drivers/infiniband/core/security.c

   1 /*
   2  * Copyright (c) 2016 Mellanox Technologies Ltd.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #include <linux/security.h>
  34 #include <linux/completion.h>
  35 #include <linux/list.h>
  36
  37 #include <rdma/ib_verbs.h>
  38 #include <rdma/ib_cache.h>
  39 #include "core_priv.h"
  40 #include "mad_priv.h"
  41
  42 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp)
  43 {
  44         struct pkey_index_qp_list *pkey = NULL;
  45         struct pkey_index_qp_list *tmp_pkey;
  46         struct ib_device *dev = pp->sec->dev;
  47
  48         spin_lock(&dev->port_pkey_list[pp->port_num].list_lock);
  49         list_for_each_entry(tmp_pkey,
  50                             &dev->port_pkey_list[pp->port_num].pkey_list,
  51                             pkey_index_list) {
  52                 if (tmp_pkey->pkey_index == pp->pkey_index) {
  53                         pkey = tmp_pkey;
  54                         break;
  55                 }
  56         }
  57         spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock);
  58         return pkey;
  59 }
  60
  61 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
  62                                       u16 *pkey,
  63                                       u64 *subnet_prefix)
  64 {
  65         struct ib_device *dev = pp->sec->dev;
  66         int ret;
  67
  68         ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
  69         if (ret)
  70                 return ret;
  71
  72         ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);
  73
  74         return ret;
  75 }
  76
  77 static int enforce_qp_pkey_security(u16 pkey,
  78                                     u64 subnet_prefix,
  79                                     struct ib_qp_security *qp_sec)
  80 {
  81         struct ib_qp_security *shared_qp_sec;
  82         int ret;
  83
  84         ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
  85         if (ret)
  86                 return ret;
  87
  88         list_for_each_entry(shared_qp_sec,
  89                             &qp_sec->shared_qp_list,
  90                             shared_qp_list) {
  91                 ret = security_ib_pkey_access(shared_qp_sec->security,
  92                                               subnet_prefix,
  93                                               pkey);
  94                 if (ret)
  95                         return ret;
  96         }
  97         return 0;
  98 }
  99
 100 /* The caller of this function must hold the QP security
 101  * mutex of the QP of the security structure in *pps.
 102  *
 103  * It takes separate ports_pkeys and security structure
 104  * because in some cases the pps will be for a new settings
 105  * or the pps will be for the real QP and security structure
 106  * will be for a shared QP.
 107  */
 108 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
 109                                        struct ib_qp_security *sec)
 110 {
 111         u64 subnet_prefix;
 112         u16 pkey;
 113         int ret = 0;
 114
 115         if (!pps)
 116                 return 0;
 117
 118         if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
 119                 ret = get_pkey_and_subnet_prefix(&pps->main,
 120                                                  &pkey,
 121                                                  &subnet_prefix);
 122                 if (ret)
 123                         return ret;
 124
 125                 ret = enforce_qp_pkey_security(pkey,
 126                                                subnet_prefix,
 127                                                sec);
 128                 if (ret)
 129                         return ret;
 130         }
 131
 132         if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
 133                 ret = get_pkey_and_subnet_prefix(&pps->alt,
 134                                                  &pkey,
 135                                                  &subnet_prefix);
 136                 if (ret)
 137                         return ret;
 138
 139                 ret = enforce_qp_pkey_security(pkey,
 140                                                subnet_prefix,
 141                                                sec);
 142         }
 143
 144         return ret;
 145 }
 146
 147 /* The caller of this function must hold the QP security
 148  * mutex.
 149  */
 150 static void qp_to_error(struct ib_qp_security *sec)
 151 {
 152         struct ib_qp_security *shared_qp_sec;
 153         struct ib_qp_attr attr = {
 154                 .qp_state = IB_QPS_ERR
 155         };
 156         struct ib_event event = {
 157                 .event = IB_EVENT_QP_FATAL
 158         };
 159
 160         /* If the QP is in the process of being destroyed
 161          * the qp pointer in the security structure is
 162          * undefined.  It cannot be modified now.
