should check that one.  Let's look at `__ib_alloc_pd` and confirm...

map[ContextFile:drivers/infiniband/core/verbs.c IncludeLines:true Name:__ib_alloc_pd]

map[SourceCode: 253:	/**
 254:	 * __ib_alloc_pd - Allocates an unused protection domain.
 255:	 * @device: The device on which to allocate the protection domain.
 256:	 * @flags: protection domain flags
 257:	 * @caller: caller's build-time module name
 258:	 *
 259:	 * A protection domain object provides an association between QPs, shared
 260:	 * receive queues, address handles, memory regions, and memory windows.
 261:	 *
 262:	 * Every PD has a local_dma_lkey which can be used as the lkey value for local
 263:	 * memory operations.
 264:	 */
 265:	struct ib_pd *__ib_alloc_pd(struct ib_device *device, unsigned int flags,
 266:			const char *caller)
 267:	{
 268:		struct ib_pd *pd;
 269:		int mr_access_flags = 0;
 270:		int ret;
 271:	
 272:		pd = rdma_zalloc_drv_obj(device, ib_pd);
 273:		if (!pd)
 274:			return ERR_PTR(-ENOMEM);
 275:	
 276:		pd->device = device;
 277:		pd->flags = flags;
 278:	
 279:		rdma_restrack_new(&pd->res, RDMA_RESTRACK_PD);
 280:		rdma_restrack_set_name(&pd->res, caller);
 281:	
 282:		ret = device->ops.alloc_pd(pd, NULL);
 283:		if (ret) {
 284:			rdma_restrack_put(&pd->res);
 285:			kfree(pd);
 286:			return ERR_PTR(ret);
 287:		}
 288:		rdma_restrack_add(&pd->res);
 289:	
 290:		if (device->attrs.kernel_cap_flags & IBK_LOCAL_DMA_LKEY)
 291:			pd->local_dma_lkey = device->local_dma_lkey;
 292:		else
 293:			mr_access_flags |= IB_ACCESS_LOCAL_WRITE;
 294:	
 295:		if (flags & IB_PD_UNSAFE_GLOBAL_RKEY) {
 296:			pr_warn("%s: enabling unsafe global rkey\n", caller);
 297:			mr_access_flags |= IB_ACCESS_REMOTE_READ | IB_ACCESS_REMOTE_WRITE;
 298:		}
 299:	
 300:		if (mr_access_flags) {
 301:			struct ib_mr *mr;
 302:	
 303:			mr = pd->device->ops.get_dma_mr(pd, mr_access_flags);
 304:			if (IS_ERR(mr)) {
 305:				ib_dealloc_pd(pd);
 306:				return ERR_CAST(mr);
 307:			}
 308:	
 309:			mr->device	= pd->device;
 310:			mr->pd		= pd;
 311:			mr->type        = IB_MR_TYPE_DMA;
 312:			mr->uobject	= NULL;
 313:			mr->need_inval	= false;
 314:	
 315:			pd->__internal_mr = mr;
 316:	
 317:			if (!(device->attrs.kernel_cap_flags & IBK_LOCAL_DMA_LKEY))
 318:				pd->local_dma_lkey = pd->__internal_mr->lkey;
 319:	
 320:			if (flags & IB_PD_UNSAFE_GLOBAL_RKEY)
 321:				pd->unsafe_global_rkey = pd->__internal_mr->rkey;
 322:		}
 323:	
 324:		return pd;
 325:	}
 SourceFile:drivers/infiniband/core/verbs.c]

gemini-3.1-pro-preview

							input: 153630
							output: 53
							thoughts: 459
						

**Race Condition in RDMA Device Removal**

Okay, let me think this through. It just hit me, the way `__ib_alloc_pd` is used… it doesn't even *take* a reference to the `device`! So, `rds_ib_remove_one` returns, and then `remove_client_context` goes and calls `ib_device_put(device)`. Then, `disable_device` waits on this `unreg_completion`. If `rds_ibdev` isn't *holding* a reference to `device`, then `unreg_completion` can complete *before* `rds_ib_dev_free` even *runs*! That's... not good.

Then, `__ib_unregister_device` calls `ib_dealloc_device(ib_dev)`. And, `ib_dealloc_device` then proceeds to call `rxe_dealloc`. Now, *this* is where it gets interesting... `rxe_dealloc` checks `WARN_ON(!xa_empty(&pool->xa))`. And since `rds_ib_dev_free` hasn't had the chance to run, the PD is *still* sitting in that pool! **Boom!** That's a classic race condition!

Wait, is `rds` even *loaded* in the reproducer? I need to know this. Okay, the reproducer does a `socket(AF_NETLINK, SOCK_RAW, NETLINK_RDMA)`. It doesn't explicitly load `rds`, no. But could `rds` be loaded by default, or maybe by another syzkaller program? I should investigate that.

Hang on… If `rds` *is* loaded, then it registers as an IB client. That means, when the `rxe` device is registered, `rds_ib_add_one` would be called. Now, wait a second. `rds_ib_add_one` has these checks in it:
```c
	/* Only handle IB (no iWARP) devices */
	if (device->node_type != RDMA_NODE_IB_CA)
		return -EOPNOTSUPP;

	/* Device must support FRWR */
	if (!(device->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
		return -EOPNOTSUPP;
```
Okay, so it is an IB device, and it must support FRWR. Now the real question. Does `rxe` support `IB_DEVICE_MEM_MGT_EXTENSIONS`? I need to check either `rxe_register_device` or `rxe_query_device` to verify that.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_verbs.c IncludeLines:true Name:rxe_query_device]

map[SourceCode:  17:	/* dev */
  18:	static int rxe_query_device(struct ib_device *ibdev,
  19:				    struct ib_device_attr *attr,
  20:				    struct ib_udata *udata)
  21:	{
  22:		struct rxe_dev *rxe = to_rdev(ibdev);
  23:		int err;
  24:	
  25:		if (udata->inlen || udata->outlen) {
  26:			rxe_dbg_dev(rxe, "malformed udata\n");
  27:			err = -EINVAL;
  28:			goto err_out;
  29:		}
  30:	
  31:		memcpy(attr, &rxe->attr, sizeof(*attr));
  32:	
  33:		return 0;
  34:	
  35:	err_out:
  36:		rxe_err_dev(rxe, "returned err = %d\n", err);
  37:		return err;
  38:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_verbs.c]

gemini-3.1-pro-preview

							input: 155058
							output: 55
							thoughts: 10
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Tracing Down Initialization of `rxe->attr`**

Alright, so the question immediately popping into my head is, "Where exactly is `rxe->attr` getting set?" That's a critical piece of information I need. I'm assuming we're dealing with an `rxe` struct, likely related to RXE (Reliable eXpress Engine) or something similar in a networking context. `attr` probably holds some configuration or state related to the RXE instance.

My immediate next step is to begin tracing the code back to initialization. I need to know where it's *first* getting a value assigned. Is it during the struct's allocation? Is it in a setup function? Is it being derived from some other context or configuration? Understanding that initialization point is key to understanding the data's lifecycle and potential issues. I'll need to use my tools and knowledge to find this initial assignment. I need to find the definition, and then begin my journey from there.

requested entity does not exist

map[ContextFile:drivers/infiniband/sw/rxe/rxe_param.c IncludeLines:true Name:rxe_set_port_info]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 155379
							output: 25
							thoughts: 26
						

Here's my thought process, as if I were considering this myself:

**Investigating IB_DEVICE_MEM_MGT_EXTENSIONS in rxe_param.c**

Okay, I need to understand how the `IB_DEVICE_MEM_MGT_EXTENSIONS` feature is handled within the `rxe_param.c` file, specifically. I know this is a critical parameter for RDMA over Converged Ethernet (RoCE) and Direct Data Placement (DDP), so I want to pinpoint where its influence is. I'll need to see how the code checks, utilizes, and potentially modifies this flag. Knowing the intricacies here is essential for debugging and performance tuning on systems utilizing this feature. I'll want to check where it is declared, assigned, and how it is used as a conditional variable in any code segments. The implications of its setting are crucial for the memory management within the RDMA fabric. Let's see what we can find.

map[Expression:IB_DEVICE_MEM_MGT_EXTENSIONS]

map[Output:drivers/infiniband/hw/bnxt_re/ib_verbs.c=183=int bnxt_re_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/bnxt_re/ib_verbs.c-213-				    | IB_DEVICE_MEM_WINDOW_TYPE_2B
drivers/infiniband/hw/bnxt_re/ib_verbs.c:214:				    | IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/bnxt_re/ib_verbs.c-215-	ib_attr->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
--
drivers/infiniband/hw/cxgb4/provider.c=255=static int c4iw_query_device(struct ib_device *ibdev, struct ib_device_attr *props,
--
drivers/infiniband/hw/cxgb4/provider.c-273-	if (fastreg_support)
drivers/infiniband/hw/cxgb4/provider.c:274:		props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/cxgb4/provider.c-275-	props->page_size_cap = T4_PAGESIZE_MASK;
--
drivers/infiniband/hw/erdma/erdma_verbs.c=318=int erdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
--
drivers/infiniband/hw/erdma/erdma_verbs.c-333-	attr->max_res_rd_atom = dev->attrs.max_qp * dev->attrs.max_ird;
drivers/infiniband/hw/erdma/erdma_verbs.c:334:	attr->device_cap_flags = IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/erdma/erdma_verbs.c-335-	attr->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
--
drivers/infiniband/hw/hfi1/verbs.c=1288=static void hfi1_fill_device_attr(struct hfi1_devdata *dd)
--
drivers/infiniband/hw/hfi1/verbs.c-1302-			IB_DEVICE_PORT_ACTIVE_EVENT | IB_DEVICE_SRQ_RESIZE |
drivers/infiniband/hw/hfi1/verbs.c:1303:			IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/hfi1/verbs.c-1304-	rdi->dparms.props.kernel_cap_flags = IBK_RDMA_NETDEV_OPA;
--
drivers/infiniband/hw/hns/hns_roce_main.c=218=static int hns_roce_query_device(struct ib_device *ib_dev,
--
drivers/infiniband/hw/hns/hns_roce_main.c-263-	    hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09) {
drivers/infiniband/hw/hns/hns_roce_main.c:264:		props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/hns/hns_roce_main.c-265-		props->max_fast_reg_page_list_len = HNS_ROCE_FRMR_MAX_PA;
--
drivers/infiniband/hw/ionic/ionic_ibdev.c=22=static int ionic_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/ionic/ionic_ibdev.c-43-		IB_DEVICE_MEM_WINDOW |
drivers/infiniband/hw/ionic/ionic_ibdev.c:44:		IB_DEVICE_MEM_MGT_EXTENSIONS |
drivers/infiniband/hw/ionic/ionic_ibdev.c-45-		IB_DEVICE_MEM_WINDOW_TYPE_2B |
--
drivers/infiniband/hw/irdma/verbs.c=11=static int irdma_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/irdma/verbs.c-28-	props->device_cap_flags = IB_DEVICE_MEM_WINDOW |
drivers/infiniband/hw/irdma/verbs.c:29:				  IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/irdma/verbs.c-30-	if (hw_attrs->uk_attrs.hw_rev < IRDMA_GEN_3)
--
drivers/infiniband/hw/mlx4/main.c=435=static int mlx4_ib_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/mlx4/main.c-507-	    (dev->dev->caps.bmme_flags & MLX4_BMME_FLAG_FAST_REG_WR))
drivers/infiniband/hw/mlx4/main.c:508:		props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/mlx4/main.c-509-	if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_XRC)
--
drivers/infiniband/hw/mlx5/main.c=936=static int mlx5_ib_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/mlx5/main.c-998-	if (!MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled))
drivers/infiniband/hw/mlx5/main.c:999:		props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/mlx5/main.c-1000-	if (MLX5_CAP_GEN(mdev, sho)) {
--
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c=67=int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
--
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c-92-					IB_DEVICE_SYS_IMAGE_GUID |
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c:93:					IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c-94-	attr->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
--
drivers/infiniband/hw/qedr/verbs.c=111=int qedr_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/qedr/verbs.c-136-	    IB_DEVICE_RC_RNR_NAK_GEN |
drivers/infiniband/hw/qedr/verbs.c:137:	    IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/qedr/verbs.c-138-	attr->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
--
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c=65=int pvrdma_query_device(struct ib_device *ibdev,
--
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c-107-	    (dev->dsr->caps.bmme_flags & PVRDMA_BMME_FLAG_FAST_REG_WR)) {
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c:108:		props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c-109-		props->max_fast_reg_page_list_len = PVRDMA_GET_CAP(dev,
--
drivers/infiniband/sw/rxe/rxe_param.h=39=enum rxe_device_param {
--
drivers/infiniband/sw/rxe/rxe_param.h-51-					| IB_DEVICE_SRQ_RESIZE
drivers/infiniband/sw/rxe/rxe_param.h:52:					| IB_DEVICE_MEM_MGT_EXTENSIONS
drivers/infiniband/sw/rxe/rxe_param.h-53-					| IB_DEVICE_MEM_WINDOW
--
drivers/infiniband/sw/siw/siw_verbs.c=129=int siw_query_device(struct ib_device *base_dev, struct ib_device_attr *attr,
--
drivers/infiniband/sw/siw/siw_verbs.c-140-	attr->atomic_cap = 0;
drivers/infiniband/sw/siw/siw_verbs.c:141:	attr->device_cap_flags = IB_DEVICE_MEM_MGT_EXTENSIONS;
drivers/infiniband/sw/siw/siw_verbs.c-142-	attr->kernel_cap_flags = IBK_ALLOW_USER_UNREG;
--
drivers/infiniband/ulp/iser/iser_verbs.c=61=static int iser_create_device_ib_res(struct iser_device *device)
--
drivers/infiniband/ulp/iser/iser_verbs.c-64-
drivers/infiniband/ulp/iser/iser_verbs.c:65:	if (!(ib_dev->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS)) {
drivers/infiniband/ulp/iser/iser_verbs.c-66-		iser_err("IB device does not support memory registrations\n");
--
drivers/infiniband/ulp/isert/ib_isert.c=380=isert_set_nego_params(struct isert_conn *isert_conn,
--
drivers/infiniband/ulp/isert/ib_isert.c-398-					  (attr->device_cap_flags &
drivers/infiniband/ulp/isert/ib_isert.c:399:					   IB_DEVICE_MEM_MGT_EXTENSIONS);
drivers/infiniband/ulp/isert/ib_isert.c-400-		if (isert_conn->snd_w_inv)
--
drivers/infiniband/ulp/rtrs/rtrs-clt.c=3154=static int rtrs_clt_ib_dev_init(struct rtrs_ib_dev *dev)
--
drivers/infiniband/ulp/rtrs/rtrs-clt.c-3160-	if (!(dev->ib_dev->attrs.device_cap_flags &
drivers/infiniband/ulp/rtrs/rtrs-clt.c:3161:	      IB_DEVICE_MEM_MGT_EXTENSIONS)) {
drivers/infiniband/ulp/rtrs/rtrs-clt.c-3162-		pr_err("Memory registrations not supported.\n");
--
drivers/infiniband/ulp/srp/ib_srp.c=4001=static int srp_add_one(struct ib_device *device)
--
drivers/infiniband/ulp/srp/ib_srp.c-4031-	srp_dev->has_fr = (attr->device_cap_flags &
drivers/infiniband/ulp/srp/ib_srp.c:4032:			   IB_DEVICE_MEM_MGT_EXTENSIONS);
drivers/infiniband/ulp/srp/ib_srp.c-4033-	if (!never_register && !srp_dev->has_fr)
--
drivers/nvme/host/rdma.c=367=nvme_rdma_find_get_device(struct rdma_cm_id *cm_id)
--
drivers/nvme/host/rdma.c-390-	if (!(ndev->dev->attrs.device_cap_flags &
drivers/nvme/host/rdma.c:391:	      IB_DEVICE_MEM_MGT_EXTENSIONS)) {
drivers/nvme/host/rdma.c-392-		dev_err(&ndev->dev->dev,
--
fs/smb/client/smbdirect.c=898=static bool frwr_is_supported(struct ib_device_attr *attrs)
fs/smb/client/smbdirect.c-899-{
fs/smb/client/smbdirect.c:900:	if (!(attrs->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
fs/smb/client/smbdirect.c-901-		return false;
--
fs/smb/server/transport_rdma.c=2487=static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
fs/smb/server/transport_rdma.c-2488-{
fs/smb/server/transport_rdma.c:2489:	if (!(attrs->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
fs/smb/server/transport_rdma.c-2490-		return false;
--
include/rdma/ib_verbs.h=220=enum ib_device_cap_flags {
--
include/rdma/ib_verbs.h-257-	 */
include/rdma/ib_verbs.h:258:	IB_DEVICE_MEM_MGT_EXTENSIONS = IB_UVERBS_DEVICE_MEM_MGT_EXTENSIONS,
include/rdma/ib_verbs.h-259-	IB_DEVICE_MEM_WINDOW_TYPE_2A = IB_UVERBS_DEVICE_MEM_WINDOW_TYPE_2A,
--
net/rds/ib.c=128=static int rds_ib_add_one(struct ib_device *device)
--
net/rds/ib.c-137-	/* Device must support FRWR */
net/rds/ib.c:138:	if (!(device->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
net/rds/ib.c-139-		return -EOPNOTSUPP;
--
net/sunrpc/xprtrdma/frwr_ops.c=172=int frwr_query_device(struct rpcrdma_ep *ep, const struct ib_device *device)
--
net/sunrpc/xprtrdma/frwr_ops.c-177-
net/sunrpc/xprtrdma/frwr_ops.c:178:	if (!(attrs->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) ||
net/sunrpc/xprtrdma/frwr_ops.c-179-	    attrs->max_fast_reg_page_list_len == 0) {
--
net/sunrpc/xprtrdma/svc_rdma_transport.c=407=static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
--
net/sunrpc/xprtrdma/svc_rdma_transport.c-518-
net/sunrpc/xprtrdma/svc_rdma_transport.c:519:	if (!(dev->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS))
net/sunrpc/xprtrdma/svc_rdma_transport.c-520-		newxprt->sc_snd_w_inv = false;
]

gemini-3.1-pro-preview

							input: 159694
							output: 47
							thoughts: 399
						

**The Critical IB Device Deregistration Sequence**

Okay, so I'm looking at this `rxe_param.h` file, and yes, I see `IB_DEVICE_MEM_MGT_EXTENSIONS` is defined. This means that `rds_ib_add_one` should successfully allocate a Protection Domain (PD), and `rds_ib_remove_one` will correctly queue the `rds_ib_dev_free` work. The code flow then moves through `remove_client_context`, which, crucially, returns immediately after calling `client->remove`, which is what I'd expect. Now, `disable_device` waits for `unreg_completion`, which makes sense.

But wait a second... does `rds_ib_add_one` actually *take* a reference to the `ib_device`? No, it doesn't! So, the `ib_device_put` call in `remove_client_context` *will* drop that reference. Hold on... `disable_device` waits for `unreg_completion`, and `unreg_completion` completes when the `device->refcount` hits zero. And now I see it, the core issue! Because `rds_ib_add_one` *doesn't* increment the `ib_device` reference count, the `device->refcount` will reach zero *before* `rds_ib_dev_free` even gets a chance to run!

This means `__ib_unregister_device` is called, and that in turn calls `ib_dealloc_device`, which triggers `rxe_dealloc`. Now, `rxe_dealloc` will check `WARN_ON(!xa_empty(&pool->xa))`. But, since `rds_ib_dev_free` *hasn't* run yet, the PD is still in the pool. *That* explains the warning perfectly! We're freeing resources that haven't been properly cleaned up.

Okay, is this a security issue? This could be. If `ib_dealloc_device` is called, it frees the `rxe_dev` structure. No, wait, that's not quite right. `ib_dealloc_device` frees the *`ib_device`* structure! I need to double-check that `ib_dealloc_device` call.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:ib_dealloc_device]

map[SourceCode: 684:	/**
 685:	 * ib_dealloc_device - free an IB device struct
 686:	 * @device:structure to free
 687:	 *
 688:	 * Free a structure allocated with ib_alloc_device().
 689:	 */
 690:	void ib_dealloc_device(struct ib_device *device)
 691:	{
 692:		if (device->ops.dealloc_driver)
 693:			device->ops.dealloc_driver(device);
 694:	
 695:		/*
 696:		 * ib_unregister_driver() requires all devices to remain in the xarray
 697:		 * while their ops are callable. The last op we call is dealloc_driver
 698:		 * above.  This is needed to create a fence on op callbacks prior to
 699:		 * allowing the driver module to unload.
 700:		 */
 701:		down_write(&devices_rwsem);
 702:		if (xa_load(&devices, device->index) == device)
 703:			xa_erase(&devices, device->index);
 704:		up_write(&devices_rwsem);
 705:	
 706:		/* Expedite releasing netdev references */
 707:		free_netdevs(device);
 708:	
 709:		WARN_ON(!xa_empty(&device->compat_devs));
 710:		WARN_ON(!xa_empty(&device->client_data));
 711:		WARN_ON(refcount_read(&device->refcount));
 712:		rdma_restrack_clean(device);
 713:		/* Balances with device_initialize */
 714:		put_device(&device->dev);
 715:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 161169
							output: 46
							thoughts: 455
						

**Use-After-Free Vulnerability in RDMA Device Handling**

Okay, hold on a second. This is concerning. I'm looking at this code and something doesn't sit right. `put_device(&device->dev)`... that's freeing the underlying `ib_device` structure, isn't it? But, if I'm understanding this correctly, `rds_ib_dev_free` is going to run later. And *that* function... yes, there it is... calls `ib_dealloc_pd(rds_ibdev->pd)`.  `ib_dealloc_pd`, if I recall, accesses `pd->device->ops.dealloc_pd(pd, udata)`. That's where things get really bad because `pd->device` is, in fact, the `ib_device`. And that's already been freed!

This screams "use-after-free."  Let me double-check `rds_ib_dev_free` one more time... yes, if `rds_ibdev->pd` isn't NULL, we're going straight into that call to `ib_dealloc_pd`.  And *that* function, as expected, accesses `pd->device`.  This `pd->device` member is, as I suspected, the `ib_device`, which was itself freed by `ib_dealloc_device` which called `put_device`.

Wait... is my understanding of `put_device` correct? Does it *actually* free the memory? Okay, let's trace this back. The `ib_device` is allocated using something like `_ib_alloc_device`.  That in turn, initializes the device using `device_initialize(&device->dev)`. When the refcount drops to zero, `ib_device_release` is invoked.

Alright, I need to investigate how `put_device` is called in relation to this free path. This is a clear race condition and potential crash/security vulnerability, assuming a malicious user could trigger the subsequent free. This needs further examination.

map[ContextFile:drivers/infiniband/core/device.c IncludeLines:true Name:ib_device_release]

map[SourceCode: 500:	static void ib_device_release(struct device *device)
 501:	{
 502:		struct ib_device *dev = container_of(device, struct ib_device, dev);
 503:	
 504:		free_netdevs(dev);
 505:		WARN_ON(refcount_read(&dev->refcount));
 506:		if (dev->hw_stats_data)
 507:			ib_device_release_hw_stats(dev->hw_stats_data);
 508:		if (dev->port_data) {
 509:			ib_cache_release_one(dev);
 510:			ib_security_release_port_pkey_list(dev);
 511:			rdma_counter_release(dev);
 512:			kfree_rcu(container_of(dev->port_data, struct ib_port_data_rcu,
 513:					       pdata[0]),
 514:				  rcu_head);
 515:		}
 516:	
 517:		mutex_destroy(&dev->subdev_lock);
 518:		mutex_destroy(&dev->unregistration_lock);
 519:		mutex_destroy(&dev->compat_devs_mutex);
 520:	
 521:		xa_destroy(&dev->compat_devs);
 522:		xa_destroy(&dev->client_data);
 523:		kfree_rcu(dev, rcu_head);
 524:	}
 SourceFile:drivers/infiniband/core/device.c]

gemini-3.1-pro-preview

							input: 162560
							output: 53
							thoughts: 165
						

**Use-After-Free Vulnerability Investigation**

Okay, so `kfree_rcu(dev, rcu_head)` should absolutely free that device. Which means `rds_ib_dev_free` is definitely going to be trying to access freed memory – classic use-after-free, right? This is starting to look promising.

But hold on, is `rds` even loaded in the reproducer? I don't see anything explicitly loading it. Now, `rds` is an InfiniBand client, so if it _is_ loaded, it would register itself. If it's not loaded, then what else could possibly trigger this warning? Let's rule out `rds` being the culprit.

Let me think… are there other IB clients that might defer their cleanup to a workqueue? `ipoib` comes to mind. Let's dig into `ipoib`, specifically `ipoib_remove_one`, since that sounds like a good place to start looking. I need to check `ipoib_remove_one` to see if it calls any cleanup functions that might be involved. This is going to be it, I think.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_remove_one]

map[SourceCode:2695:	static void ipoib_remove_one(struct ib_device *device, void *client_data)
2696:	{
2697:		struct ipoib_dev_priv *priv, *tmp, *cpriv, *tcpriv;
2698:		struct list_head *dev_list = client_data;
2699:	
2700:		list_for_each_entry_safe(priv, tmp, dev_list, list) {
2701:			LIST_HEAD(head);
2702:			ipoib_parent_unregister_pre(priv->dev);
2703:	
2704:			rtnl_lock();
2705:	
2706:			netdev_lock(priv->dev);
2707:			list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs,
2708:						 list)
2709:				unregister_netdevice_queue(cpriv->dev, &head);
2710:			netdev_unlock(priv->dev);
2711:			unregister_netdevice_queue(priv->dev, &head);
2712:			unregister_netdevice_many(&head);
2713:	
2714:			rtnl_unlock();
2715:		}
2716:	
2717:		kfree(dev_list);
2718:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 163431
							output: 53
							thoughts: 98
						

**My Current Concerns Regarding Network Device Unregistration in IPoIB**

Okay, so I'm digging into the IPoIB driver's unregistration process and a potential race condition is starting to niggle at me. Specifically, I'm focusing on `unregister_netdevice_many`. I know that's a synchronous operation, so that part seems straightforward. However, the `priv_destructor` associated with the device is `ipoib_intf_free`. Now, `ipoib_intf_free` is the critical function here, because I see that it calls `rdma_free_netdev`. The real question is: does `rdma_free_netdev` actually handle the freeing of the protection domain (PD)? I *think* I recall that the PD is allocated during `ipoib_dev_init`. I need to confirm when and where that PD gets freed. It would be a significant issue if it was freed too late, or worse, not at all, leading to resource leaks. Therefore, I need to check `ipoib_dev_cleanup` to get a definitive answer on the PD's lifecycle and ensure that it is managed correctly during unregistration.

requested entity does not exist

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_dev_cleanup]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 163854
							output: 54
							thoughts: 13
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**IPOIB Device Initialization Review**

Alright, time to get down to brass tacks. I need to make sure this `ipoib_dev_uninit` function is behaving as expected. Given my experience, I'm thinking about the potential gotchas right away. What's the context? What calls this function? Is it being called at the correct points in the device lifecycle? Are there race conditions I need to worry about, and if so, how can I be certain they are correctly mitigated? This also reminds me of potential problems relating to cleanup after a driver unloads, and what checks have been implemented to handle any errors. I need to look closely at memory management; deallocating resources correctly is absolutely critical, and I need to make sure that pointers are properly handled. The devil is in the details with this kind of low-level code, so I'll need to scrutinize every line. Let's dig in and see if this function is as robust as it needs to be.

requested entity does not exist

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_dev_uninit]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 164173
							output: 54
							thoughts: 13
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Checking `ipoib_ndo_uninit`**

Alright, let's dive right in. My first thought is to zero in on `ipoib_ndo_uninit`. This immediately suggests we're dealing with an uninitialized network device object, specifically within the context of IP-over-InfiniBand (IPoIB). The "ndo" part likely refers to the "net device operations" structure – the low-level interface the kernel uses to interact with the hardware.

