 if (copy_to_user((void __user *) (unsigned long) cmd.response, &resp, sizeof resp)) { ret = -EFAULT; goto err_list; } 
ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,			    const char __user *buf, int in_len,			    int out_len){	struct ib_uverbs_create_qp      cmd;	struct ib_uverbs_create_qp_resp resp;	struct ib_udata                 udata;	struct ib_uevent_object        *uobj;	struct ib_pd                   *pd;	struct ib_cq                   *scq, *rcq;	struct ib_srq                  *srq;	struct ib_qp                   *qp;	struct ib_qp_init_attr          attr;	int ret;	if (out_len < sizeof resp)		return -ENOSPC;	if (copy_from_user(&cmd, buf, sizeof cmd))		return -EFAULT;	INIT_UDATA(&udata, buf + sizeof cmd,		   (unsigned long) cmd.response + sizeof resp,		   in_len - sizeof cmd, out_len - sizeof resp);	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);	if (!uobj)		return -ENOMEM;	down(&ib_uverbs_idr_mutex);	pd  = idr_find(&ib_uverbs_pd_idr, cmd.pd_handle);	scq = idr_find(&ib_uverbs_cq_idr, cmd.send_cq_handle);	rcq = idr_find(&ib_uverbs_cq_idr, cmd.recv_cq_handle);	srq = cmd.is_srq ? idr_find(&ib_uverbs_srq_idr, cmd.srq_handle) : NULL;	if (!pd  || pd->uobject->context  != file->ucontext ||	    !scq || scq->uobject->context != file->ucontext ||	    !rcq || rcq->uobject->context != file->ucontext ||	    (cmd.is_srq && (!srq || srq->uobject->context != file->ucontext))) {		ret = -EINVAL;		goto err_up;	}	attr.event_handler = ib_uverbs_qp_event_handler;	attr.qp_context    = file;	attr.send_cq       = scq;	attr.recv_cq       = rcq;	attr.srq           = srq;	attr.sq_sig_type   = cmd.sq_sig_all ? IB_SIGNAL_ALL_WR : IB_SIGNAL_REQ_WR;	attr.qp_type       = cmd.qp_type;	attr.cap.max_send_wr     = cmd.max_send_wr;	attr.cap.max_recv_wr     = cmd.max_recv_wr;	attr.cap.max_send_sge    = cmd.max_send_sge;	attr.cap.max_recv_sge    = cmd.max_recv_sge;	attr.cap.max_inline_data = cmd.max_inline_data;	uobj->uobject.user_handle = cmd.user_handle;	uobj->uobject.context     = file->ucontext;	uobj->events_reported     = 0;	INIT_LIST_HEAD(&uobj->event_list);	qp = pd->device->create_qp(pd, &attr, &udata);	if (IS_ERR(qp)) {		ret = PTR_ERR(qp);		goto err_up;	}	qp->device     	  = pd->device;	qp->pd         	  = pd;	qp->send_cq    	  = attr.send_cq;	qp->recv_cq    	  = attr.recv_cq;	qp->srq	       	  = attr.srq;	qp->uobject       = &uobj->uobject;	qp->event_handler = attr.event_handler;	qp->qp_context    = attr.qp_context;	qp->qp_type	  = attr.qp_type;	atomic_inc(&pd->usecnt);	atomic_inc(&attr.send_cq->usecnt);	atomic_inc(&attr.recv_cq->usecnt);	if (attr.srq)		atomic_inc(&attr.srq->usecnt);	memset(&resp, 0, sizeof resp);	resp.qpn = qp->qp_num;retry:	if (!idr_pre_get(&ib_uverbs_qp_idr, GFP_KERNEL)) {		ret = -ENOMEM;		goto err_destroy;	}	ret = idr_get_new(&ib_uverbs_qp_idr, qp, &uobj->uobject.id);	if (ret == -EAGAIN)		goto retry;	if (ret)		goto err_destroy;	resp.qp_handle = uobj->uobject.id;	down(&file->mutex);	list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);	up(&file->mutex);	if (copy_to_user((void __user *) (unsigned long) cmd.response,			 &resp, sizeof resp)) {		ret = -EFAULT;		goto err_list;	}	up(&ib_uverbs_idr_mutex);	return in_len;err_list:	down(&file->mutex);	list_del(&uobj->uobject.list);	up(&file->mutex);err_destroy:	ib_destroy_qp(qp);err_up:	up(&ib_uverbs_idr_mutex);	kfree(uobj);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/eb9d3cd5ce2828fbb99ed7270089ea152c8f64b3/uverbs_cmd.c/clean/drivers/infiniband/core/uverbs_cmd.c