 163          */
 164         if (sec->destroying)
 165                 return;
 166
 167         ib_modify_qp(sec->qp,
 168                      &attr,
 169                      IB_QP_STATE);
 170
 171         if (sec->qp->event_handler && sec->qp->qp_context) {
 172                 event.element.qp = sec->qp;
 173                 sec->qp->event_handler(&event,
 174                                        sec->qp->qp_context);
 175         }
 176
 177         list_for_each_entry(shared_qp_sec,
 178                             &sec->shared_qp_list,
 179                             shared_qp_list) {
 180                 struct ib_qp *qp = shared_qp_sec->qp;
 181
 182                 if (qp->event_handler && qp->qp_context) {
 183                         event.element.qp = qp;
 184                         event.device = qp->device;
 185                         qp->event_handler(&event,
 186                                           qp->qp_context);
 187                 }
 188         }
 189 }
 190
 191 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
 192                                   struct ib_device *device,
 193                                   u8 port_num,
 194                                   u64 subnet_prefix)
 195 {
 196         struct ib_port_pkey *pp, *tmp_pp;
 197         bool comp;
 198         LIST_HEAD(to_error_list);
 199         u16 pkey_val;
 200
 201         if (!ib_get_cached_pkey(device,
 202                                 port_num,
 203                                 pkey->pkey_index,
 204                                 &pkey_val)) {
 205                 spin_lock(&pkey->qp_list_lock);
 206                 list_for_each_entry(pp, &pkey->qp_list, qp_list) {
 207                         if (atomic_read(&pp->sec->error_list_count))
 208                                 continue;
 209
 210                         if (enforce_qp_pkey_security(pkey_val,
 211                                                      subnet_prefix,
 212                                                      pp->sec)) {
 213                                 atomic_inc(&pp->sec->error_list_count);
 214                                 list_add(&pp->to_error_list,
 215                                          &to_error_list);
 216                         }
 217                 }
 218                 spin_unlock(&pkey->qp_list_lock);
 219         }
 220
 221         list_for_each_entry_safe(pp,
 222                                  tmp_pp,
 223                                  &to_error_list,
 224                                  to_error_list) {
 225                 mutex_lock(&pp->sec->mutex);
 226                 qp_to_error(pp->sec);
 227                 list_del(&pp->to_error_list);
 228                 atomic_dec(&pp->sec->error_list_count);
 229                 comp = pp->sec->destroying;
 230                 mutex_unlock(&pp->sec->mutex);
 231
 232                 if (comp)
 233                         complete(&pp->sec->error_complete);
 234         }
 235 }
 236
 237 /* The caller of this function must hold the QP security
 238  * mutex.
 239  */
 240 static int port_pkey_list_insert(struct ib_port_pkey *pp)
 241 {
 242         struct pkey_index_qp_list *tmp_pkey;
 243         struct pkey_index_qp_list *pkey;
 244         struct ib_device *dev;
 245         u8 port_num = pp->port_num;
 246         int ret = 0;
 247
 248         if (pp->state != IB_PORT_PKEY_VALID)
 249                 return 0;
 250
 251         dev = pp->sec->dev;
 252
 253         pkey = get_pkey_idx_qp_list(pp);
 254
 255         if (!pkey) {
 256                 bool found = false;
 257
 258                 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
 259                 if (!pkey)
 260                         return -ENOMEM;
 261
 262                 spin_lock(&dev->port_pkey_list[port_num].list_lock);
 263                 /* Check for the PKey again.  A racing process may
 264                  * have created it.
 265                  */
 266                 list_for_each_entry(tmp_pkey,
 267                                     &dev->port_pkey_list[port_num].pkey_list,
 268                                     pkey_index_list) {
 269                         if (tmp_pkey->pkey_index == pp->pkey_index) {
 270                                 kfree(pkey);
 271                                 pkey = tmp_pkey;
 272                                 found = true;
 273                                 break;
 274                         }
 275                 }
 276
 277                 if (!found) {
 278                         pkey->pkey_index = pp->pkey_index;
 279                         spin_lock_init(&pkey->qp_list_lock);
 280                         INIT_LIST_HEAD(&pkey->qp_list);
 281                         list_add(&pkey->pkey_index_list,
 282                                  &dev->port_pkey_list[port_num].pkey_list);
 283                 }
 284                 spin_unlock(&dev->port_pkey_list[port_num].list_lock);
 285         }
 286
 287         spin_lock(&pkey->qp_list_lock);
 288         list_add(&pp->qp_list, &pkey->qp_list);
 289         spin_unlock(&pkey->qp_list_lock);
 290
 291         pp->state = IB_PORT_PKEY_LISTED;
 292
 293         return ret;
 294 }
 295
 296 /* The caller of this function must hold the QP security
 297  * mutex.