My concern here is the potential for a race condition, a use-after-free, or some other memory corruption issue.  An uninitialized `ndo` pointer could lead to the kernel calling invalid function pointers, which would result in a crash, or worse, silently corrupting data, depending on the architecture. I'm already mentally running through the typical culprits: incorrect driver initialization, a missing error check, a premature free, or perhaps a complex interaction between modules during the boot process.  I need to understand *when* and *where* this uninitialization could occur. Are we talking about a device creation or deletion path? Perhaps a hotplug scenario? Or some more subtle interaction?

My immediate next steps involve scrutinizing the relevant driver code for IPoIB, the associated network device initialization routines, and any areas that involve resource management and synchronization around the `ndo` structure.  I'll be looking for potential null pointer dereferences, uninitialized memory accesses, and race conditions, paying particular attention to error paths and interrupt handlers. I'll need to confirm that `ipoib_ndo_uninit` is the correct variable to examine, and that no other variables share this characteristic. After reviewing the current code, I can look to reproduce the issue, through debugging, or perhaps by writing a test case to isolate the problem.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_main.c IncludeLines:true Name:ipoib_ndo_uninit]

map[SourceCode:2071:	static void ipoib_ndo_uninit(struct net_device *dev)
2072:	{
2073:		struct ipoib_dev_priv *priv = ipoib_priv(dev);
2074:	
2075:		/*
2076:		 * ipoib_remove_one guarantees the children are removed before the
2077:		 * parent, and that is the only place where a parent can be removed.
2078:		 */
2079:		WARN_ON(!list_empty(&priv->child_intfs));
2080:	
2081:		if (priv->parent) {
2082:			struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
2083:	
2084:			netdev_lock(ppriv->dev);
2085:			list_del(&priv->list);
2086:			netdev_unlock(ppriv->dev);
2087:		}
2088:	
2089:		ipoib_neigh_hash_uninit(dev);
2090:	
2091:		ipoib_ib_dev_cleanup(dev);
2092:	
2093:		/* no more works over the priv->wq */
2094:		if (priv->wq) {
2095:			/* See ipoib_mcast_carrier_on_task() */
2096:			WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags));
2097:			destroy_workqueue(priv->wq);
2098:			priv->wq = NULL;
2099:		}
2100:	
2101:		dev_put(priv->parent);
2102:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_main.c]

gemini-3.1-pro-preview

							input: 165147
							output: 55
							thoughts: 22
						

Here's a summary of my immediate thought process, delivered as requested:

**Deconstructing That Function Call**

Hold on a second... I'm tracing through this `ipoib_ib_dev_cleanup` routine, and I see it calling `ib_dealloc_pd`.  *That's* interesting. It feels slightly odd to me, in the context of what I'm looking at. I thought that function was for dealing with protection domains. I need to refresh my memory and check what that specific function does in the larger framework. Is this an instance where this routine handles cleanup of the protection domain? This smells like a subtle link I need to understand better. Is that the only call to this function in this module, or does it call it multiple times? I'm going to follow the call to `ib_dealloc_pd` and make sure it's doing what I think it is and that the relationship makes sense.

map[ContextFile:drivers/infiniband/ulp/ipoib/ipoib_ib.c IncludeLines:true Name:ipoib_ib_dev_cleanup]

map[SourceCode:1325:	void ipoib_ib_dev_cleanup(struct net_device *dev)
1326:	{
1327:		struct ipoib_dev_priv *priv = ipoib_priv(dev);
1328:	
1329:		ipoib_dbg(priv, "cleaning up ib_dev\n");
1330:		/*
1331:		 * We must make sure there are no more (path) completions
1332:		 * that may wish to touch priv fields that are no longer valid
1333:		 */
1334:		ipoib_flush_paths(dev);
1335:	
1336:		ipoib_mcast_stop_thread(dev);
1337:		ipoib_mcast_dev_flush(dev);
1338:	
1339:		/*
1340:		 * All of our ah references aren't free until after
1341:		 * ipoib_mcast_dev_flush(), ipoib_flush_paths, and
1342:		 * the neighbor garbage collection is stopped and reaped.
1343:		 * That should all be done now, so make a final ah flush.
1344:		 */
1345:		ipoib_reap_dead_ahs(priv);
1346:	
1347:		clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
1348:	
1349:		priv->rn_ops->ndo_uninit(dev);
1350:	
1351:		if (priv->pd) {
1352:			ib_dealloc_pd(priv->pd);
1353:			priv->pd = NULL;
1354:		}
1355:	}
 SourceFile:drivers/infiniband/ulp/ipoib/ipoib_ib.c]

gemini-3.1-pro-preview

							input: 165925
							output: 49
							thoughts: 87
						

Okay, let me break this down.

**RDMA Resource Deallocation: Clarification Needed**

Right, so I'm trying to trace the lifecycle here, specifically around RDMA resource deallocation. I see a direct call to `ib_dealloc_pd`, that's a key part. Then I'm also noting that `ipoib_ndo_uninit` gets called as part of `unregister_netdevice_many`. Hmm... that's interesting. The critical thing here is that `unregister_netdevice_many` is synchronous, right? And `ndo_uninit` is called synchronously. That means the `ipoib` driver *isn't* deferring the PD deallocation; it's happening right there, in the unregistration path. The context makes this a definitive statement.

Now, my mind starts to wander. What about `nvme_rdma_remove_one`? I should examine that code path next to ensure I have all the bases covered.

map[ContextFile:drivers/nvme/host/rdma.c IncludeLines:true Name:nvme_rdma_remove_one]

map[SourceCode:2363:	static void nvme_rdma_remove_one(struct ib_device *ib_device, void *client_data)
2364:	{
2365:		struct nvme_rdma_ctrl *ctrl;
2366:		struct nvme_rdma_device *ndev;
2367:		bool found = false;
2368:	
2369:		mutex_lock(&device_list_mutex);
2370:		list_for_each_entry(ndev, &device_list, entry) {
2371:			if (ndev->dev == ib_device) {
2372:				found = true;
2373:				break;
2374:			}
2375:		}
2376:		mutex_unlock(&device_list_mutex);
2377:	
2378:		if (!found)
2379:			return;
2380:	
2381:		/* Delete all controllers using this device */
2382:		mutex_lock(&nvme_rdma_ctrl_mutex);
2383:		list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) {
2384:			if (ctrl->device->dev != ib_device)
2385:				continue;
2386:			nvme_delete_ctrl(&ctrl->ctrl);
2387:		}
2388:		mutex_unlock(&nvme_rdma_ctrl_mutex);
2389:	
2390:		flush_workqueue(nvme_delete_wq);
2391:	}
 SourceFile:drivers/nvme/host/rdma.c]

gemini-3.1-pro-preview

							input: 166728
							output: 49
							thoughts: 100
						

**Analyzing NVMe-RDMA Controller Removal**

Okay, let me break this down. My initial thought is about the removal process for NVMe-RDMA controllers. Specifically, I'm focusing on the interaction between different functions. I see `nvme_rdma_remove_one` calls `flush_workqueue(nvme_delete_wq)`. This triggers a chain of events that I need to be sure I understand.

My next question is whether `nvme_delete_ctrl` handles the Peripheral Device (PD) freeing. The code flow is interesting because `nvme_delete_ctrl` queues a work item to `nvme_delete_wq`. But then `flush_workqueue` makes sure all those items get processed.

Ah, so it's synchronous. `flush_workqueue` ensures that the work item enqueued by `nvme_delete_ctrl` has completed before `nvme_rdma_remove_one` returns. That's good to know. The implication here is that we're ensuring a clean shutdown of the controller.

Now, my mind shifts. I need to know: what's the equivalent process for `nvmet_rdma_remove_one`? Is there a similar synchronization mechanism in the target-side removal, or is it handled differently? I need to analyze `nvmet_rdma_remove_one` in detail next to compare the behavior of both.

map[ContextFile:drivers/nvme/target/rdma.c IncludeLines:true Name:nvmet_rdma_remove_one]

map[SourceCode:2056:	static void nvmet_rdma_remove_one(struct ib_device *ib_device, void *client_data)
2057:	{
2058:		struct nvmet_rdma_queue *queue, *tmp;
2059:		struct nvmet_rdma_device *ndev;
2060:		bool found = false;
2061:	
2062:		mutex_lock(&device_list_mutex);
2063:		list_for_each_entry(ndev, &device_list, entry) {
2064:			if (ndev->device == ib_device) {
2065:				found = true;
2066:				break;
2067:			}
2068:		}
2069:		mutex_unlock(&device_list_mutex);
2070:	
2071:		if (!found)
2072:			return;
2073:	
2074:		/*
2075:		 * IB Device that is used by nvmet controllers is being removed,
2076:		 * delete all queues using this device.
2077:		 */
2078:		mutex_lock(&nvmet_rdma_queue_mutex);
2079:		list_for_each_entry_safe(queue, tmp, &nvmet_rdma_queue_list,
2080:					 queue_list) {
2081:			if (queue->dev->device != ib_device)
2082:				continue;
2083:	
2084:			pr_info("Removing queue %d\n", queue->idx);
2085:			list_del_init(&queue->queue_list);
2086:			__nvmet_rdma_queue_disconnect(queue);
2087:		}
2088:		mutex_unlock(&nvmet_rdma_queue_mutex);
2089:	
2090:		flush_workqueue(nvmet_wq);
2091:	}
 SourceFile:drivers/nvme/target/rdma.c]

gemini-3.1-pro-preview

							input: 167738
							output: 53
							thoughts: 20
						

Okay, here's my summary, taking on the persona you requested:

**Assessing Queue Management & Object Removal**

Alright, so I'm thinking about this code, and it's clear that it also takes care of flushing the workqueue. That's good, important for ensuring everything is cleaned up properly.

But now my mind immediately jumps to `srp_remove_one`. That's a critical point to consider. I need to be sure the removal process is consistent and handles all the edge cases there too. I have to think about how that relates to this flushing operation and if there are any potential race conditions or synchronization issues I need to be aware of. The interrelationship here is probably the crux of the logic.

map[ContextFile:drivers/infiniband/ulp/srp/ib_srp.c IncludeLines:true Name:srp_remove_one]

map[SourceCode:4080:	static void srp_remove_one(struct ib_device *device, void *client_data)
4081:	{
4082:		struct srp_device *srp_dev;
4083:		struct srp_host *host, *tmp_host;
4084:		struct srp_target_port *target;
4085:	
4086:		srp_dev = client_data;
4087:	
4088:		list_for_each_entry_safe(host, tmp_host, &srp_dev->dev_list, list) {
4089:			/*
4090:			 * Remove the add_target sysfs entry so that no new target ports
4091:			 * can be created.
4092:			 */
4093:			device_del(&host->dev);
4094:	
4095:			/*
4096:			 * Remove all target ports.
4097:			 */
4098:			spin_lock(&host->target_lock);
4099:			list_for_each_entry(target, &host->target_list, list)
4100:				srp_queue_remove_work(target);
4101:			spin_unlock(&host->target_lock);
4102:	
4103:			/*
4104:			 * srp_queue_remove_work() queues a call to
4105:			 * srp_remove_target(). The latter function cancels
4106:			 * target->tl_err_work so waiting for the remove works to
4107:			 * finish is sufficient.
4108:			 */
4109:			flush_workqueue(srp_remove_wq);
4110:	
4111:			put_device(&host->dev);
4112:		}
4113:	
4114:		ib_dealloc_pd(srp_dev->pd);
4115:	
4116:		kfree(srp_dev);
4117:	}
 SourceFile:drivers/infiniband/ulp/srp/ib_srp.c]

gemini-3.1-pro-preview

							input: 168547
							output: 53
							thoughts: 24
						

Here's my attempt at summarizing those thoughts, tailored for an expert audience and written in the first person:

**Memory Deallocation Concerns and SRP-T Considerations**

Okay, so I'm looking at this code, and it's calling `ib_dealloc_pd` *synchronously*. That immediately grabs my attention. We all know the potential performance pitfalls of synchronous memory deallocation in a high-performance networking context. We need to be absolutely sure this isn't going to introduce any unacceptable latency spikes. I need to dig deeper into the contexts where this call is made and see if any mitigation strategies are employed, if any exist.

Then, my mind immediately jumps to `srpt_remove_one`. That's another critical point. I need to quickly determine whether the deallocation of the protection domain is coordinated with the SRP-T removal process. Are there any potential race conditions here? I also need to understand if the calls are synchronized. Failure to correctly synchronize would be... unfortunate, to say the least. This combination could be a nasty source of difficult-to-debug memory corruption or use-after-free scenarios. I better check the locking and synchronization primitives involved very carefully.

requested entity does not exist

map[ContextFile:drivers/infiniband/ulp/srpt/ib_srpt.c IncludeLines:true Name:srpt_remove_one]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 168893
							output: 20
							thoughts: 33
						

Here's my analysis of the provided thought process, tailored for an expert audience:

**Diving into `ib_srpt.c`**

Okay, so the thought process immediately zeroes in on `srpt_remove_one` within `drivers/infiniband/ulp/srpt/ib_srpt.c`. That's smart. That function is a core part of the SRPT (SCSI RDMA Protocol Transport) implementation, and given the name, it's pretty clear it deals with removing an SRPT connection or entry. We're getting right to the heart of how this thing cleans up its state. The path itself points towards InfiniBand, meaning we're dealing with RDMA in the kernel, likely involving data transfers between initiators and targets that use SCSI semantics. My assumption is, this code deals with connection teardown when a SCSI command flow is ending, whether gracefully or abruptly. It could involve the release of resources tied to the specific SRPT session. My first instinct would be to check how it handles various error scenarios and edge cases. I'm keen to see if it frees all associated structures correctly – memory leaks are a huge pain here, and resource management is critical in this context. I'm also interested to see the locking primitives used to protect shared data structures; concurrency issues are par for the course in this environment, so understanding the locking strategy is paramount. Specifically, I’ll need to understand if the function correctly handles cases like connection aborts, target failures, and initiator disconnects.

map[Expression:srpt_remove_one]

map[Output:drivers/infiniband/ulp/srpt/ib_srpt.c=3203=static int srpt_add_one(struct ib_device *device)
--
drivers/infiniband/ulp/srpt/ib_srpt.c-3312-/**
drivers/infiniband/ulp/srpt/ib_srpt.c:3313: * srpt_remove_one - InfiniBand device removal callback function
drivers/infiniband/ulp/srpt/ib_srpt.c-3314- * @device: Describes a HCA.
--
drivers/infiniband/ulp/srpt/ib_srpt.c-3316- */
drivers/infiniband/ulp/srpt/ib_srpt.c:3317:static void srpt_remove_one(struct ib_device *device, void *client_data)
drivers/infiniband/ulp/srpt/ib_srpt.c-3318-{
--
drivers/infiniband/ulp/srpt/ib_srpt.c=3354=static struct ib_client srpt_client = {
--
drivers/infiniband/ulp/srpt/ib_srpt.c-3356-	.add = srpt_add_one,
drivers/infiniband/ulp/srpt/ib_srpt.c:3357:	.remove = srpt_remove_one
drivers/infiniband/ulp/srpt/ib_srpt.c-3358-};
]

gemini-3.1-pro-preview

							input: 169658
							output: 53
							thoughts: 12
						

Okay, let's dive into this. Here's my thought process on this specific task, tailored for an expert audience like yourself:

**Analyzing `srpt_remove_one`**

Alright, the objective is to process a function called `srpt_remove_one`. Let me start by mentally reviewing what I already know about SRP (Single Responsibility Principle) and its implications, as this function's name implies. I'm immediately thinking about how it fits into the broader architecture, what its expected inputs are, and crucially, what specific task it's *supposed* to be responsible for. Is it truly focused on just *one* thing, or am I going to find it's juggling multiple responsibilities? That's the key question. I need to be sure that this function adheres to the SRP because otherwise the code could quickly become bloated and hard to maintain. I'm going to start by looking for any code smells that might indicate violation of that principle.

requested entity does not exist

map[ContextFile:drivers/infiniband/ulp/srpt/ib_srpt.c IncludeLines:true Name:srpt_remove_one]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 169948
							output: 33
							thoughts: 29
						

Okay, here's my interpretation of that thought process, assuming I'm already deep in the weeds of InfiniBand driver development:

**Initial Assessment: Deep Dive into IB Driver Cleanup**

Alright, let me just pause and pinpoint exactly what function is under scrutiny here... Ah, it's `static void srpt_remove_one(struct ib_device *device, void *client_data)`. This likely means I'm in the middle of cleaning up SRPT (SRP Target) related resources. This routine, considering it's `remove_one`, handles the de-registration or cleanup of a specific component when an InfiniBand device is being detached or removed. Understanding this function is critical.

map[File:drivers/infiniband/ulp/srpt/ib_srpt.c]

map[Contents:/*
 * Copyright (c) 2006 - 2009 Mellanox Technology Inc.  All rights reserved.
 * Copyright (C) 2008 - 2011 Bart Van Assche <bvanassche@acm.org>.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
 * General Public License (GPL) Version 2, available from the file
 * COPYING in the main directory of this source tree, or the
 * OpenIB.org BSD license below:
 *
 *     Redistribution and use in source and binary forms, with or
 *     without modification, are permitted provided that the following
 *     conditions are met:
 *
 *      - Redistributions of source code must retain the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer.
 *
 *      - Redistributions in binary form must reproduce the above
 *        copyright notice, this list of conditions and the following
 *        disclaimer in the documentation and/or other materials
 *        provided with the distribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 *
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/err.h>
#include <linux/ctype.h>
#include <linux/kthread.h>
#include <linux/string.h>
#include <linux/delay.h>
#include <linux/atomic.h>
#include <linux/inet.h>
#include <rdma/ib_cache.h>
#include <scsi/scsi_proto.h>
#include <scsi/scsi_tcq.h>
#include <target/target_core_base.h>
#include <target/target_core_fabric.h>
#include "ib_srpt.h"

/* Name of this kernel module. */
#define DRV_NAME		"ib_srpt"

#define SRPT_ID_STRING	"Linux SRP target"

#undef pr_fmt
#define pr_fmt(fmt) DRV_NAME " " fmt

MODULE_AUTHOR("Vu Pham and Bart Van Assche");
MODULE_DESCRIPTION("SCSI RDMA Protocol target driver");
MODULE_LICENSE("Dual BSD/GPL");

/*
 * Global Variables
 */

static u64 srpt_service_guid;
static DEFINE_SPINLOCK(srpt_dev_lock);	/* Protects srpt_dev_list. */
static LIST_HEAD(srpt_dev_list);	/* List of srpt_device structures. */
static DEFINE_MUTEX(srpt_mc_mutex);	/* Protects srpt_memory_caches. */
static DEFINE_XARRAY(srpt_memory_caches); /* See also srpt_memory_cache_entry */

static unsigned srp_max_req_size = DEFAULT_MAX_REQ_SIZE;
module_param(srp_max_req_size, int, 0444);
MODULE_PARM_DESC(srp_max_req_size,
		 "Maximum size of SRP request messages in bytes.");

static int srpt_srq_size = DEFAULT_SRPT_SRQ_SIZE;
module_param(srpt_srq_size, int, 0444);
MODULE_PARM_DESC(srpt_srq_size,
		 "Shared receive queue (SRQ) size.");

static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp)
{
	return kstrtou64(buffer, 16, (u64 *)kp->arg);
}
static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp)
{
	return sprintf(buffer, "0x%016llx\n", *(u64 *)kp->arg);
}
module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x,
		  &srpt_service_guid, 0444);
MODULE_PARM_DESC(srpt_service_guid,
		 "Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA.");

static struct ib_client srpt_client;
/* Protects both rdma_cm_port and rdma_cm_id. */
static DEFINE_MUTEX(rdma_cm_mutex);
/* Port number RDMA/CM will bind to. */
static u16 rdma_cm_port;
static struct rdma_cm_id *rdma_cm_id;
static void srpt_release_cmd(struct se_cmd *se_cmd);
static void srpt_free_ch(struct kref *kref);
static int srpt_queue_status(struct se_cmd *cmd);
static void srpt_recv_done(struct ib_cq *cq, struct ib_wc *wc);
static void srpt_send_done(struct ib_cq *cq, struct ib_wc *wc);
static void srpt_process_wait_list(struct srpt_rdma_ch *ch);

/* Type of the entries in srpt_memory_caches. */
struct srpt_memory_cache_entry {
	refcount_t ref;
	struct kmem_cache *c;
};

static struct kmem_cache *srpt_cache_get(unsigned int object_size)
{
	struct srpt_memory_cache_entry *e;
	char name[32];
	void *res;

	guard(mutex)(&srpt_mc_mutex);
	e = xa_load(&srpt_memory_caches, object_size);
	if (e) {
		refcount_inc(&e->ref);
		return e->c;
	}
	snprintf(name, sizeof(name), "srpt-%u", object_size);
	e = kmalloc(sizeof(*e), GFP_KERNEL);
	if (!e)
		return NULL;
	refcount_set(&e->ref, 1);
	e->c = kmem_cache_create(name, object_size, /*align=*/512, 0, NULL);
	if (!e->c)
		goto free_entry;
	res = xa_store(&srpt_memory_caches, object_size, e, GFP_KERNEL);
	if (xa_is_err(res))
		goto destroy_cache;
	return e->c;

destroy_cache:
	kmem_cache_destroy(e->c);

free_entry:
	kfree(e);
	return NULL;
}

static void srpt_cache_put(struct kmem_cache *c)
{
	struct srpt_memory_cache_entry *e = NULL;
	unsigned long object_size;

	guard(mutex)(&srpt_mc_mutex);
	xa_for_each(&srpt_memory_caches, object_size, e)
		if (e->c == c)
			break;
	if (WARN_ON_ONCE(!e))
		return;
	if (!refcount_dec_and_test(&e->ref))
		return;
	WARN_ON_ONCE(xa_erase(&srpt_memory_caches, object_size) != e);
	kmem_cache_destroy(e->c);
	kfree(e);
}

/*
 * The only allowed channel state changes are those that change the channel
 * state into a state with a higher numerical value. Hence the new > prev test.
 */
static bool srpt_set_ch_state(struct srpt_rdma_ch *ch, enum rdma_ch_state new)
{
	unsigned long flags;
	enum rdma_ch_state prev;
	bool changed = false;

	spin_lock_irqsave(&ch->spinlock, flags);
	prev = ch->state;
	if (new > prev) {
		ch->state = new;
		changed = true;
	}
	spin_unlock_irqrestore(&ch->spinlock, flags);

	return changed;
}

/**
 * srpt_event_handler - asynchronous IB event callback function
 * @handler: IB event handler registered by ib_register_event_handler().
 * @event: Description of the event that occurred.
 *
 * Callback function called by the InfiniBand core when an asynchronous IB
 * event occurs. This callback may occur in interrupt context. See also
 * section 11.5.2, Set Asynchronous Event Handler in the InfiniBand
 * Architecture Specification.
 */
static void srpt_event_handler(struct ib_event_handler *handler,
			       struct ib_event *event)
{
	struct srpt_device *sdev =
		container_of(handler, struct srpt_device, event_handler);
	struct srpt_port *sport;
	u8 port_num;

	pr_debug("ASYNC event= %d on device= %s\n", event->event,
		 dev_name(&sdev->device->dev));

	switch (event->event) {
	case IB_EVENT_PORT_ERR:
		port_num = event->element.port_num - 1;
		if (port_num < sdev->device->phys_port_cnt) {
			sport = &sdev->port[port_num];
			sport->lid = 0;
			sport->sm_lid = 0;
		} else {
			WARN(true, "event %d: port_num %d out of range 1..%d\n",
			     event->event, port_num + 1,
			     sdev->device->phys_port_cnt);
		}
		break;
	case IB_EVENT_PORT_ACTIVE:
	case IB_EVENT_LID_CHANGE:
	case IB_EVENT_PKEY_CHANGE:
	case IB_EVENT_SM_CHANGE:
	case IB_EVENT_CLIENT_REREGISTER:
	case IB_EVENT_GID_CHANGE:
		/* Refresh port data asynchronously. */
		port_num = event->element.port_num - 1;
		if (port_num < sdev->device->phys_port_cnt) {
			sport = &sdev->port[port_num];
			if (!sport->lid && !sport->sm_lid)
				schedule_work(&sport->work);
		} else {
			WARN(true, "event %d: port_num %d out of range 1..%d\n",
			     event->event, port_num + 1,
			     sdev->device->phys_port_cnt);
		}
		break;
	default:
		pr_err("received unrecognized IB event %d\n", event->event);
		break;
	}
}

/**
 * srpt_srq_event - SRQ event callback function
 * @event: Description of the event that occurred.
 * @ctx: Context pointer specified at SRQ creation time.
 */
static void srpt_srq_event(struct ib_event *event, void *ctx)
{
	pr_debug("SRQ event %d\n", event->event);
}

static const char *get_ch_state_name(enum rdma_ch_state s)
{
	switch (s) {
	case CH_CONNECTING:
		return "connecting";
	case CH_LIVE:
		return "live";
	case CH_DISCONNECTING:
		return "disconnecting";
	case CH_DRAINING:
		return "draining";
	case CH_DISCONNECTED:
		return "disconnected";
	}
	return "???";
}

/**
 * srpt_qp_event - QP event callback function
 * @event: Description of the event that occurred.
 * @ptr: SRPT RDMA channel.
 */
static void srpt_qp_event(struct ib_event *event, void *ptr)
{
	struct srpt_rdma_ch *ch = ptr;

	pr_debug("QP event %d on ch=%p sess_name=%s-%d state=%s\n",
		 event->event, ch, ch->sess_name, ch->qp->qp_num,
		 get_ch_state_name(ch->state));

	switch (event->event) {
	case IB_EVENT_COMM_EST:
		if (ch->using_rdma_cm)
			rdma_notify(ch->rdma_cm.cm_id, event->event);
		else
			ib_cm_notify(ch->ib_cm.cm_id, event->event);
		break;
	case IB_EVENT_QP_LAST_WQE_REACHED:
		pr_debug("%s-%d, state %s: received Last WQE event.\n",
			 ch->sess_name, ch->qp->qp_num,
			 get_ch_state_name(ch->state));
		break;
	default:
		pr_err("received unrecognized IB QP event %d\n", event->event);
		break;
	}
}

/**
 * srpt_set_ioc - initialize a IOUnitInfo structure
 * @c_list: controller list.
 * @slot: one-based slot number.
 * @value: four-bit value.
 *
 * Copies the lowest four bits of value in element slot of the array of four
 * bit elements called c_list (controller list). The index slot is one-based.
 */
static void srpt_set_ioc(u8 *c_list, u32 slot, u8 value)
{
	u16 id;
	u8 tmp;

	id = (slot - 1) / 2;
	if (slot & 0x1) {
		tmp = c_list[id] & 0xf;
		c_list[id] = (value << 4) | tmp;
	} else {
		tmp = c_list[id] & 0xf0;
		c_list[id] = (value & 0xf) | tmp;
	}
}