 298  */
 299 static void port_pkey_list_remove(struct ib_port_pkey *pp)
 300 {
 301         struct pkey_index_qp_list *pkey;
 302
 303         if (pp->state != IB_PORT_PKEY_LISTED)
 304                 return;
 305
 306         pkey = get_pkey_idx_qp_list(pp);
 307
 308         spin_lock(&pkey->qp_list_lock);
 309         list_del(&pp->qp_list);
 310         spin_unlock(&pkey->qp_list_lock);
 311
 312         /* The setting may still be valid, i.e. after
 313          * a destroy has failed for example.
 314          */
 315         pp->state = IB_PORT_PKEY_VALID;
 316 }
 317
 318 static void destroy_qp_security(struct ib_qp_security *sec)
 319 {
 320         security_ib_free_security(sec->security);
 321         kfree(sec->ports_pkeys);
 322         kfree(sec);
 323 }
 324
 325 /* The caller of this function must hold the QP security
 326  * mutex.
 327  */
 328 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
 329                                           const struct ib_qp_attr *qp_attr,
 330                                           int qp_attr_mask)
 331 {
 332         struct ib_ports_pkeys *new_pps;
 333         struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;
 334
 335         new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
 336         if (!new_pps)
 337                 return NULL;
 338
 339         if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) {
 340                 if (!qp_pps) {
 341                         new_pps->main.port_num = qp_attr->port_num;
 342                         new_pps->main.pkey_index = qp_attr->pkey_index;
 343                 } else {
 344                         new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ?
 345                                                   qp_attr->port_num :
 346                                                   qp_pps->main.port_num;
 347
 348                         new_pps->main.pkey_index =
 349                                         (qp_attr_mask & IB_QP_PKEY_INDEX) ?
 350                                          qp_attr->pkey_index :
 351                                          qp_pps->main.pkey_index;
 352                 }
 353                 new_pps->main.state = IB_PORT_PKEY_VALID;
 354         } else if (qp_pps) {
 355                 new_pps->main.port_num = qp_pps->main.port_num;
 356                 new_pps->main.pkey_index = qp_pps->main.pkey_index;
 357                 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
 358                         new_pps->main.state = IB_PORT_PKEY_VALID;
 359         }
 360
 361         if (qp_attr_mask & IB_QP_ALT_PATH) {
 362                 new_pps->alt.port_num = qp_attr->alt_port_num;
 363                 new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
 364                 new_pps->alt.state = IB_PORT_PKEY_VALID;
 365         } else if (qp_pps) {
 366                 new_pps->alt.port_num = qp_pps->alt.port_num;
 367                 new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
 368                 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
 369                         new_pps->alt.state = IB_PORT_PKEY_VALID;
 370         }
 371
 372         new_pps->main.sec = qp->qp_sec;
 373         new_pps->alt.sec = qp->qp_sec;
 374         return new_pps;
 375 }
 376
 377 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
 378 {
 379         struct ib_qp *real_qp = qp->real_qp;
 380         int ret;
 381
 382         ret = ib_create_qp_security(qp, dev);
 383
 384         if (ret)
 385                 return ret;
 386
 387         if (!qp->qp_sec)
 388                 return 0;
 389
 390         mutex_lock(&real_qp->qp_sec->mutex);
 391         ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
 392                                           qp->qp_sec);
 393
 394         if (ret)
 395                 goto ret;
 396
 397         if (qp != real_qp)
 398                 list_add(&qp->qp_sec->shared_qp_list,
 399                          &real_qp->qp_sec->shared_qp_list);
 400 ret:
 401         mutex_unlock(&real_qp->qp_sec->mutex);
 402         if (ret)
 403                 destroy_qp_security(qp->qp_sec);
 404
 405         return ret;
 406 }
 407
 408 void ib_close_shared_qp_security(struct ib_qp_security *sec)
 409 {
 410         struct ib_qp *real_qp = sec->qp->real_qp;