/**
 * srpt_get_class_port_info - copy ClassPortInfo to a management datagram
 * @mad: Datagram that will be sent as response to DM_ATTR_CLASS_PORT_INFO.
 *
 * See also section 16.3.3.1 ClassPortInfo in the InfiniBand Architecture
 * Specification.
 */
static void srpt_get_class_port_info(struct ib_dm_mad *mad)
{
	struct ib_class_port_info *cif;

	cif = (struct ib_class_port_info *)mad->data;
	memset(cif, 0, sizeof(*cif));
	cif->base_version = 1;
	cif->class_version = 1;

	ib_set_cpi_resp_time(cif, 20);
	mad->mad_hdr.status = 0;
}

/**
 * srpt_get_iou - write IOUnitInfo to a management datagram
 * @mad: Datagram that will be sent as response to DM_ATTR_IOU_INFO.
 *
 * See also section 16.3.3.3 IOUnitInfo in the InfiniBand Architecture
 * Specification. See also section B.7, table B.6 in the SRP r16a document.
 */
static void srpt_get_iou(struct ib_dm_mad *mad)
{
	struct ib_dm_iou_info *ioui;
	u8 slot;
	int i;

	ioui = (struct ib_dm_iou_info *)mad->data;
	ioui->change_id = cpu_to_be16(1);
	ioui->max_controllers = 16;

	/* set present for slot 1 and empty for the rest */
	srpt_set_ioc(ioui->controller_list, 1, 1);
	for (i = 1, slot = 2; i < 16; i++, slot++)
		srpt_set_ioc(ioui->controller_list, slot, 0);

	mad->mad_hdr.status = 0;
}

/**
 * srpt_get_ioc - write IOControllerprofile to a management datagram
 * @sport: HCA port through which the MAD has been received.
 * @slot: Slot number specified in DM_ATTR_IOC_PROFILE query.
 * @mad: Datagram that will be sent as response to DM_ATTR_IOC_PROFILE.
 *
 * See also section 16.3.3.4 IOControllerProfile in the InfiniBand
 * Architecture Specification. See also section B.7, table B.7 in the SRP
 * r16a document.
 */
static void srpt_get_ioc(struct srpt_port *sport, u32 slot,
			 struct ib_dm_mad *mad)
{
	struct srpt_device *sdev = sport->sdev;
	struct ib_dm_ioc_profile *iocp;
	int send_queue_depth;

	iocp = (struct ib_dm_ioc_profile *)mad->data;

	if (!slot || slot > 16) {
		mad->mad_hdr.status
			= cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
		return;
	}

	if (slot > 2) {
		mad->mad_hdr.status
			= cpu_to_be16(DM_MAD_STATUS_NO_IOC);
		return;
	}

	if (sdev->use_srq)
		send_queue_depth = sdev->srq_size;
	else
		send_queue_depth = min(MAX_SRPT_RQ_SIZE,
				       sdev->device->attrs.max_qp_wr);

	memset(iocp, 0, sizeof(*iocp));
	strcpy(iocp->id_string, SRPT_ID_STRING);
	iocp->guid = cpu_to_be64(srpt_service_guid);
	iocp->vendor_id = cpu_to_be32(sdev->device->attrs.vendor_id);
	iocp->device_id = cpu_to_be32(sdev->device->attrs.vendor_part_id);
	iocp->device_version = cpu_to_be16(sdev->device->attrs.hw_ver);
	iocp->subsys_vendor_id = cpu_to_be32(sdev->device->attrs.vendor_id);
	iocp->subsys_device_id = 0x0;
	iocp->io_class = cpu_to_be16(SRP_REV16A_IB_IO_CLASS);
	iocp->io_subclass = cpu_to_be16(SRP_IO_SUBCLASS);
	iocp->protocol = cpu_to_be16(SRP_PROTOCOL);
	iocp->protocol_version = cpu_to_be16(SRP_PROTOCOL_VERSION);
	iocp->send_queue_depth = cpu_to_be16(send_queue_depth);
	iocp->rdma_read_depth = 4;
	iocp->send_size = cpu_to_be32(srp_max_req_size);
	iocp->rdma_size = cpu_to_be32(min(sport->port_attrib.srp_max_rdma_size,
					  1U << 24));
	iocp->num_svc_entries = 1;
	iocp->op_cap_mask = SRP_SEND_TO_IOC | SRP_SEND_FROM_IOC |
		SRP_RDMA_READ_FROM_IOC | SRP_RDMA_WRITE_FROM_IOC;

	mad->mad_hdr.status = 0;
}

/**
 * srpt_get_svc_entries - write ServiceEntries to a management datagram
 * @ioc_guid: I/O controller GUID to use in reply.
 * @slot: I/O controller number.
 * @hi: End of the range of service entries to be specified in the reply.
 * @lo: Start of the range of service entries to be specified in the reply..
 * @mad: Datagram that will be sent as response to DM_ATTR_SVC_ENTRIES.
 *
 * See also section 16.3.3.5 ServiceEntries in the InfiniBand Architecture
 * Specification. See also section B.7, table B.8 in the SRP r16a document.
 */
static void srpt_get_svc_entries(u64 ioc_guid,
				 u16 slot, u8 hi, u8 lo, struct ib_dm_mad *mad)
{
	struct ib_dm_svc_entries *svc_entries;

	WARN_ON(!ioc_guid);

	if (!slot || slot > 16) {
		mad->mad_hdr.status
			= cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
		return;
	}

	if (slot > 2 || lo > hi || hi > 1) {
		mad->mad_hdr.status
			= cpu_to_be16(DM_MAD_STATUS_NO_IOC);
		return;
	}

	svc_entries = (struct ib_dm_svc_entries *)mad->data;
	memset(svc_entries, 0, sizeof(*svc_entries));
	svc_entries->service_entries[0].id = cpu_to_be64(ioc_guid);
	snprintf(svc_entries->service_entries[0].name,
		 sizeof(svc_entries->service_entries[0].name),
		 "%s%016llx",
		 SRP_SERVICE_NAME_PREFIX,
		 ioc_guid);

	mad->mad_hdr.status = 0;
}

/**
 * srpt_mgmt_method_get - process a received management datagram
 * @sp:      HCA port through which the MAD has been received.
 * @rq_mad:  received MAD.
 * @rsp_mad: response MAD.
 */
static void srpt_mgmt_method_get(struct srpt_port *sp, struct ib_mad *rq_mad,
				 struct ib_dm_mad *rsp_mad)
{
	u16 attr_id;
	u32 slot;
	u8 hi, lo;

	attr_id = be16_to_cpu(rq_mad->mad_hdr.attr_id);
	switch (attr_id) {
	case DM_ATTR_CLASS_PORT_INFO:
		srpt_get_class_port_info(rsp_mad);
		break;
	case DM_ATTR_IOU_INFO:
		srpt_get_iou(rsp_mad);
		break;
	case DM_ATTR_IOC_PROFILE:
		slot = be32_to_cpu(rq_mad->mad_hdr.attr_mod);
		srpt_get_ioc(sp, slot, rsp_mad);
		break;
	case DM_ATTR_SVC_ENTRIES:
		slot = be32_to_cpu(rq_mad->mad_hdr.attr_mod);
		hi = (u8) ((slot >> 8) & 0xff);
		lo = (u8) (slot & 0xff);
		slot = (u16) ((slot >> 16) & 0xffff);
		srpt_get_svc_entries(srpt_service_guid,
				     slot, hi, lo, rsp_mad);
		break;
	default:
		rsp_mad->mad_hdr.status =
		    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
		break;
	}
}

/**
 * srpt_mad_send_handler - MAD send completion callback
 * @mad_agent: Return value of ib_register_mad_agent().
 * @mad_wc: Work completion reporting that the MAD has been sent.
 */
static void srpt_mad_send_handler(struct ib_mad_agent *mad_agent,
				  struct ib_mad_send_wc *mad_wc)
{
	rdma_destroy_ah(mad_wc->send_buf->ah, RDMA_DESTROY_AH_SLEEPABLE);
	ib_free_send_mad(mad_wc->send_buf);
}

/**
 * srpt_mad_recv_handler - MAD reception callback function
 * @mad_agent: Return value of ib_register_mad_agent().
 * @send_buf: Not used.
 * @mad_wc: Work completion reporting that a MAD has been received.
 */
static void srpt_mad_recv_handler(struct ib_mad_agent *mad_agent,
				  struct ib_mad_send_buf *send_buf,
				  struct ib_mad_recv_wc *mad_wc)
{
	struct srpt_port *sport = (struct srpt_port *)mad_agent->context;
	struct ib_ah *ah;
	struct ib_mad_send_buf *rsp;
	struct ib_dm_mad *dm_mad;

	if (!mad_wc || !mad_wc->recv_buf.mad)
		return;

	ah = ib_create_ah_from_wc(mad_agent->qp->pd, mad_wc->wc,
				  mad_wc->recv_buf.grh, mad_agent->port_num);
	if (IS_ERR(ah))
		goto err;

	BUILD_BUG_ON(offsetof(struct ib_dm_mad, data) != IB_MGMT_DEVICE_HDR);

	rsp = ib_create_send_mad(mad_agent, mad_wc->wc->src_qp,
				 mad_wc->wc->pkey_index, 0,
				 IB_MGMT_DEVICE_HDR, IB_MGMT_DEVICE_DATA,
				 GFP_KERNEL,
				 IB_MGMT_BASE_VERSION);
	if (IS_ERR(rsp))
		goto err_rsp;

	rsp->ah = ah;

	dm_mad = rsp->mad;
	memcpy(dm_mad, mad_wc->recv_buf.mad, sizeof(*dm_mad));
	dm_mad->mad_hdr.method = IB_MGMT_METHOD_GET_RESP;
	dm_mad->mad_hdr.status = 0;

	switch (mad_wc->recv_buf.mad->mad_hdr.method) {
	case IB_MGMT_METHOD_GET:
		srpt_mgmt_method_get(sport, mad_wc->recv_buf.mad, dm_mad);
		break;
	case IB_MGMT_METHOD_SET:
		dm_mad->mad_hdr.status =
		    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
		break;
	default:
		dm_mad->mad_hdr.status =
		    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD);
		break;
	}

	if (!ib_post_send_mad(rsp, NULL)) {
		ib_free_recv_mad(mad_wc);
		/* will destroy_ah & free_send_mad in send completion */
		return;
	}

	ib_free_send_mad(rsp);

err_rsp:
	rdma_destroy_ah(ah, RDMA_DESTROY_AH_SLEEPABLE);
err:
	ib_free_recv_mad(mad_wc);
}

static int srpt_format_guid(char *buf, unsigned int size, const __be64 *guid)
{
	const __be16 *g = (const __be16 *)guid;

	return snprintf(buf, size, "%04x:%04x:%04x:%04x",
			be16_to_cpu(g[0]), be16_to_cpu(g[1]),
			be16_to_cpu(g[2]), be16_to_cpu(g[3]));
}

/**
 * srpt_refresh_port - configure a HCA port
 * @sport: SRPT HCA port.
 *
 * Enable InfiniBand management datagram processing, update the cached sm_lid,
 * lid and gid values, and register a callback function for processing MADs
 * on the specified port.
 *
 * Note: It is safe to call this function more than once for the same port.
 */
static int srpt_refresh_port(struct srpt_port *sport)
{
	struct ib_mad_agent *mad_agent;
	struct ib_mad_reg_req reg_req;
	struct ib_port_modify port_modify;
	struct ib_port_attr port_attr;
	int ret;

	ret = ib_query_port(sport->sdev->device, sport->port, &port_attr);
	if (ret)
		return ret;

	sport->sm_lid = port_attr.sm_lid;
	sport->lid = port_attr.lid;

	ret = rdma_query_gid(sport->sdev->device, sport->port, 0, &sport->gid);
	if (ret)
		return ret;

	srpt_format_guid(sport->guid_name, ARRAY_SIZE(sport->guid_name),
			 &sport->gid.global.interface_id);
	snprintf(sport->gid_name, ARRAY_SIZE(sport->gid_name),
		 "0x%016llx%016llx",
		 be64_to_cpu(sport->gid.global.subnet_prefix),
		 be64_to_cpu(sport->gid.global.interface_id));

	if (rdma_protocol_iwarp(sport->sdev->device, sport->port))
		return 0;

	memset(&port_modify, 0, sizeof(port_modify));
	port_modify.set_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP;
	port_modify.clr_port_cap_mask = 0;

	ret = ib_modify_port(sport->sdev->device, sport->port, 0, &port_modify);
	if (ret) {
		pr_warn("%s-%d: enabling device management failed (%d). Note: this is expected if SR-IOV is enabled.\n",
			dev_name(&sport->sdev->device->dev), sport->port, ret);
		return 0;
	}

	if (!sport->mad_agent) {
		memset(&reg_req, 0, sizeof(reg_req));
		reg_req.mgmt_class = IB_MGMT_CLASS_DEVICE_MGMT;
		reg_req.mgmt_class_version = IB_MGMT_BASE_VERSION;
		set_bit(IB_MGMT_METHOD_GET, reg_req.method_mask);
		set_bit(IB_MGMT_METHOD_SET, reg_req.method_mask);

		mad_agent = ib_register_mad_agent(sport->sdev->device,
						  sport->port,
						  IB_QPT_GSI,
						  &reg_req, 0,
						  srpt_mad_send_handler,
						  srpt_mad_recv_handler,
						  sport, 0);
		if (IS_ERR(mad_agent)) {
			pr_err("%s-%d: MAD agent registration failed (%pe). Note: this is expected if SR-IOV is enabled.\n",
			       dev_name(&sport->sdev->device->dev), sport->port,
			       mad_agent);
			sport->mad_agent = NULL;
			memset(&port_modify, 0, sizeof(port_modify));
			port_modify.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP;
			ib_modify_port(sport->sdev->device, sport->port, 0,
				       &port_modify);
			return 0;
		}

		sport->mad_agent = mad_agent;
	}

	return 0;
}

/**
 * srpt_unregister_mad_agent - unregister MAD callback functions
 * @sdev: SRPT HCA pointer.
 * @port_cnt: number of ports with registered MAD
 *
 * Note: It is safe to call this function more than once for the same device.
 */
static void srpt_unregister_mad_agent(struct srpt_device *sdev, int port_cnt)
{
	struct ib_port_modify port_modify = {
		.clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP,
	};
	struct srpt_port *sport;
	int i;

	for (i = 1; i <= port_cnt; i++) {
		sport = &sdev->port[i - 1];
		WARN_ON(sport->port != i);
		if (sport->mad_agent) {
			ib_modify_port(sdev->device, i, 0, &port_modify);
			ib_unregister_mad_agent(sport->mad_agent);
			sport->mad_agent = NULL;
		}
	}
}

/**
 * srpt_alloc_ioctx - allocate a SRPT I/O context structure
 * @sdev: SRPT HCA pointer.
 * @ioctx_size: I/O context size.
 * @buf_cache: I/O buffer cache.
 * @dir: DMA data direction.
 */
static struct srpt_ioctx *srpt_alloc_ioctx(struct srpt_device *sdev,
					   int ioctx_size,
					   struct kmem_cache *buf_cache,
					   enum dma_data_direction dir)
{
	struct srpt_ioctx *ioctx;

	ioctx = kzalloc(ioctx_size, GFP_KERNEL);
	if (!ioctx)
		goto err;

	ioctx->buf = kmem_cache_alloc(buf_cache, GFP_KERNEL);
	if (!ioctx->buf)
		goto err_free_ioctx;

	ioctx->dma = ib_dma_map_single(sdev->device, ioctx->buf,
				       kmem_cache_size(buf_cache), dir);
	if (ib_dma_mapping_error(sdev->device, ioctx->dma))
		goto err_free_buf;

	return ioctx;

err_free_buf:
	kmem_cache_free(buf_cache, ioctx->buf);
err_free_ioctx:
	kfree(ioctx);
err:
	return NULL;
}

/**
 * srpt_free_ioctx - free a SRPT I/O context structure
 * @sdev: SRPT HCA pointer.
 * @ioctx: I/O context pointer.
 * @buf_cache: I/O buffer cache.
 * @dir: DMA data direction.
 */
static void srpt_free_ioctx(struct srpt_device *sdev, struct srpt_ioctx *ioctx,
			    struct kmem_cache *buf_cache,
			    enum dma_data_direction dir)
{
	if (!ioctx)
		return;

	ib_dma_unmap_single(sdev->device, ioctx->dma,
			    kmem_cache_size(buf_cache), dir);
	kmem_cache_free(buf_cache, ioctx->buf);
	kfree(ioctx);
}

/**
 * srpt_alloc_ioctx_ring - allocate a ring of SRPT I/O context structures
 * @sdev:       Device to allocate the I/O context ring for.
 * @ring_size:  Number of elements in the I/O context ring.
 * @ioctx_size: I/O context size.
 * @buf_cache:  I/O buffer cache.
 * @alignment_offset: Offset in each ring buffer at which the SRP information
 *		unit starts.
 * @dir:        DMA data direction.
 */
static struct srpt_ioctx **srpt_alloc_ioctx_ring(struct srpt_device *sdev,
				int ring_size, int ioctx_size,
				struct kmem_cache *buf_cache,
				int alignment_offset,
				enum dma_data_direction dir)
{
	struct srpt_ioctx **ring;
	int i;

	WARN_ON(ioctx_size != sizeof(struct srpt_recv_ioctx) &&
		ioctx_size != sizeof(struct srpt_send_ioctx));

	ring = kvmalloc_array(ring_size, sizeof(ring[0]), GFP_KERNEL);
	if (!ring)
		goto out;
	for (i = 0; i < ring_size; ++i) {
		ring[i] = srpt_alloc_ioctx(sdev, ioctx_size, buf_cache, dir);
		if (!ring[i])
			goto err;
		ring[i]->index = i;
		ring[i]->offset = alignment_offset;
	}
	goto out;

err:
	while (--i >= 0)
		srpt_free_ioctx(sdev, ring[i], buf_cache, dir);
	kvfree(ring);
	ring = NULL;
out:
	return ring;
}

/**
 * srpt_free_ioctx_ring - free the ring of SRPT I/O context structures
 * @ioctx_ring: I/O context ring to be freed.
 * @sdev: SRPT HCA pointer.
 * @ring_size: Number of ring elements.
 * @buf_cache: I/O buffer cache.
 * @dir: DMA data direction.
 */
static void srpt_free_ioctx_ring(struct srpt_ioctx **ioctx_ring,
				 struct srpt_device *sdev, int ring_size,
				 struct kmem_cache *buf_cache,
				 enum dma_data_direction dir)
{
	int i;

	if (!ioctx_ring)
		return;

	for (i = 0; i < ring_size; ++i)
		srpt_free_ioctx(sdev, ioctx_ring[i], buf_cache, dir);
	kvfree(ioctx_ring);
}

/**
 * srpt_set_cmd_state - set the state of a SCSI command
 * @ioctx: Send I/O context.
 * @new: New I/O context state.
 *
 * Does not modify the state of aborted commands. Returns the previous command
 * state.
 */
static enum srpt_command_state srpt_set_cmd_state(struct srpt_send_ioctx *ioctx,
						  enum srpt_command_state new)
{
	enum srpt_command_state previous;

	previous = ioctx->state;
	if (previous != SRPT_STATE_DONE)
		ioctx->state = new;

	return previous;
}

/**
 * srpt_test_and_set_cmd_state - test and set the state of a command
 * @ioctx: Send I/O context.
 * @old: Current I/O context state.
 * @new: New I/O context state.
 *
 * Returns true if and only if the previous command state was equal to 'old'.
 */
static bool srpt_test_and_set_cmd_state(struct srpt_send_ioctx *ioctx,
					enum srpt_command_state old,
					enum srpt_command_state new)
{
	enum srpt_command_state previous;

	WARN_ON(!ioctx);
	WARN_ON(old == SRPT_STATE_DONE);
	WARN_ON(new == SRPT_STATE_NEW);

	previous = ioctx->state;
	if (previous == old)
		ioctx->state = new;

	return previous == old;
}

/**
 * srpt_post_recv - post an IB receive request
 * @sdev: SRPT HCA pointer.
 * @ch: SRPT RDMA channel.
 * @ioctx: Receive I/O context pointer.
 */
static int srpt_post_recv(struct srpt_device *sdev, struct srpt_rdma_ch *ch,
			  struct srpt_recv_ioctx *ioctx)
{
	struct ib_sge list;
	struct ib_recv_wr wr;

	BUG_ON(!sdev);
	list.addr = ioctx->ioctx.dma + ioctx->ioctx.offset;
	list.length = srp_max_req_size;
	list.lkey = sdev->lkey;

	ioctx->ioctx.cqe.done = srpt_recv_done;
	wr.wr_cqe = &ioctx->ioctx.cqe;
	wr.next = NULL;
	wr.sg_list = &list;
	wr.num_sge = 1;

	if (sdev->use_srq)
		return ib_post_srq_recv(sdev->srq, &wr, NULL);
	else
		return ib_post_recv(ch->qp, &wr, NULL);
}

/**
 * srpt_zerolength_write - perform a zero-length RDMA write
 * @ch: SRPT RDMA channel.
 *
 * A quote from the InfiniBand specification: C9-88: For an HCA responder
 * using Reliable Connection service, for each zero-length RDMA READ or WRITE
 * request, the R_Key shall not be validated, even if the request includes
 * Immediate data.
 */
static int srpt_zerolength_write(struct srpt_rdma_ch *ch)
{
	struct ib_rdma_wr wr = {
		.wr = {
			.next		= NULL,
			{ .wr_cqe	= &ch->zw_cqe, },
			.opcode		= IB_WR_RDMA_WRITE,
			.send_flags	= IB_SEND_SIGNALED,
		}
	};

	pr_debug("%s-%d: queued zerolength write\n", ch->sess_name,
		 ch->qp->qp_num);

	return ib_post_send(ch->qp, &wr.wr, NULL);
}

static void srpt_zerolength_write_done(struct ib_cq *cq, struct ib_wc *wc)
{
	struct srpt_rdma_ch *ch = wc->qp->qp_context;

	pr_debug("%s-%d wc->status %d\n", ch->sess_name, ch->qp->qp_num,
		 wc->status);

	if (wc->status == IB_WC_SUCCESS) {
		srpt_process_wait_list(ch);
	} else {
		if (srpt_set_ch_state(ch, CH_DISCONNECTED))
			schedule_work(&ch->release_work);
		else
			pr_debug("%s-%d: already disconnected.\n",
				 ch->sess_name, ch->qp->qp_num);
	}
}

static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,
		struct srp_direct_buf *db, int nbufs, struct scatterlist **sg,
		unsigned *sg_cnt)
{
	enum dma_data_direction dir = target_reverse_dma_direction(&ioctx->cmd);
	struct srpt_rdma_ch *ch = ioctx->ch;
	struct scatterlist *prev = NULL;
	unsigned prev_nents;
	int ret, i;

	if (nbufs == 1) {
		ioctx->rw_ctxs = &ioctx->s_rw_ctx;
	} else {
		ioctx->rw_ctxs = kmalloc_array(nbufs, sizeof(*ioctx->rw_ctxs),
			GFP_KERNEL);
		if (!ioctx->rw_ctxs)
			return -ENOMEM;
	}

	for (i = ioctx->n_rw_ctx; i < nbufs; i++, db++) {
		struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];
		u64 remote_addr = be64_to_cpu(db->va);
		u32 size = be32_to_cpu(db->len);
		u32 rkey = be32_to_cpu(db->key);

		ret = target_alloc_sgl(&ctx->sg, &ctx->nents, size, false,
				i < nbufs - 1);
		if (ret)
			goto unwind;

		ret = rdma_rw_ctx_init(&ctx->rw, ch->qp, ch->sport->port,
				ctx->sg, ctx->nents, 0, remote_addr, rkey, dir);
		if (ret < 0) {
			target_free_sgl(ctx->sg, ctx->nents);
			goto unwind;
		}

		ioctx->n_rdma += ret;
		ioctx->n_rw_ctx++;

		if (prev) {
			sg_unmark_end(&prev[prev_nents - 1]);
			sg_chain(prev, prev_nents + 1, ctx->sg);
		} else {
			*sg = ctx->sg;
		}

		prev = ctx->sg;
		prev_nents = ctx->nents;

		*sg_cnt += ctx->nents;
	}

	return 0;

unwind:
	while (--i >= 0) {
		struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];

		rdma_rw_ctx_destroy(&ctx->rw, ch->qp, ch->sport->port,
				ctx->sg, ctx->nents, dir);
		target_free_sgl(ctx->sg, ctx->nents);
	}
	if (ioctx->rw_ctxs != &ioctx->s_rw_ctx)
		kfree(ioctx->rw_ctxs);
	return ret;
}

static void srpt_free_rw_ctxs(struct srpt_rdma_ch *ch,
				    struct srpt_send_ioctx *ioctx)
{
	enum dma_data_direction dir = target_reverse_dma_direction(&ioctx->cmd);
	int i;

	for (i = 0; i < ioctx->n_rw_ctx; i++) {
		struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];

		rdma_rw_ctx_destroy(&ctx->rw, ch->qp, ch->sport->port,
				ctx->sg, ctx->nents, dir);
		target_free_sgl(ctx->sg, ctx->nents);
	}

	if (ioctx->rw_ctxs != &ioctx->s_rw_ctx)
		kfree(ioctx->rw_ctxs);
}

static inline void *srpt_get_desc_buf(struct srp_cmd *srp_cmd)
{
	/*
	 * The pointer computations below will only be compiled correctly
	 * if srp_cmd::add_data is declared as s8*, u8*, s8[] or u8[], so check
	 * whether srp_cmd::add_data has been declared as a byte pointer.
	 */
	BUILD_BUG_ON(!__same_type(srp_cmd->add_data[0], (s8)0) &&
		     !__same_type(srp_cmd->add_data[0], (u8)0));

	/*
	 * According to the SRP spec, the lower two bits of the 'ADDITIONAL
	 * CDB LENGTH' field are reserved and the size in bytes of this field
	 * is four times the value specified in bits 3..7. Hence the "& ~3".
	 */
	return srp_cmd->add_data + (srp_cmd->add_cdb_len & ~3);
}

/**
 * srpt_get_desc_tbl - parse the data descriptors of a SRP_CMD request
 * @recv_ioctx: I/O context associated with the received command @srp_cmd.
 * @ioctx: I/O context that will be used for responding to the initiator.
 * @srp_cmd: Pointer to the SRP_CMD request data.
 * @dir: Pointer to the variable to which the transfer direction will be
 *   written.
 * @sg: [out] scatterlist for the parsed SRP_CMD.
 * @sg_cnt: [out] length of @sg.
 * @data_len: Pointer to the variable to which the total data length of all
 *   descriptors in the SRP_CMD request will be written.
 * @imm_data_offset: [in] Offset in SRP_CMD requests at which immediate data
 *   starts.
 *
 * This function initializes ioctx->nrbuf and ioctx->r_bufs.
 *
 * Returns -EINVAL when the SRP_CMD request contains inconsistent descriptors;
 * -ENOMEM when memory allocation fails and zero upon success.
 */
static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
		struct srpt_send_ioctx *ioctx,
		struct srp_cmd *srp_cmd, enum dma_data_direction *dir,
		struct scatterlist **sg, unsigned int *sg_cnt, u64 *data_len,
		u16 imm_data_offset)
{
	BUG_ON(!dir);
	BUG_ON(!data_len);

	/*
	 * The lower four bits of the buffer format field contain the DATA-IN
	 * buffer descriptor format, and the highest four bits contain the
	 * DATA-OUT buffer descriptor format.
	 */
	if (srp_cmd->buf_fmt & 0xf)
		/* DATA-IN: transfer data from target to initiator (read). */
		*dir = DMA_FROM_DEVICE;
	else if (srp_cmd->buf_fmt >> 4)
		/* DATA-OUT: transfer data from initiator to target (write). */
		*dir = DMA_TO_DEVICE;
	else
		*dir = DMA_NONE;

	/* initialize data_direction early as srpt_alloc_rw_ctxs needs it */
	ioctx->cmd.data_direction = *dir;

	if (((srp_cmd->buf_fmt & 0xf) == SRP_DATA_DESC_DIRECT) ||
	    ((srp_cmd->buf_fmt >> 4) == SRP_DATA_DESC_DIRECT)) {
		struct srp_direct_buf *db = srpt_get_desc_buf(srp_cmd);

		*data_len = be32_to_cpu(db->len);
		return srpt_alloc_rw_ctxs(ioctx, db, 1, sg, sg_cnt);
	} else if (((srp_cmd->buf_fmt & 0xf) == SRP_DATA_DESC_INDIRECT) ||
		   ((srp_cmd->buf_fmt >> 4) == SRP_DATA_DESC_INDIRECT)) {
		struct srp_indirect_buf *idb = srpt_get_desc_buf(srp_cmd);
		int nbufs = be32_to_cpu(idb->table_desc.len) /
				sizeof(struct srp_direct_buf);

		if (nbufs >
		    (srp_cmd->data_out_desc_cnt + srp_cmd->data_in_desc_cnt)) {
			pr_err("received unsupported SRP_CMD request type (%u out + %u in != %u / %zu)\n",
			       srp_cmd->data_out_desc_cnt,
			       srp_cmd->data_in_desc_cnt,
			       be32_to_cpu(idb->table_desc.len),
			       sizeof(struct srp_direct_buf));
			return -EINVAL;
		}

		*data_len = be32_to_cpu(idb->len);
		return srpt_alloc_rw_ctxs(ioctx, idb->desc_list, nbufs,
				sg, sg_cnt);
	} else if ((srp_cmd->buf_fmt >> 4) == SRP_DATA_DESC_IMM) {
		struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
		void *data = (void *)srp_cmd + imm_data_offset;
		uint32_t len = be32_to_cpu(imm_buf->len);
		uint32_t req_size = imm_data_offset + len;

		if (req_size > srp_max_req_size) {
			pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
			       imm_data_offset, len, srp_max_req_size);
			return -EINVAL;
		}
		if (recv_ioctx->byte_len < req_size) {
			pr_err("Received too few data - %d < %d\n",
			       recv_ioctx->byte_len, req_size);
			return -EIO;
		}
		/*
		 * The immediate data buffer descriptor must occur before the
		 * immediate data itself.
		 */
		if ((void *)(imm_buf + 1) > (void *)data) {
			pr_err("Received invalid write request\n");
			return -EINVAL;
		}
		*data_len = len;
		ioctx->recv_ioctx = recv_ioctx;
		if ((uintptr_t)data & 511) {
			pr_warn_once("Internal error - the receive buffers are not aligned properly.\n");
			return -EINVAL;
		}
		sg_init_one(&ioctx->imm_sg, data, len);
		*sg = &ioctx->imm_sg;
		*sg_cnt = 1;
		return 0;
	} else {
		*data_len = 0;
		return 0;
	}
}

/**
 * srpt_init_ch_qp - initialize queue pair attributes
 * @ch: SRPT RDMA channel.
 * @qp: Queue pair pointer.
 *
 * Initialized the attributes of queue pair 'qp' by allowing local write,
 * remote read and remote write. Also transitions 'qp' to state IB_QPS_INIT.
 */
static int srpt_init_ch_qp(struct srpt_rdma_ch *ch, struct ib_qp *qp)
{
	struct ib_qp_attr *attr;
	int ret;

	WARN_ON_ONCE(ch->using_rdma_cm);

	attr = kzalloc(sizeof(*attr), GFP_KERNEL);
	if (!attr)
		return -ENOMEM;

	attr->qp_state = IB_QPS_INIT;
	attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE;
	attr->port_num = ch->sport->port;

	ret = ib_find_cached_pkey(ch->sport->sdev->device, ch->sport->port,
				  ch->pkey, &attr->pkey_index);
	if (ret < 0)
		pr_err("Translating pkey %#x failed (%d) - using index 0\n",
		       ch->pkey, ret);

	ret = ib_modify_qp(qp, attr,
			   IB_QP_STATE | IB_QP_ACCESS_FLAGS | IB_QP_PORT |
			   IB_QP_PKEY_INDEX);

	kfree(attr);
	return ret;
}

/**
 * srpt_ch_qp_rtr - change the state of a channel to 'ready to receive' (RTR)
 * @ch: channel of the queue pair.
 * @qp: queue pair to change the state of.
 *
 * Returns zero upon success and a negative value upon failure.
 *
 * Note: currently a struct ib_qp_attr takes 136 bytes on a 64-bit system.
 * If this structure ever becomes larger, it might be necessary to allocate
 * it dynamically instead of on the stack.
 */
static int srpt_ch_qp_rtr(struct srpt_rdma_ch *ch, struct ib_qp *qp)
{
	struct ib_qp_attr qp_attr;
	int attr_mask;
	int ret;

	WARN_ON_ONCE(ch->using_rdma_cm);

	qp_attr.qp_state = IB_QPS_RTR;
	ret = ib_cm_init_qp_attr(ch->ib_cm.cm_id, &qp_attr, &attr_mask);
	if (ret)
		goto out;

	qp_attr.max_dest_rd_atomic = 4;

	ret = ib_modify_qp(qp, &qp_attr, attr_mask);

out:
	return ret;
}

/**
 * srpt_ch_qp_rts - change the state of a channel to 'ready to send' (RTS)
 * @ch: channel of the queue pair.
 * @qp: queue pair to change the state of.
 *
 * Returns zero upon success and a negative value upon failure.
 *
 * Note: currently a struct ib_qp_attr takes 136 bytes on a 64-bit system.
 * If this structure ever becomes larger, it might be necessary to allocate
 * it dynamically instead of on the stack.
 */
static int srpt_ch_qp_rts(struct srpt_rdma_ch *ch, struct ib_qp *qp)
{
	struct ib_qp_attr qp_attr;
	int attr_mask;
	int ret;

	qp_attr.qp_state = IB_QPS_RTS;
	ret = ib_cm_init_qp_attr(ch->ib_cm.cm_id, &qp_attr, &attr_mask);
	if (ret)
		goto out;

	qp_attr.max_rd_atomic = 4;

	ret = ib_modify_qp(qp, &qp_attr, attr_mask);

out:
	return ret;
}

/**
 * srpt_ch_qp_err - set the channel queue pair state to 'error'
 * @ch: SRPT RDMA channel.
 */
static int srpt_ch_qp_err(struct srpt_rdma_ch *ch)
{
	struct ib_qp_attr qp_attr;

	qp_attr.qp_state = IB_QPS_ERR;
	return ib_modify_qp(ch->qp, &qp_attr, IB_QP_STATE);
}

/**
 * srpt_get_send_ioctx - obtain an I/O context for sending to the initiator
 * @ch: SRPT RDMA channel.
 */
static struct srpt_send_ioctx *srpt_get_send_ioctx(struct srpt_rdma_ch *ch)
{
	struct srpt_send_ioctx *ioctx;
	int tag, cpu;

	BUG_ON(!ch);

	tag = sbitmap_queue_get(&ch->sess->sess_tag_pool, &cpu);
	if (tag < 0)
		return NULL;

	ioctx = ch->ioctx_ring[tag];
	BUG_ON(ioctx->ch != ch);
	ioctx->state = SRPT_STATE_NEW;
	WARN_ON_ONCE(ioctx->recv_ioctx);
	ioctx->n_rdma = 0;
	ioctx->n_rw_ctx = 0;
	ioctx->queue_status_only = false;
	/*
	 * transport_init_se_cmd() does not initialize all fields, so do it
	 * here.
	 */
	memset(&ioctx->cmd, 0, sizeof(ioctx->cmd));
	memset(&ioctx->sense_data, 0, sizeof(ioctx->sense_data));
	ioctx->cmd.map_tag = tag;
	ioctx->cmd.map_cpu = cpu;

	return ioctx;
}

/**
 * srpt_abort_cmd - abort a SCSI command
 * @ioctx:   I/O context associated with the SCSI command.
 */
static int srpt_abort_cmd(struct srpt_send_ioctx *ioctx)
{
	enum srpt_command_state state;

	BUG_ON(!ioctx);

	/*
	 * If the command is in a state where the target core is waiting for
	 * the ib_srpt driver, change the state to the next state.
	 */

	state = ioctx->state;
	switch (state) {
	case SRPT_STATE_NEED_DATA:
		ioctx->state = SRPT_STATE_DATA_IN;
		break;
	case SRPT_STATE_CMD_RSP_SENT:
	case SRPT_STATE_MGMT_RSP_SENT:
		ioctx->state = SRPT_STATE_DONE;
		break;
	default:
		WARN_ONCE(true, "%s: unexpected I/O context state %d\n",
			  __func__, state);
		break;
	}

	pr_debug("Aborting cmd with state %d -> %d and tag %lld\n", state,
		 ioctx->state, ioctx->cmd.tag);

	switch (state) {
	case SRPT_STATE_NEW:
	case SRPT_STATE_DATA_IN:
	case SRPT_STATE_MGMT:
	case SRPT_STATE_DONE:
		/*
		 * Do nothing - defer abort processing until
		 * srpt_queue_response() is invoked.
		 */
		break;
	case SRPT_STATE_NEED_DATA:
		pr_debug("tag %#llx: RDMA read error\n", ioctx->cmd.tag);
		transport_generic_request_failure(&ioctx->cmd,
					TCM_CHECK_CONDITION_ABORT_CMD);
		break;
	case SRPT_STATE_CMD_RSP_SENT:
		/*
		 * SRP_RSP sending failed or the SRP_RSP send completion has
		 * not been received in time.
		 */
		transport_generic_free_cmd(&ioctx->cmd, 0);
		break;
	case SRPT_STATE_MGMT_RSP_SENT:
		transport_generic_free_cmd(&ioctx->cmd, 0);
		break;
	default:
		WARN(1, "Unexpected command state (%d)", state);
		break;
	}

	return state;
}

/**
 * srpt_rdma_read_done - RDMA read completion callback
 * @cq: Completion queue.
 * @wc: Work completion.
 *
 * XXX: what is now target_execute_cmd used to be asynchronous, and unmapping
 * the data that has been transferred via IB RDMA had to be postponed until the
 * check_stop_free() callback.  None of this is necessary anymore and needs to
 * be cleaned up.
 */
static void srpt_rdma_read_done(struct ib_cq *cq, struct ib_wc *wc)
{
	struct srpt_rdma_ch *ch = wc->qp->qp_context;
	struct srpt_send_ioctx *ioctx =
		container_of(wc->wr_cqe, struct srpt_send_ioctx, rdma_cqe);

	WARN_ON(ioctx->n_rdma <= 0);
	atomic_add(ioctx->n_rdma, &ch->sq_wr_avail);
	ioctx->n_rdma = 0;

	if (unlikely(wc->status != IB_WC_SUCCESS)) {
		pr_info("RDMA_READ for ioctx 0x%p failed with status %d\n",
			ioctx, wc->status);
		srpt_abort_cmd(ioctx);
		return;
	}

	if (srpt_test_and_set_cmd_state(ioctx, SRPT_STATE_NEED_DATA,
					SRPT_STATE_DATA_IN))
		target_execute_cmd(&ioctx->cmd);
	else
		pr_err("%s[%d]: wrong state = %d\n", __func__,
		       __LINE__, ioctx->state);
}

/**
 * srpt_build_cmd_rsp - build a SRP_RSP response
 * @ch: RDMA channel through which the request has been received.
 * @ioctx: I/O context associated with the SRP_CMD request. The response will
 *   be built in the buffer ioctx->buf points at and hence this function will
 *   overwrite the request data.
 * @tag: tag of the request for which this response is being generated.
 * @status: value for the STATUS field of the SRP_RSP information unit.
 *
 * Returns the size in bytes of the SRP_RSP response.
 *
 * An SRP_RSP response contains a SCSI status or service response. See also
 * section 6.9 in the SRP r16a document for the format of an SRP_RSP
 * response. See also SPC-2 for more information about sense data.
 */
static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
			      struct srpt_send_ioctx *ioctx, u64 tag,
			      int status)
{
	struct se_cmd *cmd = &ioctx->cmd;
	struct srp_rsp *srp_rsp;
	const u8 *sense_data;
	int sense_data_len, max_sense_len;
	u32 resid = cmd->residual_count;

	/*
	 * The lowest bit of all SAM-3 status codes is zero (see also
	 * paragraph 5.3 in SAM-3).
	 */
	WARN_ON(status & 1);

	srp_rsp = ioctx->ioctx.buf;
	BUG_ON(!srp_rsp);

	sense_data = ioctx->sense_data;
	sense_data_len = ioctx->cmd.scsi_sense_length;
	WARN_ON(sense_data_len > sizeof(ioctx->sense_data));

	memset(srp_rsp, 0, sizeof(*srp_rsp));
	srp_rsp->opcode = SRP_RSP;
	srp_rsp->req_lim_delta =
		cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
	srp_rsp->tag = tag;
	srp_rsp->status = status;

	if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
		if (cmd->data_direction == DMA_TO_DEVICE) {
			/* residual data from an underflow write */
			srp_rsp->flags = SRP_RSP_FLAG_DOUNDER;
			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
			/* residual data from an underflow read */
			srp_rsp->flags = SRP_RSP_FLAG_DIUNDER;
			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
		}
	} else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
		if (cmd->data_direction == DMA_TO_DEVICE) {
			/* residual data from an overflow write */
			srp_rsp->flags = SRP_RSP_FLAG_DOOVER;
			srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
		} else if (cmd->data_direction == DMA_FROM_DEVICE) {
			/* residual data from an overflow read */
			srp_rsp->flags = SRP_RSP_FLAG_DIOVER;
			srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
		}
	}

	if (sense_data_len) {
		BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp));
		max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp);
		if (sense_data_len > max_sense_len) {
			pr_warn("truncated sense data from %d to %d bytes\n",
				sense_data_len, max_sense_len);
			sense_data_len = max_sense_len;
		}

		srp_rsp->flags |= SRP_RSP_FLAG_SNSVALID;
		srp_rsp->sense_data_len = cpu_to_be32(sense_data_len);
		memcpy(srp_rsp->data, sense_data, sense_data_len);
	}

	return sizeof(*srp_rsp) + sense_data_len;
}

/**
 * srpt_build_tskmgmt_rsp - build a task management response
 * @ch:       RDMA channel through which the request has been received.
 * @ioctx:    I/O context in which the SRP_RSP response will be built.
 * @rsp_code: RSP_CODE that will be stored in the response.
 * @tag:      Tag of the request for which this response is being generated.
 *
 * Returns the size in bytes of the SRP_RSP response.
 *
 * An SRP_RSP response contains a SCSI status or service response. See also
 * section 6.9 in the SRP r16a document for the format of an SRP_RSP
 * response.
 */
static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
				  struct srpt_send_ioctx *ioctx,
				  u8 rsp_code, u64 tag)
{
	struct srp_rsp *srp_rsp;
	int resp_data_len;
	int resp_len;

	resp_data_len = 4;
	resp_len = sizeof(*srp_rsp) + resp_data_len;

	srp_rsp = ioctx->ioctx.buf;
	BUG_ON(!srp_rsp);
	memset(srp_rsp, 0, sizeof(*srp_rsp));

	srp_rsp->opcode = SRP_RSP;
	srp_rsp->req_lim_delta =
		cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
	srp_rsp->tag = tag;

	srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
	srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
	srp_rsp->data[3] = rsp_code;

	return resp_len;
}

static int srpt_check_stop_free(struct se_cmd *cmd)
{
	struct srpt_send_ioctx *ioctx = container_of(cmd,
				struct srpt_send_ioctx, cmd);

	return target_put_sess_cmd(&ioctx->cmd);
}

/**
 * srpt_handle_cmd - process a SRP_CMD information unit
 * @ch: SRPT RDMA channel.
 * @recv_ioctx: Receive I/O context.
 * @send_ioctx: Send I/O context.
 */
static void srpt_handle_cmd(struct srpt_rdma_ch *ch,
			    struct srpt_recv_ioctx *recv_ioctx,
			    struct srpt_send_ioctx *send_ioctx)
{
	struct se_cmd *cmd;
	struct srp_cmd *srp_cmd;
	struct scatterlist *sg = NULL;
	unsigned sg_cnt = 0;
	u64 data_len;
	enum dma_data_direction dir;
	int rc;

	BUG_ON(!send_ioctx);

	srp_cmd = recv_ioctx->ioctx.buf + recv_ioctx->ioctx.offset;
	cmd = &send_ioctx->cmd;
	cmd->tag = srp_cmd->tag;

	switch (srp_cmd->task_attr) {
	case SRP_CMD_SIMPLE_Q:
		cmd->sam_task_attr = TCM_SIMPLE_TAG;
		break;
	case SRP_CMD_ORDERED_Q:
	default:
		cmd->sam_task_attr = TCM_ORDERED_TAG;
		break;
	case SRP_CMD_HEAD_OF_Q:
		cmd->sam_task_attr = TCM_HEAD_TAG;
		break;
	case SRP_CMD_ACA:
		cmd->sam_task_attr = TCM_ACA_TAG;
		break;
	}

	rc = srpt_get_desc_tbl(recv_ioctx, send_ioctx, srp_cmd, &dir,
			       &sg, &sg_cnt, &data_len, ch->imm_data_offset);
	if (rc) {
		if (rc != -EAGAIN) {
			pr_err("0x%llx: parsing SRP descriptor table failed.\n",
			       srp_cmd->tag);
		}
		goto busy;
	}

	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
			     scsilun_to_int(&srp_cmd->lun), data_len,
			     TCM_SIMPLE_TAG, dir, TARGET_SCF_ACK_KREF);
	if (rc != 0) {
		pr_debug("target_submit_cmd() returned %d for tag %#llx\n", rc,
			 srp_cmd->tag);
		goto busy;
	}

	if (target_submit_prep(cmd, srp_cmd->cdb, sg, sg_cnt, NULL, 0, NULL, 0,
			       GFP_KERNEL))
		return;

	target_submit(cmd);
	return;

busy:
	target_send_busy(cmd);
}

static int srp_tmr_to_tcm(int fn)
{
	switch (fn) {
	case SRP_TSK_ABORT_TASK:
		return TMR_ABORT_TASK;
	case SRP_TSK_ABORT_TASK_SET:
		return TMR_ABORT_TASK_SET;
	case SRP_TSK_CLEAR_TASK_SET:
		return TMR_CLEAR_TASK_SET;
	case SRP_TSK_LUN_RESET:
		return TMR_LUN_RESET;
	case SRP_TSK_CLEAR_ACA:
		return TMR_CLEAR_ACA;
	default:
		return -1;
	}
}

/**
 * srpt_handle_tsk_mgmt - process a SRP_TSK_MGMT information unit
 * @ch: SRPT RDMA channel.
 * @recv_ioctx: Receive I/O context.
 * @send_ioctx: Send I/O context.
 *
 * Returns 0 if and only if the request will be processed by the target core.
 *
 * For more information about SRP_TSK_MGMT information units, see also section
 * 6.7 in the SRP r16a document.
 */
static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
				 struct srpt_recv_ioctx *recv_ioctx,
				 struct srpt_send_ioctx *send_ioctx)
{
	struct srp_tsk_mgmt *srp_tsk;
	struct se_cmd *cmd;
	struct se_session *sess = ch->sess;
	int tcm_tmr;
	int rc;

	BUG_ON(!send_ioctx);

	srp_tsk = recv_ioctx->ioctx.buf + recv_ioctx->ioctx.offset;
	cmd = &send_ioctx->cmd;

	pr_debug("recv tsk_mgmt fn %d for task_tag %lld and cmd tag %lld ch %p sess %p\n",
		 srp_tsk->tsk_mgmt_func, srp_tsk->task_tag, srp_tsk->tag, ch,
		 ch->sess);

	srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
	send_ioctx->cmd.tag = srp_tsk->tag;
	tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
	rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL,
			       scsilun_to_int(&srp_tsk->lun), srp_tsk, tcm_tmr,
			       GFP_KERNEL, srp_tsk->task_tag,
			       TARGET_SCF_ACK_KREF);
	if (rc != 0) {
		send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
		cmd->se_tfo->queue_tm_rsp(cmd);
	}
	return;
}

/**
 * srpt_handle_new_iu - process a newly received information unit
 * @ch:    RDMA channel through which the information unit has been received.
 * @recv_ioctx: Receive I/O context associated with the information unit.
 */
static bool
srpt_handle_new_iu(struct srpt_rdma_ch *ch, struct srpt_recv_ioctx *recv_ioctx)
{
	struct srpt_send_ioctx *send_ioctx = NULL;
	struct srp_cmd *srp_cmd;
	bool res = false;
	u8 opcode;

	BUG_ON(!ch);
	BUG_ON(!recv_ioctx);

	if (unlikely(ch->state == CH_CONNECTING))
		goto push;

	ib_dma_sync_single_for_cpu(ch->sport->sdev->device,
				   recv_ioctx->ioctx.dma,
				   recv_ioctx->ioctx.offset + srp_max_req_size,
				   DMA_FROM_DEVICE);

	srp_cmd = recv_ioctx->ioctx.buf + recv_ioctx->ioctx.offset;
	opcode = srp_cmd->opcode;
	if (opcode == SRP_CMD || opcode == SRP_TSK_MGMT) {
		send_ioctx = srpt_get_send_ioctx(ch);
		if (unlikely(!send_ioctx))
			goto push;
	}

	if (!list_empty(&recv_ioctx->wait_list)) {
		WARN_ON_ONCE(!ch->processing_wait_list);
		list_del_init(&recv_ioctx->wait_list);
	}

	switch (opcode) {
	case SRP_CMD:
		srpt_handle_cmd(ch, recv_ioctx, send_ioctx);
		break;
	case SRP_TSK_MGMT:
		srpt_handle_tsk_mgmt(ch, recv_ioctx, send_ioctx);
		break;
	case SRP_I_LOGOUT:
		pr_err("Not yet implemented: SRP_I_LOGOUT\n");
		break;
	case SRP_CRED_RSP:
		pr_debug("received SRP_CRED_RSP\n");
		break;
	case SRP_AER_RSP:
		pr_debug("received SRP_AER_RSP\n");
		break;
	case SRP_RSP:
		pr_err("Received SRP_RSP\n");
		break;
	default:
		pr_err("received IU with unknown opcode 0x%x\n", opcode);
		break;
	}

	if (!send_ioctx || !send_ioctx->recv_ioctx)
		srpt_post_recv(ch->sport->sdev, ch, recv_ioctx);
	res = true;

out:
	return res;

push:
	if (list_empty(&recv_ioctx->wait_list)) {
		WARN_ON_ONCE(ch->processing_wait_list);
		list_add_tail(&recv_ioctx->wait_list, &ch->cmd_wait_list);
	}
	goto out;
}

static void srpt_recv_done(struct ib_cq *cq, struct ib_wc *wc)
{
	struct srpt_rdma_ch *ch = wc->qp->qp_context;
	struct srpt_recv_ioctx *ioctx =
		container_of(wc->wr_cqe, struct srpt_recv_ioctx, ioctx.cqe);

	if (wc->status == IB_WC_SUCCESS) {
		int req_lim;

		req_lim = atomic_dec_return(&ch->req_lim);
		if (unlikely(req_lim < 0))
			pr_err("req_lim = %d < 0\n", req_lim);
		ioctx->byte_len = wc->byte_len;
		srpt_handle_new_iu(ch, ioctx);
	} else {
		pr_info_ratelimited("receiving failed for ioctx %p with status %d\n",
				    ioctx, wc->status);
	}
}

/*
 * This function must be called from the context in which RDMA completions are
 * processed because it accesses the wait list without protection against
 * access from other threads.
 */
static void srpt_process_wait_list(struct srpt_rdma_ch *ch)
{
	struct srpt_recv_ioctx *recv_ioctx, *tmp;

	WARN_ON_ONCE(ch->state == CH_CONNECTING);

	if (list_empty(&ch->cmd_wait_list))
		return;

	WARN_ON_ONCE(ch->processing_wait_list);
	ch->processing_wait_list = true;
	list_for_each_entry_safe(recv_ioctx, tmp, &ch->cmd_wait_list,
				 wait_list) {
		if (!srpt_handle_new_iu(ch, recv_ioctx))
			break;
	}
	ch->processing_wait_list = false;
}

/**
 * srpt_send_done - send completion callback
 * @cq: Completion queue.
 * @wc: Work completion.
 *
 * Note: Although this has not yet been observed during tests, at least in
 * theory it is possible that the srpt_get_send_ioctx() call invoked by
 * srpt_handle_new_iu() fails. This is possible because the req_lim_delta
 * value in each response is set to one, and it is possible that this response
 * makes the initiator send a new request before the send completion for that
 * response has been processed. This could e.g. happen if the call to
 * srpt_put_send_iotcx() is delayed because of a higher priority interrupt or
 * if IB retransmission causes generation of the send completion to be
 * delayed. Incoming information units for which srpt_get_send_ioctx() fails
 * are queued on cmd_wait_list. The code below processes these delayed
 * requests one at a time.
 */
static void srpt_send_done(struct ib_cq *cq, struct ib_wc *wc)
{
	struct srpt_rdma_ch *ch = wc->qp->qp_context;
	struct srpt_send_ioctx *ioctx =
		container_of(wc->wr_cqe, struct srpt_send_ioctx, ioctx.cqe);
	enum srpt_command_state state;

	state = srpt_set_cmd_state(ioctx, SRPT_STATE_DONE);

	WARN_ON(state != SRPT_STATE_CMD_RSP_SENT &&
		state != SRPT_STATE_MGMT_RSP_SENT);

	atomic_add(1 + ioctx->n_rdma, &ch->sq_wr_avail);

	if (wc->status != IB_WC_SUCCESS)
		pr_info("sending response for ioctx 0x%p failed with status %d\n",
			ioctx, wc->status);

	if (state != SRPT_STATE_DONE) {
		transport_generic_free_cmd(&ioctx->cmd, 0);
	} else {
		pr_err("IB completion has been received too late for wr_id = %u.\n",
		       ioctx->ioctx.index);
	}

	srpt_process_wait_list(ch);
}

/**
 * srpt_create_ch_ib - create receive and send completion queues
 * @ch: SRPT RDMA channel.
 */
static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
{
	struct ib_qp_init_attr *qp_init;
	struct srpt_port *sport = ch->sport;
	struct srpt_device *sdev = sport->sdev;
	const struct ib_device_attr *attrs = &sdev->device->attrs;
	int sq_size = sport->port_attrib.srp_sq_size;
	int i, ret;