 411
 412         mutex_lock(&real_qp->qp_sec->mutex);
 413         list_del(&sec->shared_qp_list);
 414         mutex_unlock(&real_qp->qp_sec->mutex);
 415
 416         destroy_qp_security(sec);
 417 }
 418
 419 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
 420 {
 421         u8 i = rdma_start_port(dev);
 422         bool is_ib = false;
 423         int ret;
 424
 425         while (i <= rdma_end_port(dev) && !is_ib)
 426                 is_ib = rdma_protocol_ib(dev, i++);
 427
 428         /* If this isn't an IB device don't create the security context */
 429         if (!is_ib)
 430                 return 0;
 431
 432         qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
 433         if (!qp->qp_sec)
 434                 return -ENOMEM;
 435
 436         qp->qp_sec->qp = qp;
 437         qp->qp_sec->dev = dev;
 438         mutex_init(&qp->qp_sec->mutex);
 439         INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
 440         atomic_set(&qp->qp_sec->error_list_count, 0);
 441         init_completion(&qp->qp_sec->error_complete);
 442         ret = security_ib_alloc_security(&qp->qp_sec->security);
 443         if (ret) {
 444                 kfree(qp->qp_sec);
 445                 qp->qp_sec = NULL;
 446         }
 447
 448         return ret;
 449 }
 450 EXPORT_SYMBOL(ib_create_qp_security);
 451
 452 void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
 453 {
 454         /* Return if not IB */
 455         if (!sec)
 456                 return;
 457
 458         mutex_lock(&sec->mutex);
 459
 460         /* Remove the QP from the lists so it won't get added to
 461          * a to_error_list during the destroy process.
 462          */
 463         if (sec->ports_pkeys) {
 464                 port_pkey_list_remove(&sec->ports_pkeys->main);
 465                 port_pkey_list_remove(&sec->ports_pkeys->alt);
 466         }
 467
 468         /* If the QP is already in one or more of those lists
 469          * the destroying flag will ensure the to error flow
 470          * doesn't operate on an undefined QP.
 471          */
 472         sec->destroying = true;
 473
 474         /* Record the error list count to know how many completions
 475          * to wait for.
 476          */
 477         sec->error_comps_pending = atomic_read(&sec->error_list_count);
 478
 479         mutex_unlock(&sec->mutex);
 480 }
 481
 482 void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
 483 {
 484         int ret;
 485         int i;
 486
 487         /* Return if not IB */
 488         if (!sec)
 489                 return;
 490
 491         /* If a concurrent cache update is in progress this
 492          * QP security could be marked for an error state
 493          * transition.  Wait for this to complete.
 494          */
 495         for (i = 0; i < sec->error_comps_pending; i++)
 496                 wait_for_completion(&sec->error_complete);
 497
 498         mutex_lock(&sec->mutex);
 499         sec->destroying = false;
 500
 501         /* Restore the position in the lists and verify
 502          * access is still allowed in case a cache update
 503          * occurred while attempting to destroy.
 504          *
 505          * Because these setting were listed already
 506          * and removed during ib_destroy_qp_security_begin
 507          * we know the pkey_index_qp_list for the PKey
 508          * already exists so port_pkey_list_insert won't fail.
 509          */
 510         if (sec->ports_pkeys) {
 511                 port_pkey_list_insert(&sec->ports_pkeys->main);
 512                 port_pkey_list_insert(&sec->ports_pkeys->alt);
 513         }
 514
 515         ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
 516         if (ret)
 517                 qp_to_error(sec);
 518
 519         mutex_unlock(&sec->mutex);
 520 }
 521
 522 void ib_destroy_qp_security_end(struct ib_qp_security *sec)
 523 {
 524         int i;
 525
 526         /* Return if not IB */
 527         if (!sec)
 528                 return;
 529
 530         /* If a concurrent cache update is occurring we must
 531          * wait until this QP security structure is processed
 532          * in the QP to error flow before destroying it because
 533          * the to_error_list is in use.