	WARN_ON(ch->rq_size < 1);

	ret = -ENOMEM;
	qp_init = kzalloc(sizeof(*qp_init), GFP_KERNEL);
	if (!qp_init)
		goto out;

retry:
	ch->cq = ib_cq_pool_get(sdev->device, ch->rq_size + sq_size, -1,
				 IB_POLL_WORKQUEUE);
	if (IS_ERR(ch->cq)) {
		ret = PTR_ERR(ch->cq);
		pr_err("failed to create CQ cqe= %d ret= %pe\n",
		       ch->rq_size + sq_size, ch->cq);
		goto out;
	}
	ch->cq_size = ch->rq_size + sq_size;

	qp_init->qp_context = (void *)ch;
	qp_init->event_handler = srpt_qp_event;
	qp_init->send_cq = ch->cq;
	qp_init->recv_cq = ch->cq;
	qp_init->sq_sig_type = IB_SIGNAL_REQ_WR;
	qp_init->qp_type = IB_QPT_RC;
	/*
	 * We divide up our send queue size into half SEND WRs to send the
	 * completions, and half R/W contexts to actually do the RDMA
	 * READ/WRITE transfers.  Note that we need to allocate CQ slots for
	 * both both, as RDMA contexts will also post completions for the
	 * RDMA READ case.
	 */
	qp_init->cap.max_send_wr = min(sq_size / 2, attrs->max_qp_wr);
	qp_init->cap.max_rdma_ctxs = sq_size / 2;
	qp_init->cap.max_send_sge = attrs->max_send_sge;
	qp_init->cap.max_recv_sge = 1;
	qp_init->port_num = ch->sport->port;
	if (sdev->use_srq)
		qp_init->srq = sdev->srq;
	else
		qp_init->cap.max_recv_wr = ch->rq_size;

	if (ch->using_rdma_cm) {
		ret = rdma_create_qp(ch->rdma_cm.cm_id, sdev->pd, qp_init);
		ch->qp = ch->rdma_cm.cm_id->qp;
	} else {
		ch->qp = ib_create_qp(sdev->pd, qp_init);
		if (!IS_ERR(ch->qp)) {
			ret = srpt_init_ch_qp(ch, ch->qp);
			if (ret)
				ib_destroy_qp(ch->qp);
		} else {
			ret = PTR_ERR(ch->qp);
		}
	}
	if (ret) {
		bool retry = sq_size > MIN_SRPT_SQ_SIZE;

		if (retry) {
			pr_debug("failed to create queue pair with sq_size = %d (%d) - retrying\n",
				 sq_size, ret);
			ib_cq_pool_put(ch->cq, ch->cq_size);
			sq_size = max(sq_size / 2, MIN_SRPT_SQ_SIZE);
			goto retry;
		} else {
			pr_err("failed to create queue pair with sq_size = %d (%d)\n",
			       sq_size, ret);
			goto err_destroy_cq;
		}
	}

	atomic_set(&ch->sq_wr_avail, qp_init->cap.max_send_wr);

	pr_debug("%s: max_cqe= %d max_sge= %d sq_size = %d ch= %p\n",
		 __func__, ch->cq->cqe, qp_init->cap.max_send_sge,
		 qp_init->cap.max_send_wr, ch);

	if (!sdev->use_srq)
		for (i = 0; i < ch->rq_size; i++)
			srpt_post_recv(sdev, ch, ch->ioctx_recv_ring[i]);

out:
	kfree(qp_init);
	return ret;

err_destroy_cq:
	ch->qp = NULL;
	ib_cq_pool_put(ch->cq, ch->cq_size);
	goto out;
}

static void srpt_destroy_ch_ib(struct srpt_rdma_ch *ch)
{
	ib_destroy_qp(ch->qp);
	ib_cq_pool_put(ch->cq, ch->cq_size);
}

/**
 * srpt_close_ch - close a RDMA channel
 * @ch: SRPT RDMA channel.
 *
 * Make sure all resources associated with the channel will be deallocated at
 * an appropriate time.
 *
 * Returns true if and only if the channel state has been modified into
 * CH_DRAINING.
 */
static bool srpt_close_ch(struct srpt_rdma_ch *ch)
{
	int ret;

	if (!srpt_set_ch_state(ch, CH_DRAINING)) {
		pr_debug("%s: already closed\n", ch->sess_name);
		return false;
	}

	kref_get(&ch->kref);

	ret = srpt_ch_qp_err(ch);
	if (ret < 0)
		pr_err("%s-%d: changing queue pair into error state failed: %d\n",
		       ch->sess_name, ch->qp->qp_num, ret);

	ret = srpt_zerolength_write(ch);
	if (ret < 0) {
		pr_err("%s-%d: queuing zero-length write failed: %d\n",
		       ch->sess_name, ch->qp->qp_num, ret);
		if (srpt_set_ch_state(ch, CH_DISCONNECTED))
			schedule_work(&ch->release_work);
		else
			WARN_ON_ONCE(true);
	}

	kref_put(&ch->kref, srpt_free_ch);

	return true;
}

/*
 * Change the channel state into CH_DISCONNECTING. If a channel has not yet
 * reached the connected state, close it. If a channel is in the connected
 * state, send a DREQ. If a DREQ has been received, send a DREP. Note: it is
 * the responsibility of the caller to ensure that this function is not
 * invoked concurrently with the code that accepts a connection. This means
 * that this function must either be invoked from inside a CM callback
 * function or that it must be invoked with the srpt_port.mutex held.
 */
static int srpt_disconnect_ch(struct srpt_rdma_ch *ch)
{
	int ret;

	if (!srpt_set_ch_state(ch, CH_DISCONNECTING))
		return -ENOTCONN;

	if (ch->using_rdma_cm) {
		ret = rdma_disconnect(ch->rdma_cm.cm_id);
	} else {
		ret = ib_send_cm_dreq(ch->ib_cm.cm_id, NULL, 0);
		if (ret < 0)
			ret = ib_send_cm_drep(ch->ib_cm.cm_id, NULL, 0);
	}

	if (ret < 0 && srpt_close_ch(ch))
		ret = 0;

	return ret;
}

/* Send DREQ and wait for DREP. */
static void srpt_disconnect_ch_sync(struct srpt_rdma_ch *ch)
{
	DECLARE_COMPLETION_ONSTACK(closed);
	struct srpt_port *sport = ch->sport;

	pr_debug("ch %s-%d state %d\n", ch->sess_name, ch->qp->qp_num,
		 ch->state);

	ch->closed = &closed;

	mutex_lock(&sport->mutex);
	srpt_disconnect_ch(ch);
	mutex_unlock(&sport->mutex);

	while (wait_for_completion_timeout(&closed, 5 * HZ) == 0)
		pr_info("%s(%s-%d state %d): still waiting ...\n", __func__,
			ch->sess_name, ch->qp->qp_num, ch->state);

}

static void __srpt_close_all_ch(struct srpt_port *sport)
{
	struct srpt_nexus *nexus;
	struct srpt_rdma_ch *ch;

	lockdep_assert_held(&sport->mutex);

	list_for_each_entry(nexus, &sport->nexus_list, entry) {
		list_for_each_entry(ch, &nexus->ch_list, list) {
			if (srpt_disconnect_ch(ch) >= 0)
				pr_info("Closing channel %s-%d because target %s_%d has been disabled\n",
					ch->sess_name, ch->qp->qp_num,
					dev_name(&sport->sdev->device->dev),
					sport->port);
			srpt_close_ch(ch);
		}
	}
}

/*
 * Look up (i_port_id, t_port_id) in sport->nexus_list. Create an entry if
 * it does not yet exist.
 */
static struct srpt_nexus *srpt_get_nexus(struct srpt_port *sport,
					 const u8 i_port_id[16],
					 const u8 t_port_id[16])
{
	struct srpt_nexus *nexus = NULL, *tmp_nexus = NULL, *n;

	for (;;) {
		mutex_lock(&sport->mutex);
		list_for_each_entry(n, &sport->nexus_list, entry) {
			if (memcmp(n->i_port_id, i_port_id, 16) == 0 &&
			    memcmp(n->t_port_id, t_port_id, 16) == 0) {
				nexus = n;
				break;
			}
		}
		if (!nexus && tmp_nexus) {
			list_add_tail_rcu(&tmp_nexus->entry,
					  &sport->nexus_list);
			swap(nexus, tmp_nexus);
		}
		mutex_unlock(&sport->mutex);

		if (nexus)
			break;
		tmp_nexus = kzalloc(sizeof(*nexus), GFP_KERNEL);
		if (!tmp_nexus) {
			nexus = ERR_PTR(-ENOMEM);
			break;
		}
		INIT_LIST_HEAD(&tmp_nexus->ch_list);
		memcpy(tmp_nexus->i_port_id, i_port_id, 16);
		memcpy(tmp_nexus->t_port_id, t_port_id, 16);
	}

	kfree(tmp_nexus);

	return nexus;
}

static void srpt_set_enabled(struct srpt_port *sport, bool enabled)
	__must_hold(&sport->mutex)
{
	lockdep_assert_held(&sport->mutex);

	if (sport->enabled == enabled)
		return;
	sport->enabled = enabled;
	if (!enabled)
		__srpt_close_all_ch(sport);
}

static void srpt_drop_sport_ref(struct srpt_port *sport)
{
	if (atomic_dec_return(&sport->refcount) == 0 && sport->freed_channels)
		complete(sport->freed_channels);
}

static void srpt_free_ch(struct kref *kref)
{
	struct srpt_rdma_ch *ch = container_of(kref, struct srpt_rdma_ch, kref);

	srpt_drop_sport_ref(ch->sport);
	kfree_rcu(ch, rcu);
}

/*
 * Shut down the SCSI target session, tell the connection manager to
 * disconnect the associated RDMA channel, transition the QP to the error
 * state and remove the channel from the channel list. This function is
 * typically called from inside srpt_zerolength_write_done(). Concurrent
 * srpt_zerolength_write() calls from inside srpt_close_ch() are possible
 * as long as the channel is on sport->nexus_list.
 */
static void srpt_release_channel_work(struct work_struct *w)
{
	struct srpt_rdma_ch *ch;
	struct srpt_device *sdev;
	struct srpt_port *sport;
	struct se_session *se_sess;

	ch = container_of(w, struct srpt_rdma_ch, release_work);
	pr_debug("%s-%d\n", ch->sess_name, ch->qp->qp_num);

	sdev = ch->sport->sdev;
	BUG_ON(!sdev);

	se_sess = ch->sess;
	BUG_ON(!se_sess);

	target_stop_session(se_sess);
	target_wait_for_sess_cmds(se_sess);

	target_remove_session(se_sess);
	ch->sess = NULL;

	if (ch->using_rdma_cm)
		rdma_destroy_id(ch->rdma_cm.cm_id);
	else
		ib_destroy_cm_id(ch->ib_cm.cm_id);

	sport = ch->sport;
	mutex_lock(&sport->mutex);
	list_del_rcu(&ch->list);
	mutex_unlock(&sport->mutex);

	if (ch->closed)
		complete(ch->closed);

	srpt_destroy_ch_ib(ch);

	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
			     ch->sport->sdev, ch->rq_size,
			     ch->rsp_buf_cache, DMA_TO_DEVICE);

	srpt_cache_put(ch->rsp_buf_cache);

	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_recv_ring,
			     sdev, ch->rq_size,
			     ch->req_buf_cache, DMA_FROM_DEVICE);

	srpt_cache_put(ch->req_buf_cache);

	kref_put(&ch->kref, srpt_free_ch);
}

/**
 * srpt_cm_req_recv - process the event IB_CM_REQ_RECEIVED
 * @sdev: HCA through which the login request was received.
 * @ib_cm_id: IB/CM connection identifier in case of IB/CM.
 * @rdma_cm_id: RDMA/CM connection identifier in case of RDMA/CM.
 * @port_num: Port through which the REQ message was received.
 * @pkey: P_Key of the incoming connection.
 * @req: SRP login request.
 * @src_addr: GID (IB/CM) or IP address (RDMA/CM) of the port that submitted
 * the login request.
 *
 * Ownership of the cm_id is transferred to the target session if this
 * function returns zero. Otherwise the caller remains the owner of cm_id.
 */
static int srpt_cm_req_recv(struct srpt_device *const sdev,
			    struct ib_cm_id *ib_cm_id,
			    struct rdma_cm_id *rdma_cm_id,
			    u8 port_num, __be16 pkey,
			    const struct srp_login_req *req,
			    const char *src_addr)
{
	struct srpt_port *sport = &sdev->port[port_num - 1];
	struct srpt_nexus *nexus;
	struct srp_login_rsp *rsp = NULL;
	struct srp_login_rej *rej = NULL;
	union {
		struct rdma_conn_param rdma_cm;
		struct ib_cm_rep_param ib_cm;
	} *rep_param = NULL;
	struct srpt_rdma_ch *ch = NULL;
	char i_port_id[36];
	u32 it_iu_len;
	int i, tag_num, tag_size, ret;
	struct srpt_tpg *stpg;

	WARN_ON_ONCE(irqs_disabled());

	it_iu_len = be32_to_cpu(req->req_it_iu_len);

	pr_info("Received SRP_LOGIN_REQ with i_port_id %pI6, t_port_id %pI6 and it_iu_len %d on port %d (guid=%pI6); pkey %#04x\n",
		req->initiator_port_id, req->target_port_id, it_iu_len,
		port_num, &sport->gid, be16_to_cpu(pkey));

	nexus = srpt_get_nexus(sport, req->initiator_port_id,
			       req->target_port_id);
	if (IS_ERR(nexus)) {
		ret = PTR_ERR(nexus);
		goto out;
	}

	ret = -ENOMEM;
	rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
	rej = kzalloc(sizeof(*rej), GFP_KERNEL);
	rep_param = kzalloc(sizeof(*rep_param), GFP_KERNEL);
	if (!rsp || !rej || !rep_param)
		goto out;

	ret = -EINVAL;
	if (it_iu_len > srp_max_req_size || it_iu_len < 64) {
		rej->reason = cpu_to_be32(
				SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE);
		pr_err("rejected SRP_LOGIN_REQ because its length (%d bytes) is out of range (%d .. %d)\n",
		       it_iu_len, 64, srp_max_req_size);
		goto reject;
	}

	if (!sport->enabled) {
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_info("rejected SRP_LOGIN_REQ because target port %s_%d has not yet been enabled\n",
			dev_name(&sport->sdev->device->dev), port_num);
		goto reject;
	}

	if (*(__be64 *)req->target_port_id != cpu_to_be64(srpt_service_guid)
	    || *(__be64 *)(req->target_port_id + 8) !=
	       cpu_to_be64(srpt_service_guid)) {
		rej->reason = cpu_to_be32(
				SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL);
		pr_err("rejected SRP_LOGIN_REQ because it has an invalid target port identifier.\n");
		goto reject;
	}

	ret = -ENOMEM;
	ch = kzalloc(sizeof(*ch), GFP_KERNEL);
	if (!ch) {
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_err("rejected SRP_LOGIN_REQ because out of memory.\n");
		goto reject;
	}

	kref_init(&ch->kref);
	ch->pkey = be16_to_cpu(pkey);
	ch->nexus = nexus;
	ch->zw_cqe.done = srpt_zerolength_write_done;
	INIT_WORK(&ch->release_work, srpt_release_channel_work);
	ch->sport = sport;
	if (rdma_cm_id) {
		ch->using_rdma_cm = true;
		ch->rdma_cm.cm_id = rdma_cm_id;
		rdma_cm_id->context = ch;
	} else {
		ch->ib_cm.cm_id = ib_cm_id;
		ib_cm_id->context = ch;
	}
	/*
	 * ch->rq_size should be at least as large as the initiator queue
	 * depth to avoid that the initiator driver has to report QUEUE_FULL
	 * to the SCSI mid-layer.
	 */
	ch->rq_size = min(MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
	spin_lock_init(&ch->spinlock);
	ch->state = CH_CONNECTING;
	INIT_LIST_HEAD(&ch->cmd_wait_list);
	ch->max_rsp_size = ch->sport->port_attrib.srp_max_rsp_size;

	ch->rsp_buf_cache = srpt_cache_get(ch->max_rsp_size);
	if (!ch->rsp_buf_cache)
		goto free_ch;

	ch->ioctx_ring = (struct srpt_send_ioctx **)
		srpt_alloc_ioctx_ring(ch->sport->sdev, ch->rq_size,
				      sizeof(*ch->ioctx_ring[0]),
				      ch->rsp_buf_cache, 0, DMA_TO_DEVICE);
	if (!ch->ioctx_ring) {
		pr_err("rejected SRP_LOGIN_REQ because creating a new QP SQ ring failed.\n");
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		goto free_rsp_cache;
	}

	for (i = 0; i < ch->rq_size; i++)
		ch->ioctx_ring[i]->ch = ch;
	if (!sdev->use_srq) {
		u16 imm_data_offset = req->req_flags & SRP_IMMED_REQUESTED ?
			be16_to_cpu(req->imm_data_offset) : 0;
		u16 alignment_offset;
		u32 req_sz;

		if (req->req_flags & SRP_IMMED_REQUESTED)
			pr_debug("imm_data_offset = %d\n",
				 be16_to_cpu(req->imm_data_offset));
		if (imm_data_offset >= sizeof(struct srp_cmd)) {
			ch->imm_data_offset = imm_data_offset;
			rsp->rsp_flags |= SRP_LOGIN_RSP_IMMED_SUPP;
		} else {
			ch->imm_data_offset = 0;
		}
		alignment_offset = round_up(imm_data_offset, 512) -
			imm_data_offset;
		req_sz = alignment_offset + imm_data_offset + srp_max_req_size;
		ch->req_buf_cache = srpt_cache_get(req_sz);
		if (!ch->req_buf_cache)
			goto free_rsp_ring;

		ch->ioctx_recv_ring = (struct srpt_recv_ioctx **)
			srpt_alloc_ioctx_ring(ch->sport->sdev, ch->rq_size,
					      sizeof(*ch->ioctx_recv_ring[0]),
					      ch->req_buf_cache,
					      alignment_offset,
					      DMA_FROM_DEVICE);
		if (!ch->ioctx_recv_ring) {
			pr_err("rejected SRP_LOGIN_REQ because creating a new QP RQ ring failed.\n");
			rej->reason =
			    cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
			goto free_recv_cache;
		}
		for (i = 0; i < ch->rq_size; i++)
			INIT_LIST_HEAD(&ch->ioctx_recv_ring[i]->wait_list);
	}

	ret = srpt_create_ch_ib(ch);
	if (ret) {
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_err("rejected SRP_LOGIN_REQ because creating a new RDMA channel failed.\n");
		goto free_recv_ring;
	}

	strscpy(ch->sess_name, src_addr, sizeof(ch->sess_name));
	snprintf(i_port_id, sizeof(i_port_id), "0x%016llx%016llx",
			be64_to_cpu(*(__be64 *)nexus->i_port_id),
			be64_to_cpu(*(__be64 *)(nexus->i_port_id + 8)));

	pr_debug("registering src addr %s or i_port_id %s\n", ch->sess_name,
		 i_port_id);

	tag_num = ch->rq_size;
	tag_size = 1; /* ib_srpt does not use se_sess->sess_cmd_map */

	if (sport->guid_id) {
		mutex_lock(&sport->guid_id->mutex);
		list_for_each_entry(stpg, &sport->guid_id->tpg_list, entry) {
			if (!IS_ERR_OR_NULL(ch->sess))
				break;
			ch->sess = target_setup_session(&stpg->tpg, tag_num,
						tag_size, TARGET_PROT_NORMAL,
						ch->sess_name, ch, NULL);
		}
		mutex_unlock(&sport->guid_id->mutex);
	}

	if (sport->gid_id) {
		mutex_lock(&sport->gid_id->mutex);
		list_for_each_entry(stpg, &sport->gid_id->tpg_list, entry) {
			if (!IS_ERR_OR_NULL(ch->sess))
				break;
			ch->sess = target_setup_session(&stpg->tpg, tag_num,
					tag_size, TARGET_PROT_NORMAL, i_port_id,
					ch, NULL);
			if (!IS_ERR_OR_NULL(ch->sess))
				break;
			/* Retry without leading "0x" */
			ch->sess = target_setup_session(&stpg->tpg, tag_num,
						tag_size, TARGET_PROT_NORMAL,
						i_port_id + 2, ch, NULL);
		}
		mutex_unlock(&sport->gid_id->mutex);
	}

	if (IS_ERR_OR_NULL(ch->sess)) {
		WARN_ON_ONCE(ch->sess == NULL);
		ret = PTR_ERR(ch->sess);
		ch->sess = NULL;
		pr_info("Rejected login for initiator %s: ret = %d.\n",
			ch->sess_name, ret);
		rej->reason = cpu_to_be32(ret == -ENOMEM ?
				SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES :
				SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
		goto destroy_ib;
	}

	/*
	 * Once a session has been created destruction of srpt_rdma_ch objects
	 * will decrement sport->refcount. Hence increment sport->refcount now.
	 */
	atomic_inc(&sport->refcount);

	mutex_lock(&sport->mutex);

	if ((req->req_flags & SRP_MTCH_ACTION) == SRP_MULTICHAN_SINGLE) {
		struct srpt_rdma_ch *ch2;

		list_for_each_entry(ch2, &nexus->ch_list, list) {
			if (srpt_disconnect_ch(ch2) < 0)
				continue;
			pr_info("Relogin - closed existing channel %s\n",
				ch2->sess_name);
			rsp->rsp_flags |= SRP_LOGIN_RSP_MULTICHAN_TERMINATED;
		}
	} else {
		rsp->rsp_flags |= SRP_LOGIN_RSP_MULTICHAN_MAINTAINED;
	}

	list_add_tail_rcu(&ch->list, &nexus->ch_list);

	if (!sport->enabled) {
		rej->reason = cpu_to_be32(
				SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n",
			dev_name(&sdev->device->dev), port_num);
		mutex_unlock(&sport->mutex);
		ret = -EINVAL;
		goto reject;
	}

	mutex_unlock(&sport->mutex);

	ret = ch->using_rdma_cm ? 0 : srpt_ch_qp_rtr(ch, ch->qp);
	if (ret) {
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_err("rejected SRP_LOGIN_REQ because enabling RTR failed (error code = %d)\n",
		       ret);
		goto reject;
	}

	pr_debug("Establish connection sess=%p name=%s ch=%p\n", ch->sess,
		 ch->sess_name, ch);

	/* create srp_login_response */
	rsp->opcode = SRP_LOGIN_RSP;
	rsp->tag = req->tag;
	rsp->max_it_iu_len = cpu_to_be32(srp_max_req_size);
	rsp->max_ti_iu_len = req->req_it_iu_len;
	ch->max_ti_iu_len = it_iu_len;
	rsp->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
				   SRP_BUF_FORMAT_INDIRECT);
	rsp->req_lim_delta = cpu_to_be32(ch->rq_size);
	atomic_set(&ch->req_lim, ch->rq_size);
	atomic_set(&ch->req_lim_delta, 0);

	/* create cm reply */
	if (ch->using_rdma_cm) {
		rep_param->rdma_cm.private_data = (void *)rsp;
		rep_param->rdma_cm.private_data_len = sizeof(*rsp);
		rep_param->rdma_cm.rnr_retry_count = 7;
		rep_param->rdma_cm.flow_control = 1;
		rep_param->rdma_cm.responder_resources = 4;
		rep_param->rdma_cm.initiator_depth = 4;
	} else {
		rep_param->ib_cm.qp_num = ch->qp->qp_num;
		rep_param->ib_cm.private_data = (void *)rsp;
		rep_param->ib_cm.private_data_len = sizeof(*rsp);
		rep_param->ib_cm.rnr_retry_count = 7;
		rep_param->ib_cm.flow_control = 1;
		rep_param->ib_cm.failover_accepted = 0;
		rep_param->ib_cm.srq = 1;
		rep_param->ib_cm.responder_resources = 4;
		rep_param->ib_cm.initiator_depth = 4;
	}

	/*
	 * Hold the sport mutex while accepting a connection to avoid that
	 * srpt_disconnect_ch() is invoked concurrently with this code.
	 */
	mutex_lock(&sport->mutex);
	if (sport->enabled && ch->state == CH_CONNECTING) {
		if (ch->using_rdma_cm)
			ret = rdma_accept(rdma_cm_id, &rep_param->rdma_cm);
		else
			ret = ib_send_cm_rep(ib_cm_id, &rep_param->ib_cm);
	} else {
		ret = -EINVAL;
	}
	mutex_unlock(&sport->mutex);

	switch (ret) {
	case 0:
		break;
	case -EINVAL:
		goto reject;
	default:
		rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
		pr_err("sending SRP_LOGIN_REQ response failed (error code = %d)\n",
		       ret);
		goto reject;
	}

	goto out;

destroy_ib:
	srpt_destroy_ch_ib(ch);

free_recv_ring:
	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_recv_ring,
			     ch->sport->sdev, ch->rq_size,
			     ch->req_buf_cache, DMA_FROM_DEVICE);

free_recv_cache:
	srpt_cache_put(ch->req_buf_cache);

free_rsp_ring:
	srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
			     ch->sport->sdev, ch->rq_size,
			     ch->rsp_buf_cache, DMA_TO_DEVICE);

free_rsp_cache:
	srpt_cache_put(ch->rsp_buf_cache);

free_ch:
	if (rdma_cm_id)
		rdma_cm_id->context = NULL;
	else
		ib_cm_id->context = NULL;
	kfree(ch);
	ch = NULL;

	WARN_ON_ONCE(ret == 0);

reject:
	pr_info("Rejecting login with reason %#x\n", be32_to_cpu(rej->reason));
	rej->opcode = SRP_LOGIN_REJ;
	rej->tag = req->tag;
	rej->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT |
				   SRP_BUF_FORMAT_INDIRECT);

	if (rdma_cm_id)
		rdma_reject(rdma_cm_id, rej, sizeof(*rej),
			    IB_CM_REJ_CONSUMER_DEFINED);
	else
		ib_send_cm_rej(ib_cm_id, IB_CM_REJ_CONSUMER_DEFINED, NULL, 0,
			       rej, sizeof(*rej));

	if (ch && ch->sess) {
		srpt_close_ch(ch);
		/*
		 * Tell the caller not to free cm_id since
		 * srpt_release_channel_work() will do that.
		 */
		ret = 0;
	}

out:
	kfree(rep_param);
	kfree(rsp);
	kfree(rej);

	return ret;
}

static int srpt_ib_cm_req_recv(struct ib_cm_id *cm_id,
			       const struct ib_cm_req_event_param *param,
			       void *private_data)
{
	char sguid[40];

	srpt_format_guid(sguid, sizeof(sguid),
			 &param->primary_path->dgid.global.interface_id);

	return srpt_cm_req_recv(cm_id->context, cm_id, NULL, param->port,
				param->primary_path->pkey,
				private_data, sguid);
}

static int srpt_rdma_cm_req_recv(struct rdma_cm_id *cm_id,
				 struct rdma_cm_event *event)
{
	struct srpt_device *sdev;
	struct srp_login_req req;
	const struct srp_login_req_rdma *req_rdma;
	struct sa_path_rec *path_rec = cm_id->route.path_rec;
	char src_addr[40];

	sdev = ib_get_client_data(cm_id->device, &srpt_client);
	if (!sdev)
		return -ECONNREFUSED;

	if (event->param.conn.private_data_len < sizeof(*req_rdma))
		return -EINVAL;

	/* Transform srp_login_req_rdma into srp_login_req. */
	req_rdma = event->param.conn.private_data;
	memset(&req, 0, sizeof(req));
	req.opcode		= req_rdma->opcode;
	req.tag			= req_rdma->tag;
	req.req_it_iu_len	= req_rdma->req_it_iu_len;
	req.req_buf_fmt		= req_rdma->req_buf_fmt;
	req.req_flags		= req_rdma->req_flags;
	memcpy(req.initiator_port_id, req_rdma->initiator_port_id, 16);
	memcpy(req.target_port_id, req_rdma->target_port_id, 16);
	req.imm_data_offset	= req_rdma->imm_data_offset;

	snprintf(src_addr, sizeof(src_addr), "%pIS",
		 &cm_id->route.addr.src_addr);

	return srpt_cm_req_recv(sdev, NULL, cm_id, cm_id->port_num,
				path_rec ? path_rec->pkey : 0, &req, src_addr);
}

static void srpt_cm_rej_recv(struct srpt_rdma_ch *ch,
			     enum ib_cm_rej_reason reason,
			     const u8 *private_data,
			     u8 private_data_len)
{
	char *priv = NULL;
	int i;

	if (private_data_len && (priv = kmalloc(private_data_len * 3 + 1,
						GFP_KERNEL))) {
		for (i = 0; i < private_data_len; i++)
			sprintf(priv + 3 * i, " %02x", private_data[i]);
	}
	pr_info("Received CM REJ for ch %s-%d; reason %d%s%s.\n",
		ch->sess_name, ch->qp->qp_num, reason, private_data_len ?
		"; private data" : "", priv ? priv : " (?)");
	kfree(priv);
}

/**
 * srpt_cm_rtu_recv - process an IB_CM_RTU_RECEIVED or USER_ESTABLISHED event
 * @ch: SRPT RDMA channel.
 *
 * An RTU (ready to use) message indicates that the connection has been
 * established and that the recipient may begin transmitting.
 */
static void srpt_cm_rtu_recv(struct srpt_rdma_ch *ch)
{
	int ret;

	ret = ch->using_rdma_cm ? 0 : srpt_ch_qp_rts(ch, ch->qp);
	if (ret < 0) {
		pr_err("%s-%d: QP transition to RTS failed\n", ch->sess_name,
		       ch->qp->qp_num);
		srpt_close_ch(ch);
		return;
	}

	/*
	 * Note: calling srpt_close_ch() if the transition to the LIVE state
	 * fails is not necessary since that means that that function has
	 * already been invoked from another thread.
	 */
	if (!srpt_set_ch_state(ch, CH_LIVE)) {
		pr_err("%s-%d: channel transition to LIVE state failed\n",
		       ch->sess_name, ch->qp->qp_num);
		return;
	}

	/* Trigger wait list processing. */
	ret = srpt_zerolength_write(ch);
	WARN_ONCE(ret < 0, "%d\n", ret);
}

/**
 * srpt_cm_handler - IB connection manager callback function
 * @cm_id: IB/CM connection identifier.
 * @event: IB/CM event.
 *
 * A non-zero return value will cause the caller destroy the CM ID.
 *
 * Note: srpt_cm_handler() must only return a non-zero value when transferring
 * ownership of the cm_id to a channel by srpt_cm_req_recv() failed. Returning
 * a non-zero value in any other case will trigger a race with the
 * ib_destroy_cm_id() call in srpt_release_channel().
 */
static int srpt_cm_handler(struct ib_cm_id *cm_id,
			   const struct ib_cm_event *event)
{
	struct srpt_rdma_ch *ch = cm_id->context;
	int ret;

	ret = 0;
	switch (event->event) {
	case IB_CM_REQ_RECEIVED:
		ret = srpt_ib_cm_req_recv(cm_id, &event->param.req_rcvd,
					  event->private_data);
		break;
	case IB_CM_REJ_RECEIVED:
		srpt_cm_rej_recv(ch, event->param.rej_rcvd.reason,
				 event->private_data,
				 IB_CM_REJ_PRIVATE_DATA_SIZE);
		break;
	case IB_CM_RTU_RECEIVED:
	case IB_CM_USER_ESTABLISHED:
		srpt_cm_rtu_recv(ch);
		break;
	case IB_CM_DREQ_RECEIVED:
		srpt_disconnect_ch(ch);
		break;
	case IB_CM_DREP_RECEIVED:
		pr_info("Received CM DREP message for ch %s-%d.\n",
			ch->sess_name, ch->qp->qp_num);
		srpt_close_ch(ch);
		break;
	case IB_CM_TIMEWAIT_EXIT:
		pr_info("Received CM TimeWait exit for ch %s-%d.\n",
			ch->sess_name, ch->qp->qp_num);
		srpt_close_ch(ch);
		break;
	case IB_CM_REP_ERROR:
		pr_info("Received CM REP error for ch %s-%d.\n", ch->sess_name,
			ch->qp->qp_num);
		break;
	case IB_CM_DREQ_ERROR:
		pr_info("Received CM DREQ ERROR event.\n");
		break;
	case IB_CM_MRA_RECEIVED:
		pr_info("Received CM MRA event\n");
		break;
	default:
		pr_err("received unrecognized CM event %d\n", event->event);
		break;
	}

	return ret;
}

static int srpt_rdma_cm_handler(struct rdma_cm_id *cm_id,
				struct rdma_cm_event *event)
{
	struct srpt_rdma_ch *ch = cm_id->context;
	int ret = 0;

	switch (event->event) {
	case RDMA_CM_EVENT_CONNECT_REQUEST:
		ret = srpt_rdma_cm_req_recv(cm_id, event);
		break;
	case RDMA_CM_EVENT_REJECTED:
		srpt_cm_rej_recv(ch, event->status,
				 event->param.conn.private_data,
				 event->param.conn.private_data_len);
		break;
	case RDMA_CM_EVENT_ESTABLISHED:
		srpt_cm_rtu_recv(ch);
		break;
	case RDMA_CM_EVENT_DISCONNECTED:
		if (ch->state < CH_DISCONNECTING)
			srpt_disconnect_ch(ch);
		else
			srpt_close_ch(ch);
		break;
	case RDMA_CM_EVENT_TIMEWAIT_EXIT:
		srpt_close_ch(ch);
		break;
	case RDMA_CM_EVENT_UNREACHABLE:
		pr_info("Received CM REP error for ch %s-%d.\n", ch->sess_name,
			ch->qp->qp_num);
		break;
	case RDMA_CM_EVENT_DEVICE_REMOVAL:
	case RDMA_CM_EVENT_ADDR_CHANGE:
		break;
	default:
		pr_err("received unrecognized RDMA CM event %d\n",
		       event->event);
		break;
	}

	return ret;
}

/*
 * srpt_write_pending - Start data transfer from initiator to target (write).
 */
static int srpt_write_pending(struct se_cmd *se_cmd)
{
	struct srpt_send_ioctx *ioctx =
		container_of(se_cmd, struct srpt_send_ioctx, cmd);
	struct srpt_rdma_ch *ch = ioctx->ch;
	struct ib_send_wr *first_wr = NULL;
	struct ib_cqe *cqe = &ioctx->rdma_cqe;
	enum srpt_command_state new_state;
	int ret, i;

	if (ioctx->recv_ioctx) {
		srpt_set_cmd_state(ioctx, SRPT_STATE_DATA_IN);
		target_execute_cmd(&ioctx->cmd);
		return 0;
	}

	new_state = srpt_set_cmd_state(ioctx, SRPT_STATE_NEED_DATA);
	WARN_ON(new_state == SRPT_STATE_DONE);

	if (atomic_sub_return(ioctx->n_rdma, &ch->sq_wr_avail) < 0) {
		pr_warn("%s: IB send queue full (needed %d)\n",
				__func__, ioctx->n_rdma);
		ret = -ENOMEM;
		goto out_undo;
	}

	cqe->done = srpt_rdma_read_done;
	for (i = ioctx->n_rw_ctx - 1; i >= 0; i--) {
		struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];

		first_wr = rdma_rw_ctx_wrs(&ctx->rw, ch->qp, ch->sport->port,
				cqe, first_wr);
		cqe = NULL;
	}

	ret = ib_post_send(ch->qp, first_wr, NULL);
	if (ret) {
		pr_err("%s: ib_post_send() returned %d for %d (avail: %d)\n",
			 __func__, ret, ioctx->n_rdma,
			 atomic_read(&ch->sq_wr_avail));
		goto out_undo;
	}

	return 0;
out_undo:
	atomic_add(ioctx->n_rdma, &ch->sq_wr_avail);
	return ret;
}

static u8 tcm_to_srp_tsk_mgmt_status(const int tcm_mgmt_status)
{
	switch (tcm_mgmt_status) {
	case TMR_FUNCTION_COMPLETE:
		return SRP_TSK_MGMT_SUCCESS;
	case TMR_FUNCTION_REJECTED:
		return SRP_TSK_MGMT_FUNC_NOT_SUPP;
	}
	return SRP_TSK_MGMT_FAILED;
}

/**
 * srpt_queue_response - transmit the response to a SCSI command
 * @cmd: SCSI target command.
 *
 * Callback function called by the TCM core. Must not block since it can be
 * invoked on the context of the IB completion handler.
 */
static void srpt_queue_response(struct se_cmd *cmd)
{
	struct srpt_send_ioctx *ioctx =
		container_of(cmd, struct srpt_send_ioctx, cmd);
	struct srpt_rdma_ch *ch = ioctx->ch;
	struct srpt_device *sdev = ch->sport->sdev;
	struct ib_send_wr send_wr, *first_wr = &send_wr;
	struct ib_sge sge;
	enum srpt_command_state state;
	int resp_len, ret, i;
	u8 srp_tm_status;

	state = ioctx->state;
	switch (state) {
	case SRPT_STATE_NEW:
	case SRPT_STATE_DATA_IN:
		ioctx->state = SRPT_STATE_CMD_RSP_SENT;
		break;
	case SRPT_STATE_MGMT:
		ioctx->state = SRPT_STATE_MGMT_RSP_SENT;
		break;
	default:
		WARN(true, "ch %p; cmd %d: unexpected command state %d\n",
			ch, ioctx->ioctx.index, ioctx->state);
		break;
	}

	if (WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))
		return;

	/* For read commands, transfer the data to the initiator. */
	if (ioctx->cmd.data_direction == DMA_FROM_DEVICE &&
	    ioctx->cmd.data_length &&
	    !ioctx->queue_status_only) {
		for (i = ioctx->n_rw_ctx - 1; i >= 0; i--) {
			struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];

			first_wr = rdma_rw_ctx_wrs(&ctx->rw, ch->qp,
					ch->sport->port, NULL, first_wr);
		}
	}

	if (state != SRPT_STATE_MGMT)
		resp_len = srpt_build_cmd_rsp(ch, ioctx, ioctx->cmd.tag,
					      cmd->scsi_status);
	else {
		srp_tm_status
			= tcm_to_srp_tsk_mgmt_status(cmd->se_tmr_req->response);
		resp_len = srpt_build_tskmgmt_rsp(ch, ioctx, srp_tm_status,
						 ioctx->cmd.tag);
	}

	atomic_inc(&ch->req_lim);

	if (unlikely(atomic_sub_return(1 + ioctx->n_rdma,
			&ch->sq_wr_avail) < 0)) {
		pr_warn("%s: IB send queue full (needed %d)\n",
				__func__, ioctx->n_rdma);
		goto out;
	}

	ib_dma_sync_single_for_device(sdev->device, ioctx->ioctx.dma, resp_len,
				      DMA_TO_DEVICE);

	sge.addr = ioctx->ioctx.dma;
	sge.length = resp_len;
	sge.lkey = sdev->lkey;

	ioctx->ioctx.cqe.done = srpt_send_done;
	send_wr.next = NULL;
	send_wr.wr_cqe = &ioctx->ioctx.cqe;
	send_wr.sg_list = &sge;
	send_wr.num_sge = 1;
	send_wr.opcode = IB_WR_SEND;
	send_wr.send_flags = IB_SEND_SIGNALED;

	ret = ib_post_send(ch->qp, first_wr, NULL);
	if (ret < 0) {
		pr_err("%s: sending cmd response failed for tag %llu (%d)\n",
			__func__, ioctx->cmd.tag, ret);
		goto out;
	}

	return;

out:
	atomic_add(1 + ioctx->n_rdma, &ch->sq_wr_avail);
	atomic_dec(&ch->req_lim);
	srpt_set_cmd_state(ioctx, SRPT_STATE_DONE);
	target_put_sess_cmd(&ioctx->cmd);
}

static int srpt_queue_data_in(struct se_cmd *cmd)
{
	srpt_queue_response(cmd);
	return 0;
}

static void srpt_queue_tm_rsp(struct se_cmd *cmd)
{
	srpt_queue_response(cmd);
}

/*
 * This function is called for aborted commands if no response is sent to the
 * initiator. Make sure that the credits freed by aborting a command are
 * returned to the initiator the next time a response is sent by incrementing
 * ch->req_lim_delta.
 */
static void srpt_aborted_task(struct se_cmd *cmd)
{
	struct srpt_send_ioctx *ioctx = container_of(cmd,
				struct srpt_send_ioctx, cmd);
	struct srpt_rdma_ch *ch = ioctx->ch;

	atomic_inc(&ch->req_lim_delta);
}

static int srpt_queue_status(struct se_cmd *cmd)
{
	struct srpt_send_ioctx *ioctx;

	ioctx = container_of(cmd, struct srpt_send_ioctx, cmd);
	BUG_ON(ioctx->sense_data != cmd->sense_buffer);
	if (cmd->se_cmd_flags &
	    (SCF_TRANSPORT_TASK_SENSE | SCF_EMULATED_TASK_SENSE))
		WARN_ON(cmd->scsi_status != SAM_STAT_CHECK_CONDITION);
	ioctx->queue_status_only = true;
	srpt_queue_response(cmd);
	return 0;
}

static void srpt_refresh_port_work(struct work_struct *work)
{
	struct srpt_port *sport = container_of(work, struct srpt_port, work);

	srpt_refresh_port(sport);
}

/**
 * srpt_release_sport - disable login and wait for associated channels
 * @sport: SRPT HCA port.
 */
static int srpt_release_sport(struct srpt_port *sport)
{
	DECLARE_COMPLETION_ONSTACK(c);
	struct srpt_nexus *nexus, *next_n;
	struct srpt_rdma_ch *ch;

	WARN_ON_ONCE(irqs_disabled());

	sport->freed_channels = &c;

	mutex_lock(&sport->mutex);
	srpt_set_enabled(sport, false);
	mutex_unlock(&sport->mutex);

	while (atomic_read(&sport->refcount) > 0 &&
	       wait_for_completion_timeout(&c, 5 * HZ) <= 0) {
		pr_info("%s_%d: waiting for unregistration of %d sessions ...\n",
			dev_name(&sport->sdev->device->dev), sport->port,
			atomic_read(&sport->refcount));
		rcu_read_lock();
		list_for_each_entry(nexus, &sport->nexus_list, entry) {
			list_for_each_entry(ch, &nexus->ch_list, list) {
				pr_info("%s-%d: state %s\n",
					ch->sess_name, ch->qp->qp_num,
					get_ch_state_name(ch->state));
			}
		}
		rcu_read_unlock();
	}

	mutex_lock(&sport->mutex);
	list_for_each_entry_safe(nexus, next_n, &sport->nexus_list, entry) {
		list_del(&nexus->entry);
		kfree_rcu(nexus, rcu);
	}
	mutex_unlock(&sport->mutex);

	return 0;
}

struct port_and_port_id {
	struct srpt_port *sport;
	struct srpt_port_id **port_id;
};

static struct port_and_port_id __srpt_lookup_port(const char *name)
{
	struct ib_device *dev;
	struct srpt_device *sdev;
	struct srpt_port *sport;
	int i;

	list_for_each_entry(sdev, &srpt_dev_list, list) {
		dev = sdev->device;
		if (!dev)
			continue;

		for (i = 0; i < dev->phys_port_cnt; i++) {
			sport = &sdev->port[i];

			if (strcmp(sport->guid_name, name) == 0) {
				kref_get(&sdev->refcnt);
				return (struct port_and_port_id){
					sport, &sport->guid_id};
			}
			if (strcmp(sport->gid_name, name) == 0) {
				kref_get(&sdev->refcnt);
				return (struct port_and_port_id){
					sport, &sport->gid_id};
			}
		}
	}

	return (struct port_and_port_id){};
}

/**
 * srpt_lookup_port() - Look up an RDMA port by name
 * @name: ASCII port name
 *
 * Increments the RDMA port reference count if an RDMA port pointer is returned.
 * The caller must drop that reference count by calling srpt_port_put_ref().
 */
static struct port_and_port_id srpt_lookup_port(const char *name)
{
	struct port_and_port_id papi;

	spin_lock(&srpt_dev_lock);
	papi = __srpt_lookup_port(name);
	spin_unlock(&srpt_dev_lock);

	return papi;
}

static void srpt_free_srq(struct srpt_device *sdev)
{
	if (!sdev->srq)
		return;

	ib_destroy_srq(sdev->srq);
	srpt_free_ioctx_ring((struct srpt_ioctx **)sdev->ioctx_ring, sdev,
			     sdev->srq_size, sdev->req_buf_cache,
			     DMA_FROM_DEVICE);
	srpt_cache_put(sdev->req_buf_cache);
	sdev->srq = NULL;
}

static int srpt_alloc_srq(struct srpt_device *sdev)
{
	struct ib_srq_init_attr srq_attr = {
		.event_handler = srpt_srq_event,
		.srq_context = (void *)sdev,
		.attr.max_wr = sdev->srq_size,
		.attr.max_sge = 1,
		.srq_type = IB_SRQT_BASIC,
	};
	struct ib_device *device = sdev->device;
	struct ib_srq *srq;
	int i;

	WARN_ON_ONCE(sdev->srq);
	srq = ib_create_srq(sdev->pd, &srq_attr);
	if (IS_ERR(srq)) {
		pr_debug("ib_create_srq() failed: %pe\n", srq);
		return PTR_ERR(srq);
	}

	pr_debug("create SRQ #wr= %d max_allow=%d dev= %s\n", sdev->srq_size,
		 sdev->device->attrs.max_srq_wr, dev_name(&device->dev));

	sdev->req_buf_cache = srpt_cache_get(srp_max_req_size);
	if (!sdev->req_buf_cache)
		goto free_srq;

	sdev->ioctx_ring = (struct srpt_recv_ioctx **)
		srpt_alloc_ioctx_ring(sdev, sdev->srq_size,
				      sizeof(*sdev->ioctx_ring[0]),
				      sdev->req_buf_cache, 0, DMA_FROM_DEVICE);
	if (!sdev->ioctx_ring)
		goto free_cache;

	sdev->use_srq = true;
	sdev->srq = srq;

	for (i = 0; i < sdev->srq_size; ++i) {
		INIT_LIST_HEAD(&sdev->ioctx_ring[i]->wait_list);
		srpt_post_recv(sdev, NULL, sdev->ioctx_ring[i]);
	}

	return 0;

free_cache:
	srpt_cache_put(sdev->req_buf_cache);

free_srq:
	ib_destroy_srq(srq);
	return -ENOMEM;
}

static int srpt_use_srq(struct srpt_device *sdev, bool use_srq)
{
	struct ib_device *device = sdev->device;
	int ret = 0;

	if (!use_srq) {
		srpt_free_srq(sdev);
		sdev->use_srq = false;
	} else if (use_srq && !sdev->srq) {
		ret = srpt_alloc_srq(sdev);
	}
	pr_debug("%s(%s): use_srq = %d; ret = %d\n", __func__,
		 dev_name(&device->dev), sdev->use_srq, ret);
	return ret;
}

static void srpt_free_sdev(struct kref *refcnt)
{
	struct srpt_device *sdev = container_of(refcnt, typeof(*sdev), refcnt);

	kfree(sdev);
}

static void srpt_sdev_put(struct srpt_device *sdev)
{
	kref_put(&sdev->refcnt, srpt_free_sdev);
}

/**
 * srpt_add_one - InfiniBand device addition callback function
 * @device: Describes a HCA.
 */
static int srpt_add_one(struct ib_device *device)
{
	struct srpt_device *sdev;
	struct srpt_port *sport;
	int ret;
	u32 i;

	pr_debug("device = %p\n", device);

	sdev = kzalloc(struct_size(sdev, port, device->phys_port_cnt),
		       GFP_KERNEL);
	if (!sdev)
		return -ENOMEM;

	kref_init(&sdev->refcnt);
	sdev->device = device;
	mutex_init(&sdev->sdev_mutex);

	sdev->pd = ib_alloc_pd(device, 0);
	if (IS_ERR(sdev->pd)) {
		ret = PTR_ERR(sdev->pd);
		goto free_dev;
	}

	sdev->lkey = sdev->pd->local_dma_lkey;

	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);

	srpt_use_srq(sdev, sdev->port[0].port_attrib.use_srq);

	if (!srpt_service_guid)
		srpt_service_guid = be64_to_cpu(device->node_guid);

	if (rdma_port_get_link_layer(device, 1) == IB_LINK_LAYER_INFINIBAND)
		sdev->cm_id = ib_create_cm_id(device, srpt_cm_handler, sdev);
	if (IS_ERR(sdev->cm_id)) {
		pr_info("ib_create_cm_id() failed: %pe\n", sdev->cm_id);
		ret = PTR_ERR(sdev->cm_id);
		sdev->cm_id = NULL;
		if (!rdma_cm_id)
			goto err_ring;
	}

	/* print out target login information */
	pr_debug("Target login info: id_ext=%016llx,ioc_guid=%016llx,pkey=ffff,service_id=%016llx\n",
		 srpt_service_guid, srpt_service_guid, srpt_service_guid);

	/*
	 * We do not have a consistent service_id (ie. also id_ext of target_id)
	 * to identify this target. We currently use the guid of the first HCA
	 * in the system as service_id; therefore, the target_id will change
	 * if this HCA is gone bad and replaced by different HCA
	 */
	ret = sdev->cm_id ?
		ib_cm_listen(sdev->cm_id, cpu_to_be64(srpt_service_guid)) :
		0;
	if (ret < 0) {
		pr_err("ib_cm_listen() failed: %d (cm_id state = %d)\n", ret,
		       sdev->cm_id->state);
		goto err_cm;
	}

	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,
			      srpt_event_handler);

	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
		sport = &sdev->port[i - 1];
		INIT_LIST_HEAD(&sport->nexus_list);
		mutex_init(&sport->mutex);
		sport->sdev = sdev;
		sport->port = i;
		sport->port_attrib.srp_max_rdma_size = DEFAULT_MAX_RDMA_SIZE;
		sport->port_attrib.srp_max_rsp_size = DEFAULT_MAX_RSP_SIZE;
		sport->port_attrib.srp_sq_size = DEF_SRPT_SQ_SIZE;
		sport->port_attrib.use_srq = false;
		INIT_WORK(&sport->work, srpt_refresh_port_work);

		ret = srpt_refresh_port(sport);
		if (ret) {
			pr_err("MAD registration failed for %s-%d.\n",
			       dev_name(&sdev->device->dev), i);
			i--;
			goto err_port;
		}
	}

	ib_register_event_handler(&sdev->event_handler);
	spin_lock(&srpt_dev_lock);
	list_add_tail(&sdev->list, &srpt_dev_list);
	spin_unlock(&srpt_dev_lock);

	ib_set_client_data(device, &srpt_client, sdev);
	pr_debug("added %s.\n", dev_name(&device->dev));
	return 0;

err_port:
	srpt_unregister_mad_agent(sdev, i);
err_cm:
	if (sdev->cm_id)
		ib_destroy_cm_id(sdev->cm_id);
err_ring:
	srpt_free_srq(sdev);
	ib_dealloc_pd(sdev->pd);
free_dev:
	srpt_sdev_put(sdev);
	pr_info("%s(%s) failed.\n", __func__, dev_name(&device->dev));
	return ret;
}

/**
 * srpt_remove_one - InfiniBand device removal callback function
 * @device: Describes a HCA.
 * @client_data: The value passed as the third argument to ib_set_client_data().
 */
static void srpt_remove_one(struct ib_device *device, void *client_data)
{
	struct srpt_device *sdev = client_data;
	int i;

	srpt_unregister_mad_agent(sdev, sdev->device->phys_port_cnt);

	ib_unregister_event_handler(&sdev->event_handler);

	/* Cancel any work queued by the just unregistered IB event handler. */
	for (i = 0; i < sdev->device->phys_port_cnt; i++)
		cancel_work_sync(&sdev->port[i].work);

	if (sdev->cm_id)
		ib_destroy_cm_id(sdev->cm_id);

	ib_set_client_data(device, &srpt_client, NULL);

	/*
	 * Unregistering a target must happen after destroying sdev->cm_id
	 * such that no new SRP_LOGIN_REQ information units can arrive while
	 * destroying the target.
	 */
	spin_lock(&srpt_dev_lock);
	list_del(&sdev->list);
	spin_unlock(&srpt_dev_lock);

	for (i = 0; i < sdev->device->phys_port_cnt; i++)
		srpt_release_sport(&sdev->port[i]);

	srpt_free_srq(sdev);

	ib_dealloc_pd(sdev->pd);

	srpt_sdev_put(sdev);
}

static struct ib_client srpt_client = {
	.name = DRV_NAME,
	.add = srpt_add_one,
	.remove = srpt_remove_one
};

static int srpt_check_true(struct se_portal_group *se_tpg)
{
	return 1;
}

static struct srpt_port *srpt_tpg_to_sport(struct se_portal_group *tpg)
{
	return tpg->se_tpg_wwn->priv;
}

static struct srpt_port_id *srpt_wwn_to_sport_id(struct se_wwn *wwn)
{
	struct srpt_port *sport = wwn->priv;

	if (sport->guid_id && &sport->guid_id->wwn == wwn)
		return sport->guid_id;
	if (sport->gid_id && &sport->gid_id->wwn == wwn)
		return sport->gid_id;
	WARN_ON_ONCE(true);
	return NULL;
}

static char *srpt_get_fabric_wwn(struct se_portal_group *tpg)
{
	struct srpt_tpg *stpg = container_of(tpg, typeof(*stpg), tpg);

	return stpg->sport_id->name;
}

static u16 srpt_get_tag(struct se_portal_group *tpg)
{
	return 1;
}

static void srpt_release_cmd(struct se_cmd *se_cmd)
{
	struct srpt_send_ioctx *ioctx = container_of(se_cmd,
				struct srpt_send_ioctx, cmd);
	struct srpt_rdma_ch *ch = ioctx->ch;
	struct srpt_recv_ioctx *recv_ioctx = ioctx->recv_ioctx;

	WARN_ON_ONCE(ioctx->state != SRPT_STATE_DONE &&
		     !(ioctx->cmd.transport_state & CMD_T_ABORTED));

	if (recv_ioctx) {
		WARN_ON_ONCE(!list_empty(&recv_ioctx->wait_list));
		ioctx->recv_ioctx = NULL;
		srpt_post_recv(ch->sport->sdev, ch, recv_ioctx);
	}

	if (ioctx->n_rw_ctx) {
		srpt_free_rw_ctxs(ch, ioctx);
		ioctx->n_rw_ctx = 0;
	}

	target_free_tag(se_cmd->se_sess, se_cmd);
}

/**
 * srpt_close_session - forcibly close a session
 * @se_sess: SCSI target session.
 *
 * Callback function invoked by the TCM core to clean up sessions associated
 * with a node ACL when the user invokes
 * rmdir /sys/kernel/config/target/$driver/$port/$tpg/acls/$i_port_id
 */
static void srpt_close_session(struct se_session *se_sess)
{
	struct srpt_rdma_ch *ch = se_sess->fabric_sess_ptr;

	srpt_disconnect_ch_sync(ch);
}

/* Note: only used from inside debug printk's by the TCM core. */
static int srpt_get_tcm_cmd_state(struct se_cmd *se_cmd)
{
	struct srpt_send_ioctx *ioctx;

	ioctx = container_of(se_cmd, struct srpt_send_ioctx, cmd);
	return ioctx->state;
}

static int srpt_parse_guid(u64 *guid, const char *name)
{
	u16 w[4];
	int ret = -EINVAL;

	if (sscanf(name, "%hx:%hx:%hx:%hx", &w[0], &w[1], &w[2], &w[3]) != 4)
		goto out;
	*guid = get_unaligned_be64(w);
	ret = 0;
out:
	return ret;
}

/**
 * srpt_parse_i_port_id - parse an initiator port ID
 * @name: ASCII representation of a 128-bit initiator port ID.
 * @i_port_id: Binary 128-bit port ID.
 */
static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
{
	const char *p;
	unsigned len, count, leading_zero_bytes;
	int ret;

	p = name;
	if (strncasecmp(p, "0x", 2) == 0)
		p += 2;
	ret = -EINVAL;
	len = strlen(p);
	if (len % 2)
		goto out;
	count = min(len / 2, 16U);
	leading_zero_bytes = 16 - count;
	memset(i_port_id, 0, leading_zero_bytes);
	ret = hex2bin(i_port_id + leading_zero_bytes, p, count);

out:
	return ret;
}

/*
 * configfs callback function invoked for mkdir
 * /sys/kernel/config/target/$driver/$port/$tpg/acls/$i_port_id
 *
 * i_port_id must be an initiator port GUID, GID or IP address. See also the
 * target_alloc_session() calls in this driver. Examples of valid initiator
 * port IDs:
 * 0x0000000000000000505400fffe4a0b7b
 * 0000000000000000505400fffe4a0b7b
 * 5054:00ff:fe4a:0b7b
 * 192.168.122.76
 */
static int srpt_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
{
	struct sockaddr_storage sa;
	u64 guid;
	u8 i_port_id[16];
	int ret;

	ret = srpt_parse_guid(&guid, name);
	if (ret < 0)
		ret = srpt_parse_i_port_id(i_port_id, name);
	if (ret < 0)
		ret = inet_pton_with_scope(&init_net, AF_UNSPEC, name, NULL,
					   &sa);
	if (ret < 0)
		pr_err("invalid initiator port ID %s\n", name);
	return ret;
}

static ssize_t srpt_tpg_attrib_srp_max_rdma_size_show(struct config_item *item,
		char *page)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);

	return sysfs_emit(page, "%u\n", sport->port_attrib.srp_max_rdma_size);
}

static ssize_t srpt_tpg_attrib_srp_max_rdma_size_store(struct config_item *item,
		const char *page, size_t count)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
	unsigned long val;
	int ret;

	ret = kstrtoul(page, 0, &val);
	if (ret < 0) {
		pr_err("kstrtoul() failed with ret: %d\n", ret);
		return -EINVAL;
	}
	if (val > MAX_SRPT_RDMA_SIZE) {
		pr_err("val: %lu exceeds MAX_SRPT_RDMA_SIZE: %d\n", val,
			MAX_SRPT_RDMA_SIZE);
		return -EINVAL;
	}
	if (val < DEFAULT_MAX_RDMA_SIZE) {
		pr_err("val: %lu smaller than DEFAULT_MAX_RDMA_SIZE: %d\n",
			val, DEFAULT_MAX_RDMA_SIZE);
		return -EINVAL;
	}
	sport->port_attrib.srp_max_rdma_size = val;

	return count;
}

static ssize_t srpt_tpg_attrib_srp_max_rsp_size_show(struct config_item *item,
		char *page)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);

	return sysfs_emit(page, "%u\n", sport->port_attrib.srp_max_rsp_size);
}

static ssize_t srpt_tpg_attrib_srp_max_rsp_size_store(struct config_item *item,
		const char *page, size_t count)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
	unsigned long val;
	int ret;

	ret = kstrtoul(page, 0, &val);
	if (ret < 0) {
		pr_err("kstrtoul() failed with ret: %d\n", ret);
		return -EINVAL;
	}
	if (val > MAX_SRPT_RSP_SIZE) {
		pr_err("val: %lu exceeds MAX_SRPT_RSP_SIZE: %d\n", val,
			MAX_SRPT_RSP_SIZE);
		return -EINVAL;
	}
	if (val < MIN_MAX_RSP_SIZE) {
		pr_err("val: %lu smaller than MIN_MAX_RSP_SIZE: %d\n", val,
			MIN_MAX_RSP_SIZE);
		return -EINVAL;
	}
	sport->port_attrib.srp_max_rsp_size = val;

	return count;
}

static ssize_t srpt_tpg_attrib_srp_sq_size_show(struct config_item *item,
		char *page)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);

	return sysfs_emit(page, "%u\n", sport->port_attrib.srp_sq_size);
}

static ssize_t srpt_tpg_attrib_srp_sq_size_store(struct config_item *item,
		const char *page, size_t count)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
	unsigned long val;
	int ret;

	ret = kstrtoul(page, 0, &val);
	if (ret < 0) {
		pr_err("kstrtoul() failed with ret: %d\n", ret);
		return -EINVAL;
	}
	if (val > MAX_SRPT_SRQ_SIZE) {
		pr_err("val: %lu exceeds MAX_SRPT_SRQ_SIZE: %d\n", val,
			MAX_SRPT_SRQ_SIZE);
		return -EINVAL;
	}
	if (val < MIN_SRPT_SRQ_SIZE) {
		pr_err("val: %lu smaller than MIN_SRPT_SRQ_SIZE: %d\n", val,
			MIN_SRPT_SRQ_SIZE);
		return -EINVAL;
	}
	sport->port_attrib.srp_sq_size = val;

	return count;
}

static ssize_t srpt_tpg_attrib_use_srq_show(struct config_item *item,
					    char *page)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);

	return sysfs_emit(page, "%d\n", sport->port_attrib.use_srq);
}

static ssize_t srpt_tpg_attrib_use_srq_store(struct config_item *item,
					     const char *page, size_t count)
{
	struct se_portal_group *se_tpg = attrib_to_tpg(item);
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);
	struct srpt_device *sdev = sport->sdev;
	unsigned long val;
	bool enabled;
	int ret;

	ret = kstrtoul(page, 0, &val);
	if (ret < 0)
		return ret;
	if (val != !!val)
		return -EINVAL;

	ret = mutex_lock_interruptible(&sdev->sdev_mutex);
	if (ret < 0)
		return ret;
	ret = mutex_lock_interruptible(&sport->mutex);
	if (ret < 0)
		goto unlock_sdev;
	enabled = sport->enabled;
	/* Log out all initiator systems before changing 'use_srq'. */
	srpt_set_enabled(sport, false);
	sport->port_attrib.use_srq = val;
	srpt_use_srq(sdev, sport->port_attrib.use_srq);
	srpt_set_enabled(sport, enabled);
	ret = count;
	mutex_unlock(&sport->mutex);
unlock_sdev:
	mutex_unlock(&sdev->sdev_mutex);

	return ret;
}

CONFIGFS_ATTR(srpt_tpg_attrib_,  srp_max_rdma_size);
CONFIGFS_ATTR(srpt_tpg_attrib_,  srp_max_rsp_size);
CONFIGFS_ATTR(srpt_tpg_attrib_,  srp_sq_size);
CONFIGFS_ATTR(srpt_tpg_attrib_,  use_srq);

static struct configfs_attribute *srpt_tpg_attrib_attrs[] = {
	&srpt_tpg_attrib_attr_srp_max_rdma_size,
	&srpt_tpg_attrib_attr_srp_max_rsp_size,
	&srpt_tpg_attrib_attr_srp_sq_size,
	&srpt_tpg_attrib_attr_use_srq,
	NULL,
};

static struct rdma_cm_id *srpt_create_rdma_id(struct sockaddr *listen_addr)
{
	struct rdma_cm_id *rdma_cm_id;
	int ret;

	rdma_cm_id = rdma_create_id(&init_net, srpt_rdma_cm_handler,
				    NULL, RDMA_PS_TCP, IB_QPT_RC);
	if (IS_ERR(rdma_cm_id)) {
		pr_err("RDMA/CM ID creation failed: %pe\n", rdma_cm_id);
		goto out;
	}

	ret = rdma_bind_addr(rdma_cm_id, listen_addr);
	if (ret) {
		char addr_str[64];

		snprintf(addr_str, sizeof(addr_str), "%pISp", listen_addr);
		pr_err("Binding RDMA/CM ID to address %s failed: %d\n",
		       addr_str, ret);
		rdma_destroy_id(rdma_cm_id);
		rdma_cm_id = ERR_PTR(ret);
		goto out;
	}

	ret = rdma_listen(rdma_cm_id, 128);
	if (ret) {
		pr_err("rdma_listen() failed: %d\n", ret);
		rdma_destroy_id(rdma_cm_id);
		rdma_cm_id = ERR_PTR(ret);
	}

out:
	return rdma_cm_id;
}

static ssize_t srpt_rdma_cm_port_show(struct config_item *item, char *page)
{
	return sysfs_emit(page, "%d\n", rdma_cm_port);
}

static ssize_t srpt_rdma_cm_port_store(struct config_item *item,
				       const char *page, size_t count)
{
	struct sockaddr_in  addr4 = { .sin_family  = AF_INET  };
	struct sockaddr_in6 addr6 = { .sin6_family = AF_INET6 };
	struct rdma_cm_id *new_id = NULL;
	u16 val;
	int ret;

	ret = kstrtou16(page, 0, &val);
	if (ret < 0)
		return ret;
	ret = count;
	if (rdma_cm_port == val)
		goto out;

	if (val) {
		addr6.sin6_port = cpu_to_be16(val);
		new_id = srpt_create_rdma_id((struct sockaddr *)&addr6);
		if (IS_ERR(new_id)) {
			addr4.sin_port = cpu_to_be16(val);
			new_id = srpt_create_rdma_id((struct sockaddr *)&addr4);
			if (IS_ERR(new_id)) {
				ret = PTR_ERR(new_id);
				goto out;
			}
		}
	}

	mutex_lock(&rdma_cm_mutex);
	rdma_cm_port = val;
	swap(rdma_cm_id, new_id);
	mutex_unlock(&rdma_cm_mutex);

	if (new_id)
		rdma_destroy_id(new_id);
	ret = count;
out:
	return ret;
}

CONFIGFS_ATTR(srpt_, rdma_cm_port);

static struct configfs_attribute *srpt_da_attrs[] = {
	&srpt_attr_rdma_cm_port,
	NULL,
};

static int srpt_enable_tpg(struct se_portal_group *se_tpg, bool enable)
{
	struct srpt_port *sport = srpt_tpg_to_sport(se_tpg);

	mutex_lock(&sport->mutex);
	srpt_set_enabled(sport, enable);
	mutex_unlock(&sport->mutex);

	return 0;
}

/**
 * srpt_make_tpg - configfs callback invoked for mkdir /sys/kernel/config/target/$driver/$port/$tpg
 * @wwn: Corresponds to $driver/$port.
 * @name: $tpg.
 */
static struct se_portal_group *srpt_make_tpg(struct se_wwn *wwn,
					     const char *name)
{
	struct srpt_port_id *sport_id = srpt_wwn_to_sport_id(wwn);
	struct srpt_tpg *stpg;
	int res = -ENOMEM;

	stpg = kzalloc(sizeof(*stpg), GFP_KERNEL);
	if (!stpg)
		return ERR_PTR(res);
	stpg->sport_id = sport_id;
	res = core_tpg_register(wwn, &stpg->tpg, SCSI_PROTOCOL_SRP);
	if (res) {
		kfree(stpg);
		return ERR_PTR(res);
	}

	mutex_lock(&sport_id->mutex);
	list_add_tail(&stpg->entry, &sport_id->tpg_list);
	mutex_unlock(&sport_id->mutex);

	return &stpg->tpg;
}

/**
 * srpt_drop_tpg - configfs callback invoked for rmdir /sys/kernel/config/target/$driver/$port/$tpg
 * @tpg: Target portal group to deregister.
 */
static void srpt_drop_tpg(struct se_portal_group *tpg)
{
	struct srpt_tpg *stpg = container_of(tpg, typeof(*stpg), tpg);
	struct srpt_port_id *sport_id = stpg->sport_id;
	struct srpt_port *sport = srpt_tpg_to_sport(tpg);

	mutex_lock(&sport_id->mutex);
	list_del(&stpg->entry);
	mutex_unlock(&sport_id->mutex);

	sport->enabled = false;
	core_tpg_deregister(tpg);
	kfree(stpg);
}

/**
 * srpt_make_tport - configfs callback invoked for mkdir /sys/kernel/config/target/$driver/$port
 * @tf: Not used.
 * @group: Not used.
 * @name: $port.
 */
static struct se_wwn *srpt_make_tport(struct target_fabric_configfs *tf,
				      struct config_group *group,
				      const char *name)
{
	struct port_and_port_id papi = srpt_lookup_port(name);
	struct srpt_port *sport = papi.sport;
	struct srpt_port_id *port_id;

	if (!papi.port_id)
		return ERR_PTR(-EINVAL);
	if (*papi.port_id) {
		/* Attempt to create a directory that already exists. */
		WARN_ON_ONCE(true);
		return &(*papi.port_id)->wwn;
	}
	port_id = kzalloc(sizeof(*port_id), GFP_KERNEL);
	if (!port_id) {
		srpt_sdev_put(sport->sdev);
		return ERR_PTR(-ENOMEM);
	}
	mutex_init(&port_id->mutex);
	INIT_LIST_HEAD(&port_id->tpg_list);
	port_id->wwn.priv = sport;
	memcpy(port_id->name, port_id == sport->guid_id ? sport->guid_name :
	       sport->gid_name, ARRAY_SIZE(port_id->name));

	*papi.port_id = port_id;

	return &port_id->wwn;
}

/**
 * srpt_drop_tport - configfs callback invoked for rmdir /sys/kernel/config/target/$driver/$port
 * @wwn: $port.
 */
static void srpt_drop_tport(struct se_wwn *wwn)
{
	struct srpt_port_id *port_id = container_of(wwn, typeof(*port_id), wwn);
	struct srpt_port *sport = wwn->priv;

	if (sport->guid_id == port_id)
		sport->guid_id = NULL;
	else if (sport->gid_id == port_id)
		sport->gid_id = NULL;
	else
		WARN_ON_ONCE(true);

	srpt_sdev_put(sport->sdev);
	kfree(port_id);
}

static ssize_t srpt_wwn_version_show(struct config_item *item, char *buf)
{
	return sysfs_emit(buf, "\n");
}

CONFIGFS_ATTR_RO(srpt_wwn_, version);

static struct configfs_attribute *srpt_wwn_attrs[] = {
	&srpt_wwn_attr_version,
	NULL,
};

static const struct target_core_fabric_ops srpt_template = {
	.module				= THIS_MODULE,
	.fabric_name			= "srpt",
	.tpg_get_wwn			= srpt_get_fabric_wwn,
	.tpg_get_tag			= srpt_get_tag,
	.tpg_check_demo_mode_cache	= srpt_check_true,
	.tpg_check_demo_mode_write_protect = srpt_check_true,
	.release_cmd			= srpt_release_cmd,
	.check_stop_free		= srpt_check_stop_free,
	.close_session			= srpt_close_session,
	.sess_get_initiator_sid		= NULL,
	.write_pending			= srpt_write_pending,
	.get_cmd_state			= srpt_get_tcm_cmd_state,
	.queue_data_in			= srpt_queue_data_in,
	.queue_status			= srpt_queue_status,
	.queue_tm_rsp			= srpt_queue_tm_rsp,
	.aborted_task			= srpt_aborted_task,
	/*
	 * Setup function pointers for generic logic in
	 * target_core_fabric_configfs.c
	 */
	.fabric_make_wwn		= srpt_make_tport,
	.fabric_drop_wwn		= srpt_drop_tport,
	.fabric_make_tpg		= srpt_make_tpg,
	.fabric_enable_tpg		= srpt_enable_tpg,
	.fabric_drop_tpg		= srpt_drop_tpg,
	.fabric_init_nodeacl		= srpt_init_nodeacl,

	.tfc_discovery_attrs		= srpt_da_attrs,
	.tfc_wwn_attrs			= srpt_wwn_attrs,
	.tfc_tpg_attrib_attrs		= srpt_tpg_attrib_attrs,

	.default_submit_type		= TARGET_DIRECT_SUBMIT,
	.direct_submit_supp		= 1,
};

/**
 * srpt_init_module - kernel module initialization
 *
 * Note: Since ib_register_client() registers callback functions, and since at
 * least one of these callback functions (srpt_add_one()) calls target core
 * functions, this driver must be registered with the target core before
 * ib_register_client() is called.
 */
static int __init srpt_init_module(void)
{
	int ret;

	ret = -EINVAL;
	if (srp_max_req_size < MIN_MAX_REQ_SIZE) {
		pr_err("invalid value %d for kernel module parameter srp_max_req_size -- must be at least %d.\n",
		       srp_max_req_size, MIN_MAX_REQ_SIZE);
		goto out;
	}

	if (srpt_srq_size < MIN_SRPT_SRQ_SIZE
	    || srpt_srq_size > MAX_SRPT_SRQ_SIZE) {
		pr_err("invalid value %d for kernel module parameter srpt_srq_size -- must be in the range [%d..%d].\n",
		       srpt_srq_size, MIN_SRPT_SRQ_SIZE, MAX_SRPT_SRQ_SIZE);
		goto out;
	}

	ret = target_register_template(&srpt_template);
	if (ret)
		goto out;

	ret = ib_register_client(&srpt_client);
	if (ret) {
		pr_err("couldn't register IB client\n");
		goto out_unregister_target;
	}

	return 0;

out_unregister_target:
	target_unregister_template(&srpt_template);
out:
	return ret;
}

static void __exit srpt_cleanup_module(void)
{
	if (rdma_cm_id)
		rdma_destroy_id(rdma_cm_id);
	ib_unregister_client(&srpt_client);
	target_unregister_template(&srpt_template);
}

module_init(srpt_init_module);
module_exit(srpt_cleanup_module);
]

gemini-3.1-pro-preview

							input: 214058
							output: 50
							thoughts: 872
						

**Analyzing a Potential Use-After-Free Vulnerability in RDMA/IB Subsystem**

Okay, so `srpt_remove_one` synchronously deallocates the protection domain (`ib_dealloc_pd`). That's important to note. But let's look at `rds_ib_remove_one` again. It calls `rds_ib_dev_shutdown`, sets client data to NULL, and then safely removes the device from the list with RCU protection. `synchronize_rcu()` is used to ensure all readers of the device data and the list are finished before releasing the references. The critical bit... `rds_ib_dev_put` is called *twice*. Why? Ah, `rds_ib_add_one` increments the refcount to 2 initially. So, the two `rds_ib_dev_put` calls decrement it back to zero. Then, `queue_work(rds_wq, &rds_ibdev->free_work)` is called, but importantly, `rds_ib_remove_one` *returns* without waiting for `rds_ibdev->free_work` to complete! And that `free_work` function (`rds_ib_dev_free`) calls `ib_dealloc_pd(rds_ibdev->pd)`.

This is a clear race condition. It's a textbook use-after-free! If the `ib_device` is unregistered and freed before `rds_ib_dev_free` runs, then `ib_dealloc_pd` will be accessing freed memory. Specifically, the reported error in `rxe_dealloc` about the PD pool not being empty makes perfect sense. The PD is still in the pool when it should not be. This directly corresponds to the reported bug.

Can this be exploited? Absolutely. It's a use-after-free of the `ib_device` within `rds_ib_dev_free`. `ib_dealloc_pd` calls a function pointer `pd->device->ops.dealloc_pd(pd, udata)`. The critical fact: `pd->device` now points to the *freed* `ib_device` structure. That means we're dereferencing a function pointer from a freed region! This is prime territory for arbitrary code execution.

Here's how. The `ib_device` itself is freed via `kfree_rcu(dev, rcu_head)`. So, it's freed after an RCU grace period. `rds_ib_dev_free` is on a workqueue, so it's asynchronous. If an attacker can delay the workqueue execution (e.g., flood it or just win a race) and wait for the RCU grace period to pass, they can then reallocate the memory formerly occupied by `ib_device` with attacker-controlled data. Then, when `pd->device->ops.dealloc_pd` is called, it will jump to an attacker-controlled address! It's a classic control-flow hijacking due to use-after-free.

The reproducer uses `RDMA_NLDEV_CMD_NEWLINK` and `RDMA_NLDEV_CMD_DELLINK`. Are these netlink commands accessible to unprivileged users? We need to look at `nldev_cb_table`.

map[ContextFile:drivers/infiniband/core/nldev.c IncludeLines:true Name:nldev_cb_table]

map[SourceCode:2640:	static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
2641:		[RDMA_NLDEV_CMD_GET] = {
2642:			.doit = nldev_get_doit,
2643:			.dump = nldev_get_dumpit,
2644:		},
2645:		[RDMA_NLDEV_CMD_GET_CHARDEV] = {
2646:			.doit = nldev_get_chardev,
2647:		},
2648:		[RDMA_NLDEV_CMD_SET] = {
2649:			.doit = nldev_set_doit,
2650:			.flags = RDMA_NL_ADMIN_PERM,
2651:		},
2652:		[RDMA_NLDEV_CMD_NEWLINK] = {
2653:			.doit = nldev_newlink,
2654:			.flags = RDMA_NL_ADMIN_PERM,
2655:		},
2656:		[RDMA_NLDEV_CMD_DELLINK] = {
2657:			.doit = nldev_dellink,
2658:			.flags = RDMA_NL_ADMIN_PERM,
2659:		},
2660:		[RDMA_NLDEV_CMD_PORT_GET] = {
2661:			.doit = nldev_port_get_doit,
2662:			.dump = nldev_port_get_dumpit,
2663:		},
2664:		[RDMA_NLDEV_CMD_RES_GET] = {
2665:			.doit = nldev_res_get_doit,
2666:			.dump = nldev_res_get_dumpit,
2667:		},
2668:		[RDMA_NLDEV_CMD_RES_QP_GET] = {
2669:			.doit = nldev_res_get_qp_doit,
2670:			.dump = nldev_res_get_qp_dumpit,
2671:		},
2672:		[RDMA_NLDEV_CMD_RES_CM_ID_GET] = {
2673:			.doit = nldev_res_get_cm_id_doit,
2674:			.dump = nldev_res_get_cm_id_dumpit,
2675:		},
2676:		[RDMA_NLDEV_CMD_RES_CQ_GET] = {
2677:			.doit = nldev_res_get_cq_doit,
2678:			.dump = nldev_res_get_cq_dumpit,
2679:		},
2680:		[RDMA_NLDEV_CMD_RES_MR_GET] = {
2681:			.doit = nldev_res_get_mr_doit,
2682:			.dump = nldev_res_get_mr_dumpit,
2683:		},
2684:		[RDMA_NLDEV_CMD_RES_PD_GET] = {
2685:			.doit = nldev_res_get_pd_doit,
2686:			.dump = nldev_res_get_pd_dumpit,
2687:		},
2688:		[RDMA_NLDEV_CMD_RES_CTX_GET] = {
2689:			.doit = nldev_res_get_ctx_doit,
2690:			.dump = nldev_res_get_ctx_dumpit,
2691:		},
2692:		[RDMA_NLDEV_CMD_RES_SRQ_GET] = {
2693:			.doit = nldev_res_get_srq_doit,
2694:			.dump = nldev_res_get_srq_dumpit,
2695:		},
2696:		[RDMA_NLDEV_CMD_SYS_GET] = {
2697:			.doit = nldev_sys_get_doit,
2698:		},
2699:		[RDMA_NLDEV_CMD_SYS_SET] = {
2700:			.doit = nldev_set_sys_set_doit,
2701:			.flags = RDMA_NL_ADMIN_PERM,
2702:		},
2703:		[RDMA_NLDEV_CMD_STAT_SET] = {
2704:			.doit = nldev_stat_set_doit,
2705:			.flags = RDMA_NL_ADMIN_PERM,
2706:		},
2707:		[RDMA_NLDEV_CMD_STAT_GET] = {
2708:			.doit = nldev_stat_get_doit,
2709:			.dump = nldev_stat_get_dumpit,
2710:		},
2711:		[RDMA_NLDEV_CMD_STAT_DEL] = {
2712:			.doit = nldev_stat_del_doit,
2713:			.flags = RDMA_NL_ADMIN_PERM,
2714:		},
2715:		[RDMA_NLDEV_CMD_RES_QP_GET_RAW] = {
2716:			.doit = nldev_res_get_qp_raw_doit,
2717:			.dump = nldev_res_get_qp_raw_dumpit,
2718:			.flags = RDMA_NL_ADMIN_PERM,
2719:		},
2720:		[RDMA_NLDEV_CMD_RES_CQ_GET_RAW] = {
2721:			.doit = nldev_res_get_cq_raw_doit,
2722:			.dump = nldev_res_get_cq_raw_dumpit,
2723:			.flags = RDMA_NL_ADMIN_PERM,
2724:		},
2725:		[RDMA_NLDEV_CMD_RES_MR_GET_RAW] = {
2726:			.doit = nldev_res_get_mr_raw_doit,
2727:			.dump = nldev_res_get_mr_raw_dumpit,
2728:			.flags = RDMA_NL_ADMIN_PERM,
2729:		},
2730:		[RDMA_NLDEV_CMD_RES_SRQ_GET_RAW] = {
2731:			.doit = nldev_res_get_srq_raw_doit,
2732:			.dump = nldev_res_get_srq_raw_dumpit,
2733:			.flags = RDMA_NL_ADMIN_PERM,
2734:		},
2735:		[RDMA_NLDEV_CMD_STAT_GET_STATUS] = {
2736:			.doit = nldev_stat_get_counter_status_doit,
2737:		},
2738:		[RDMA_NLDEV_CMD_NEWDEV] = {
2739:			.doit = nldev_newdev,
2740:			.flags = RDMA_NL_ADMIN_PERM,
2741:		},
2742:		[RDMA_NLDEV_CMD_DELDEV] = {
2743:			.doit = nldev_deldev,
2744:			.flags = RDMA_NL_ADMIN_PERM,
2745:		},
2746:	};
 SourceFile:drivers/infiniband/core/nldev.c]

gemini-3.1-pro-preview

							input: 217762
							output: 50
							thoughts: 54
						

**Examining RDMA Network Link Permissions**

Okay, so I'm looking at how we handle permissions for creating and deleting RDMA network links. Specifically, I see that the commands `RDMA_NLDEV_CMD_NEWLINK` and `RDMA_NLDEV_CMD_DELLINK` both require `RDMA_NL_ADMIN_PERM`. Right, that's standard practice, makes sense. But before I move on, let's just quickly confirm what `RDMA_NL_ADMIN_PERM` actually *means*. No sense in blindly assuming – better to verify it's the specific set of privileges I expect. Need to quickly check that definition and ensure it aligns with my mental model of appropriate administrator control over these network interfaces. Gotta make sure we're not inadvertently granting too much or too little access. Time to delve into the specific implementation of that permission.

requested entity does not exist

map[ContextFile:include/rdma/rdma_netlink.h IncludeLines:true Name:RDMA_NL_ADMIN_PERM]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 218074
							output: 23
							thoughts: 16
						

Here's my thought process, summarized as you requested:

**Navigating the RDMA Namespace**

Okay, so I need to find something related to `RDMA_NL_ADMIN_PERM`. Right, that's a pretty specific term, likely part of some kernel-level network configuration or permissions scheme within the RDMA (Remote Direct Memory Access) subsystem. Given my expertise, I suspect this is related to Network Link (NL) attributes, specifically concerning administrative permissions. I'll need to use `grep` to efficiently search for this string. This likely involves diving into the kernel source tree, perhaps configuration files, or even some documentation. My mental checklist includes considerations for:

*   **Potential Source Locations:** Where are the most likely places this would be defined or referenced? Kernel source code, header files, configuration files for RDMA-related tools, or perhaps even in the relevant netlink protocol definitions?
*   **Contextual Clues:** Are there related keywords or concepts I should also search for to broaden the search, but also narrow it down to the most relevant hits?
*   **Search Efficiency:** I need to make sure my `grep` invocation is efficient; I might use recursive search (`-r`), and potentially filter out binary files (`-I`) or specific directory trees to speed up the process and remove irrelevant noise.
*   **Expected Output:** Once I have the `grep` results, I'll need to interpret them. The surrounding code or configuration will tell the real story. I'll be looking for definitions, uses, and any commentary that goes along with `RDMA_NL_ADMIN_PERM`, to understand the implications of this particular permission.

map[Expression:RDMA_NL_ADMIN_PERM]

map[Output:drivers/infiniband/core/device.c=2914=static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
--
drivers/infiniband/core/device.c-2916-		.doit = ib_nl_handle_resolve_resp,
drivers/infiniband/core/device.c:2917:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/device.c-2918-	},
--
drivers/infiniband/core/device.c-2920-		.doit = ib_nl_handle_set_timeout,
drivers/infiniband/core/device.c:2921:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/device.c-2922-	},
--
drivers/infiniband/core/device.c-2924-		.doit = ib_nl_handle_ip_res_resp,
drivers/infiniband/core/device.c:2925:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/device.c-2926-	},
--
drivers/infiniband/core/netlink.c=152=static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
--
drivers/infiniband/core/netlink.c-168-
drivers/infiniband/core/netlink.c:169:	if ((cb_table[op].flags & RDMA_NL_ADMIN_PERM) &&
drivers/infiniband/core/netlink.c-170-	    !netlink_capable(skb, CAP_NET_ADMIN)) {
--
drivers/infiniband/core/nldev.c=2640=static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
--
drivers/infiniband/core/nldev.c-2649-		.doit = nldev_set_doit,
drivers/infiniband/core/nldev.c:2650:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2651-	},
--
drivers/infiniband/core/nldev.c-2653-		.doit = nldev_newlink,
drivers/infiniband/core/nldev.c:2654:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2655-	},
--
drivers/infiniband/core/nldev.c-2657-		.doit = nldev_dellink,
drivers/infiniband/core/nldev.c:2658:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2659-	},
--
drivers/infiniband/core/nldev.c-2700-		.doit = nldev_set_sys_set_doit,
drivers/infiniband/core/nldev.c:2701:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2702-	},
--
drivers/infiniband/core/nldev.c-2704-		.doit = nldev_stat_set_doit,
drivers/infiniband/core/nldev.c:2705:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2706-	},
--
drivers/infiniband/core/nldev.c-2712-		.doit = nldev_stat_del_doit,
drivers/infiniband/core/nldev.c:2713:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2714-	},
--
drivers/infiniband/core/nldev.c-2717-		.dump = nldev_res_get_qp_raw_dumpit,
drivers/infiniband/core/nldev.c:2718:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2719-	},
--
drivers/infiniband/core/nldev.c-2722-		.dump = nldev_res_get_cq_raw_dumpit,
drivers/infiniband/core/nldev.c:2723:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2724-	},
--
drivers/infiniband/core/nldev.c-2727-		.dump = nldev_res_get_mr_raw_dumpit,
drivers/infiniband/core/nldev.c:2728:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2729-	},
--
drivers/infiniband/core/nldev.c-2732-		.dump = nldev_res_get_srq_raw_dumpit,
drivers/infiniband/core/nldev.c:2733:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2734-	},
--
drivers/infiniband/core/nldev.c-2739-		.doit = nldev_newdev,
drivers/infiniband/core/nldev.c:2740:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2741-	},
--
drivers/infiniband/core/nldev.c-2743-		.doit = nldev_deldev,
drivers/infiniband/core/nldev.c:2744:		.flags = RDMA_NL_ADMIN_PERM,
drivers/infiniband/core/nldev.c-2745-	},
--
include/rdma/rdma_netlink.h=24=enum rdma_nl_flags {
include/rdma/rdma_netlink.h-25-	/* Require CAP_NET_ADMIN */
include/rdma/rdma_netlink.h:26:	RDMA_NL_ADMIN_PERM	= 1 << 0,
include/rdma/rdma_netlink.h-27-};
]

gemini-3.1-pro-preview

							input: 220268
							output: 49
							thoughts: 68
						

**Examining the Requirements for Network Device Creation**

Okay, so I'm looking at this and it's clear: creating this network device requires `CAP_NET_ADMIN`. That's the baseline. Right, so if I'm understanding this correctly, as an expert in this, that means it's *accessible* from a user namespace, provided the user has that crucial `CAP_NET_ADMIN` capability assigned within that specific namespace. That makes perfect sense, standard capability delegation.

Now, hold on... the critical question pops up in my mind: Does `RDMA_NLDEV_CMD_NEWLINK` function correctly *within* a user namespace? That's the key. I can't just assume it. I need to verify that interaction and the implications. I know what to do; time to delve into `nldev_newlink` and see what it is actually doing under the hood. I need to understand how the function handles namespaces and capabilities directly. That's the next step to fully understand this feature's limitations and possible exploits.

map[ContextFile:drivers/infiniband/core/nldev.c IncludeLines:true Name:nldev_newlink]

map[SourceCode:1757:	static int nldev_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
1758:				  struct netlink_ext_ack *extack)
1759:	{
1760:		struct nlattr *tb[RDMA_NLDEV_ATTR_MAX];
1761:		char ibdev_name[IB_DEVICE_NAME_MAX];
1762:		const struct rdma_link_ops *ops;
1763:		char ndev_name[IFNAMSIZ];
1764:		struct net_device *ndev;
1765:		char type[IFNAMSIZ];
1766:		int err;
1767:	
1768:		err = nlmsg_parse(nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
1769:				    nldev_policy, extack);
1770:		if (err || !tb[RDMA_NLDEV_ATTR_DEV_NAME] ||
1771:		    !tb[RDMA_NLDEV_ATTR_LINK_TYPE] || !tb[RDMA_NLDEV_ATTR_NDEV_NAME])
1772:			return -EINVAL;
1773:	
1774:		nla_strscpy(ibdev_name, tb[RDMA_NLDEV_ATTR_DEV_NAME],
1775:			    sizeof(ibdev_name));
1776:		if (strchr(ibdev_name, '%') || strlen(ibdev_name) == 0)
1777:			return -EINVAL;
1778:	
1779:		nla_strscpy(type, tb[RDMA_NLDEV_ATTR_LINK_TYPE], sizeof(type));
1780:		nla_strscpy(ndev_name, tb[RDMA_NLDEV_ATTR_NDEV_NAME],
1781:			    sizeof(ndev_name));
1782:	
1783:		ndev = dev_get_by_name(sock_net(skb->sk), ndev_name);
1784:		if (!ndev)
1785:			return -ENODEV;
1786:	
1787:		down_read(&link_ops_rwsem);
1788:		ops = link_ops_get(type);
1789:	#ifdef CONFIG_MODULES
1790:		if (!ops) {
1791:			up_read(&link_ops_rwsem);
1792:			request_module("rdma-link-%s", type);
1793:			down_read(&link_ops_rwsem);
1794:			ops = link_ops_get(type);
1795:		}
1796:	#endif
1797:		err = ops ? ops->newlink(ibdev_name, ndev) : -EINVAL;
1798:		up_read(&link_ops_rwsem);
1799:		dev_put(ndev);
1800:	
1801:		return err;
1802:	}
 SourceFile:drivers/infiniband/core/nldev.c]

gemini-3.1-pro-preview

							input: 221458
							output: 44
							thoughts: 110
						

**Analyzing Network Administration Capabilities in User Namespaces**

Okay, so I'm looking at how this system determines network device accessibility. It seems the code first uses `sock_net(skb->sk)` to pinpoint the network device. Then, it uses `netlink_capable(skb, CAP_NET_ADMIN)` to verify if the user possesses `CAP_NET_ADMIN` privileges within the user namespace associated with the current net namespace. So, it appears that, yes, this functionality *is* accessible from user namespaces.

Hang on a second… I'm noticing `rdma_nl_rcv_msg` also relies on `netlink_capable(skb, CAP_NET_ADMIN)`. I'd better double-check the logic within `netlink_capable` itself to make absolutely certain I understand the implications here. Gotta verify all the assumptions.

map[ContextFile:net/netlink/af_netlink.c IncludeLines:true Name:netlink_capable]

map[SourceCode: 873:	/**
 874:	 * netlink_capable - Netlink global message capability test
 875:	 * @skb: socket buffer holding a netlink command from userspace
 876:	 * @cap: The capability to use
 877:	 *
 878:	 * Test to see if the opener of the socket we received the message
 879:	 * from had when the netlink socket was created and the sender of the
 880:	 * message has the capability @cap in all user namespaces.
 881:	 */
 882:	bool netlink_capable(const struct sk_buff *skb, int cap)
 883:	{
 884:		return netlink_ns_capable(skb, &init_user_ns, cap);
 885:	}
 SourceFile:net/netlink/af_netlink.c]

gemini-3.1-pro-preview

							input: 222041
							output: 51
							thoughts: 166
						

**My Line of Reasoning on Netlink Capabilities**

Okay, so I see that `netlink_capable` is looking at `&init_user_ns`. That's interesting, because it seems to be implying a requirement for `CAP_NET_ADMIN` *specifically* within the initial user namespace. I need to confirm this. Let me quickly examine that function:

```c
bool netlink_capable(const struct sk_buff *skb, int cap)
{
	return netlink_ns_capable(skb, &init_user_ns, cap);
}
```

Yep, that confirms it! We're indeed checking against `init_user_ns`, meaning that standard user namespaces don't get access to these capabilities. That's good, that's what I was hoping to see. So, no user namespaces are going to have access, fantastic. 

Now, I need to make sure that this applies to `RDMA_NL_ADMIN_PERM`. Is `RDMA_NL_ADMIN_PERM` checked using `netlink_capable`? Let me go and check `rdma_nl_rcv_msg`.

map[ContextFile:drivers/infiniband/core/netlink.c IncludeLines:true Name:rdma_nl_rcv_msg]

map[SourceCode: 152:	static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 153:				   struct netlink_ext_ack *extack)
 154:	{
 155:		int type = nlh->nlmsg_type;
 156:		unsigned int index = RDMA_NL_GET_CLIENT(type);
 157:		unsigned int op = RDMA_NL_GET_OP(type);
 158:		const struct rdma_nl_cbs *cb_table;
 159:		int err = -EINVAL;
 160:	
 161:		if (!is_nl_msg_valid(index, op))
 162:			return -EINVAL;
 163:	
 164:		down_read(&rdma_nl_types[index].sem);
 165:		cb_table = get_cb_table(skb, index, op);
 166:		if (!cb_table)
 167:			goto done;
 168:	
 169:		if ((cb_table[op].flags & RDMA_NL_ADMIN_PERM) &&
 170:		    !netlink_capable(skb, CAP_NET_ADMIN)) {
 171:			err = -EPERM;
 172:			goto done;
 173:		}
 174:	
 175:		/*
 176:		 * LS responses overload the 0x100 (NLM_F_ROOT) flag.  Don't
 177:		 * mistakenly call the .dump() function.
 178:		 */
 179:		if (index == RDMA_NL_LS) {
 180:			if (cb_table[op].doit)
 181:				err = cb_table[op].doit(skb, nlh, extack);
 182:			goto done;
 183:		}
 184:		/* FIXME: Convert IWCM to properly handle doit callbacks */
 185:		if ((nlh->nlmsg_flags & NLM_F_DUMP) || index == RDMA_NL_IWCM) {
 186:			struct netlink_dump_control c = {
 187:				.dump = cb_table[op].dump,
 188:			};
 189:			if (c.dump)
 190:				err = netlink_dump_start(skb->sk, skb, nlh, &c);
 191:			goto done;
 192:		}
 193:	
 194:		if (cb_table[op].doit)
 195:			err = cb_table[op].doit(skb, nlh, extack);
 196:	done:
 197:		up_read(&rdma_nl_types[index].sem);
 198:		return err;
 199:	}
 SourceFile:drivers/infiniband/core/netlink.c]

gemini-3.1-pro-preview

							input: 223326
							output: 53
							thoughts: 1972
						

**Analysis of the IB Device Unregistration Vulnerability**

Okay, so the code uses `netlink_capable` with `CAP_NET_ADMIN`. That means the vulnerability requires `CAP_NET_ADMIN` in the initial user namespace. Therefore, it's not reachable by unprivileged processes, and not accessible from user namespaces either. The bug report is clear on this: the vulnerability is neither accessible from unprivileged processes, nor accessible from user namespaces.

However, how else could `ib_unregister_device` be triggered? A USB device unplugging might call `ib_unregister_device` in a device driver. The reproducer does use `syz_usb_connect`, which creates a USB Raw Gadget. But does this specific USB device register an IB device? No, it looks like the reproducer uses `RDMA_NLDEV_CMD_NEWLINK` to create an `rxe` device on `bond0` as a first step. The sequence is: `RDMA_NLDEV_CMD_NEWLINK`, `syz_usb_connect`, `RDMA_NLDEV_CMD_PORT_GET`. Crucially, the reproducer appears to *not* use `RDMA_NLDEV_CMD_DELLINK`, which would unregister the device.

But wait, looking at the reproducer bytes, they are `04 14`, which translates to `RDMA_NLDEV_CMD_DELLINK`! Syzkaller often mutates the byte arrays. That explains the discrepancy. It *does* use `RDMA_NLDEV_CMD_DELLINK`. Syzkaller runs in a user namespace, but the code checks `init_user_ns`. Ah, right, syzkaller often runs as root in the initial namespace. The bug requires `CAP_NET_ADMIN` in the initial namespace to work.

Is there another way to trigger `ib_unregister_device`? If a physical device is unplugged, like a USB or PCI device, the kernel calls `ib_unregister_device`. If an attacker can introduce a malicious USB device, the kernel loads the driver, registers the IB device, and then when the device is unplugged, the bug occurs. The same race condition would happen with `rds` loaded. Specifically, `rds_ib_add_one` checks `device->node_type` and `device->attrs.device_cap_flags`. A USB device with the correct properties will trigger the issue on unplug. It can be triggered via a peripheral device. But the current reproducer uses `syz_usb_connect`. The stack trace shows `nldev_dellink`. So, the reproducer triggers it via `RDMA_NLDEV_CMD_DELLINK`. `syz_usb_connect` might be just noise.

`rxe` is a software RDMA device over Ethernet. If the Ethernet device is destroyed, the `rxe` device is destroyed, too. Can an unprivileged user destroy an Ethernet device? If the device is a `veth` or `dummy` device created in a user namespace, then yes. But can a user namespace create an `rxe` device on a `veth`? The user needs to send `RDMA_NLDEV_CMD_NEWLINK`. However, this requires `CAP_NET_ADMIN` in `init_user_ns`. An unprivileged user can't create `rxe`. But if the admin creates the `rxe` on a `veth` and *then* gives the `veth` to the unprivileged user, when the user namespace is destroyed, the `veth` is destroyed, and the `rxe` is destroyed, too! I should check if `rxe` even listens to netdev events to be certain.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_net.c IncludeLines:true Name:rxe_net_notifier]

map[SourceCode: 676:	static struct notifier_block rxe_net_notifier = {
 677:		.notifier_call = rxe_notify,
 678:	};
 SourceFile:drivers/infiniband/sw/rxe/rxe_net.c]

gemini-3.1-pro-preview

							input: 226238
							output: 51
							thoughts: 10
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `rxe_notify`**

Alright, time to dig in. The mention of `rxe_notify` has piqued my interest. Let's start by taking a close look at how that function is being used. I need to understand its role in the overall architecture, specifically what events it signals and what's dependent on those signals. Are we talking about completion notifications, error propagation, or something else entirely? A quick scan of the surrounding code should shed light on the context. I'll need to trace the call paths to identify the producers and consumers of this notification, and how latency is involved, as well as if there are any potential race conditions. I'm looking for any unusual behavior, inefficiencies, or potential areas for improvement. Let's see what's what.

map[ContextFile:drivers/infiniband/sw/rxe/rxe_net.c IncludeLines:true Name:rxe_notify]

map[SourceCode: 638:	static int rxe_notify(struct notifier_block *not_blk,
 639:			      unsigned long event,
 640:			      void *arg)
 641:	{
 642:		struct net_device *ndev = netdev_notifier_info_to_dev(arg);
 643:		struct rxe_dev *rxe = rxe_get_dev_from_net(ndev);
 644:	
 645:		if (!rxe)
 646:			return NOTIFY_OK;
 647:	
 648:		switch (event) {
 649:		case NETDEV_UNREGISTER:
 650:			ib_unregister_device_queued(&rxe->ib_dev);
 651:			break;
 652:		case NETDEV_CHANGEMTU:
 653:			rxe_dbg_dev(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
 654:			rxe_set_mtu(rxe, ndev->mtu);
 655:			break;
 656:		case NETDEV_DOWN:
 657:		case NETDEV_CHANGE:
 658:			if (ib_get_curr_port_state(ndev) == IB_PORT_DOWN)
 659:				rxe_counter_inc(rxe, RXE_CNT_LINK_DOWNED);
 660:			break;
 661:		case NETDEV_REBOOT:
 662:		case NETDEV_GOING_DOWN:
 663:		case NETDEV_CHANGEADDR:
 664:		case NETDEV_CHANGENAME:
 665:		case NETDEV_FEAT_CHANGE:
 666:		default:
 667:			rxe_dbg_dev(rxe, "ignoring netdev event = %ld for %s\n",
 668:				event, ndev->name);
 669:			break;
 670:		}
 671:	
 672:		ib_device_put(&rxe->ib_dev);
 673:		return NOTIFY_OK;
 674:	}
 SourceFile:drivers/infiniband/sw/rxe/rxe_net.c]

gemini-3.1-pro-preview

							input: 227112
							output: 66
							thoughts: 5855
						

**Detailed Analysis of a Potential Use-After-Free Vulnerability**

Okay, so I've been digging into this potential use-after-free (UAF) issue, and here's a breakdown of my thought process. The core problem revolves around the interaction between the `ib_unregister_device` function and the `rds_ib_dev_free` workqueue item, which handles some cleanup related to the RDS over IB protocol. The crux of the issue is a race condition where `ib_unregister_device` might free an `ib_device` *before* `rds_ib_dev_free` has a chance to complete its operations on that same device.

First, I confirmed that `NETDEV_UNREGISTER` can indeed trigger `ib_unregister_device`, and I considered different scenarios. Can an unprivileged user just unregister a network device? Yes, if it's in their user namespace. Could an admin move a network device with an `rxe` device attached to a user namespace? That's possible, though it requires specific setup. I had to look into whether RDMA devices are namespace-aware, which depends on whether `CONFIG_RDMA_USER_NAMESPACE` is enabled.

I also considered whether a peripheral device could trigger this, say, a USB device. While a user *could* plug in a USB Ethernet device and attempt to create an `rxe` device on it, they would need `CAP_NET_ADMIN` privileges in `init_user_ns` to do so. So, that's not a direct route for an unprivileged user. I then considered other peripheral triggers, and ultimately, Thunderbolt/PCIe hotplug presents a viable vector. If an attacker plugs in a Thunderbolt RoCE device, the IB device is registered, and when they unplug it, the IB device is unregistered. This is the critical piece that confirms the potential for a peripheral trigger.

From there, I focused on the specific race condition and the code. `ib_unregister_device` calls `ib_dealloc_device`, which calls `put_device`, which eventually calls `ib_device_release`, which calls `kfree_rcu` on `dev`, after some RCU grace period. Concurrently, `rds_ib_dev_free` is queued on `rds_wq`. Crucially, `rds_ib_dev_free` *does* access the freed `ib_device` via `pd->device`, leading to a UAF in `ib_dealloc_pd_user`.

I then went through the `rds_ib_dev_free` code step by step, which confirmed that `ib_dealloc_pd` will call `pd->device->ops.dealloc_pd`. Because `pd->device` is a pointer to the `ib_device`, this creates a UAF if the `ib_device` has been freed. I double-checked that `rds_ib_add_one` doesn't hold an extra reference. I confirmed that the device is freed because `ib_dealloc_device` calls `put_device`, which frees it. This happens after the workqueue item is queued, which means the device may be freed before the work item runs.

I checked for mitigations. Does `rds_ib_remove_one` flush the `rds_wq`? No. Is there a way `rds_ib_dev_put` can be called from somewhere else? It can be called twice from `rds_ib_remove_one`, which does not flush the workqueue, meaning there is no flushing of the workqueue, and no mitigation. I also considered the `rds_ib_exit` function, which *does* flush the workqueue when unloading the module, but that's a different scenario.

So, the UAF vulnerability is present and exploitable, as an RCU grace period delay is involved, and there's no synchronization to prevent the race. I then delved into all the potential dimensions of this vulnerability.

-   **Exploitable:** Yes. Read from freed memory with function pointers.
-   **Denial of Service:** Yes, the vulnerability can lead to a crash.
-   **Accessible From Unprivileged Processes:** No. The trigger does not work for unprivileged processes.
-   **Accessible From User Namespaces:** No. It also does not work in user namespaces.
-   **VM Guest Trigger:** No.
-   **VM Host Trigger in The Confidetial Computing Context:** No.
-   **Ethernet Network Trigger:** No.
-   **Other Remote Trigger:** No.
-   **Peripheral Trigger:** Yes, via hotplugging a Thunderbolt RDMA device.
-   **Malicious Filesystem Trigger:** No.

I then revisited the reproducer's use of `syz_usb_connect`.

map[DenialOfService:true Exploitable:true FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:true RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[DenialOfService:true Exploitable:true FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:true RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

gemini-3.1-pro-preview

							input: 234122
							output: 594
							thoughts: 540
						

**Finalizing the Analysis: A Dangerous UAF in RDMA Device Unregistration**

Okay, the analysis is complete, and it's time to craft the definitive response. Here's my understanding of the situation: we're dealing with a nasty Use-After-Free vulnerability in the Reliable Datagram Sockets (RDS) RDMA client. The telltale sign is that `WARN_ON(!xa_empty(&pool->xa))` message in `rxe_pool_cleanup` during `rxe_dealloc`, specifically for the Protection Domain pool (`pd_pool`). This screams that a Protection Domain wasn't deallocated cleanly before the RDMA device was unregistered.

My investigation has nailed down the root cause to a classic race condition. When an RDMA device comes online, `rds_ib_add_one` dutifully allocates a Protection Domain using `ib_alloc_pd`. The problem arises during device removal, handled by `rds_ib_remove_one`. While this function *should* handle cleanup, it's actually lazy. It defers the real work, including the crucial `ib_dealloc_pd`, to a workqueue (`rds_ib_dev_free` on `rds_wq`) and returns immediately. This means `rds_ib_remove_one` doesn't wait for completion.

The RDMA core, when it goes to disable the device, waits for the device's refcount to hit zero. The flaw here is that `rds_ib_add_one` doesn't hold a reference to the `ib_device`. Hence, the refcount drops to zero without the RDS cleanup. Then, `ib_dealloc_device` proceeds to free the `ib_device` structure using `kfree_rcu`.

The ticking time bomb is that *later*, when the deferred `rds_ib_dev_free` work actually runs, it calls `ib_dealloc_pd(rds_ibdev->pd)`.  But remember, this function goes to access `pd->device->ops.dealloc_pd`. The `pd->device` pointer, which is the `ib_device`, has already been freed, thus becoming a dangling pointer that now points to freed memory. This creates a textbook Use-After-Free condition, an indirect call to a potentially freed or attacker-controlled address.

This UAF is, as we know, a highly exploitable situation. Arbitrary code execution and privilege escalation are clearly on the table.

Now, while exploiting this directly via the standard device unregistration path requires `CAP_NET_ADMIN` in the initial user namespace, limiting the scope of attack to privileged processes and the initial user namespace. The good news (for an attacker) is that this bug can also be triggered by physical hotplugging and unplugging a PCIe RDMA device, such as one connected via Thunderbolt. This happens automatically, as the kernel dynamically registers and unregisters the device. This Peripheral Trigger method is a significant concern as it allows unprivileged attackers to trigger the vulnerability.

map[Explanation:The bug report indicates a `WARN_ON(!xa_empty(&pool->xa))` in `rxe_pool_cleanup`
for the `pd_pool` (Protection Domain pool). This warning is triggered during
`rxe_dealloc` (called via `ib_unregister_device`), meaning that a Protection
Domain (PD) was not properly deallocated before the RDMA device was unregistered
and destroyed.

### Root Cause & Exploitation
The root cause is a race condition in the `rds` (Reliable Datagram Sockets) RDMA
client.
When an RDMA device is registered, `rds_ib_add_one` allocates a PD
(`ib_alloc_pd`). When the device is unregistered, `rds_ib_remove_one` is called
to clean up. However, `rds_ib_remove_one` defers the actual cleanup (including
`ib_dealloc_pd`) to a workqueue (`rds_ib_dev_free` on `rds_wq`) and returns
immediately without waiting for the work to complete.

The RDMA core (`disable_device`) waits for the device's refcount to reach 0
before freeing it. Since `rds_ib_add_one` does not hold a reference to the
`ib_device`, the refcount drops to 0, and `ib_dealloc_device` proceeds to free
the `ib_device` structure (via `kfree_rcu`).

Later, when the deferred `rds_ib_dev_free` work executes, it calls
`ib_dealloc_pd(rds_ibdev->pd)`. This function accesses
`pd->device->ops.dealloc_pd`. Since `pd->device` (the `ib_device`) has already
been freed, this results in a **Use-After-Free (UAF)**. Because it involves an
indirect function call (`->ops.dealloc_pd`) from a freed structure, it is highly
exploitable for arbitrary code execution and privilege escalation.

### Trigger Vectors
- **Unprivileged / User Namespaces:** Triggering the software RDMA device
creation/deletion (via `RDMA_NLDEV_CMD_NEWLINK` and `RDMA_NLDEV_CMD_DELLINK`
netlink commands) requires `CAP_NET_ADMIN` in the **initial** user namespace
(`init_user_ns`). Therefore, it cannot be triggered by unprivileged users or
from within user namespaces.
- **Peripheral Trigger:** The bug can be triggered by physically hotplugging and
then unplugging a PCIe RDMA device (e.g., via Thunderbolt). The kernel will
automatically probe the device, register it with the RDMA core (triggering
`rds_ib_add_one`), and upon unplug, unregister it (triggering the UAF race
condition).]