 534          */
 535         for (i = 0; i < sec->error_comps_pending; i++)
 536                 wait_for_completion(&sec->error_complete);
 537
 538         destroy_qp_security(sec);
 539 }
 540
 541 void ib_security_cache_change(struct ib_device *device,
 542                               u8 port_num,
 543                               u64 subnet_prefix)
 544 {
 545         struct pkey_index_qp_list *pkey;
 546
 547         list_for_each_entry(pkey,
 548                             &device->port_pkey_list[port_num].pkey_list,
 549                             pkey_index_list) {
 550                 check_pkey_qps(pkey,
 551                                device,
 552                                port_num,
 553                                subnet_prefix);
 554         }
 555 }
 556
 557 void ib_security_destroy_port_pkey_list(struct ib_device *device)
 558 {
 559         struct pkey_index_qp_list *pkey, *tmp_pkey;
 560         int i;
 561
 562         for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
 563                 spin_lock(&device->port_pkey_list[i].list_lock);
 564                 list_for_each_entry_safe(pkey,
 565                                          tmp_pkey,
 566                                          &device->port_pkey_list[i].pkey_list,
 567                                          pkey_index_list) {
 568                         list_del(&pkey->pkey_index_list);
 569                         kfree(pkey);
 570                 }
 571                 spin_unlock(&device->port_pkey_list[i].list_lock);
 572         }
 573 }
 574
 575 int ib_security_modify_qp(struct ib_qp *qp,
 576                           struct ib_qp_attr *qp_attr,
 577                           int qp_attr_mask,
 578                           struct ib_udata *udata)
 579 {
 580         int ret = 0;
 581         struct ib_ports_pkeys *tmp_pps;
 582         struct ib_ports_pkeys *new_pps = NULL;
 583         struct ib_qp *real_qp = qp->real_qp;
 584         bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
 585                            real_qp->qp_type == IB_QPT_GSI ||
 586                            real_qp->qp_type >= IB_QPT_RESERVED1);
 587         bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
 588                            (qp_attr_mask & IB_QP_ALT_PATH));
 589
 590         WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
 591                    rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
 592                    !real_qp->qp_sec),
 593                    "%s: QP security is not initialized for IB QP: %d\n",
 594                    __func__, real_qp->qp_num);
 595
 596         /* The port/pkey settings are maintained only for the real QP. Open
 597          * handles on the real QP will be in the shared_qp_list. When
 598          * enforcing security on the real QP all the shared QPs will be
 599          * checked as well.
 600          */
 601
 602         if (pps_change && !special_qp && real_qp->qp_sec) {
 603                 mutex_lock(&real_qp->qp_sec->mutex);
 604                 new_pps = get_new_pps(real_qp,
 605                                       qp_attr,
 606                                       qp_attr_mask);
 607                 if (!new_pps) {
 608                         mutex_unlock(&real_qp->qp_sec->mutex);
 609                         return -ENOMEM;
 610                 }
 611                 /* Add this QP to the lists for the new port
 612                  * and pkey settings before checking for permission
 613                  * in case there is a concurrent cache update
 614                  * occurring.  Walking the list for a cache change
 615                  * doesn't acquire the security mutex unless it's
 616                  * sending the QP to error.
 617                  */
 618                 ret = port_pkey_list_insert(&new_pps->main);
 619
 620                 if (!ret)
 621                         ret = port_pkey_list_insert(&new_pps->alt);
 622
 623                 if (!ret)
 624                         ret = check_qp_port_pkey_settings(new_pps,
 625                                                           real_qp->qp_sec);
 626         }
 627
 628         if (!ret)
 629                 ret = real_qp->device->modify_qp(real_qp,
 630                                                  qp_attr,
 631                                                  qp_attr_mask,
 632                                                  udata);
 633
 634         if (new_pps) {
 635                 /* Clean up the lists and free the appropriate
 636                  * ports_pkeys structure.
 637                  */
 638                 if (ret) {
 639                         tmp_pps = new_pps;
 640                 } else {
 641                         tmp_pps = real_qp->qp_sec->ports_pkeys;
 642                         real_qp->qp_sec->ports_pkeys = new_pps;
 643                 }
 644
 645                 if (tmp_pps) {
 646                         port_pkey_list_remove(&tmp_pps->main);
 647                         port_pkey_list_remove(&tmp_pps->alt);
 648                 }
 649                 kfree(tmp_pps);
 650                 mutex_unlock(&real_qp->qp_sec->mutex);
 651         }
 652         return ret;
 653 }
 654
 655 static int ib_security_pkey_access(struct ib_device *dev,
 656                                    u8 port_num,
 657                                    u16 pkey_index,
 658                                    void *sec)
 659 {
 660         u64 subnet_prefix;
 661         u16 pkey;
 662         int ret;
 663
 664         if (!rdma_protocol_ib(dev, port_num))
 665                 return 0;
 666
 667         ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
 668         if (ret)
 669                 return ret;
 670
 671         ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);
 672
 673         if (ret)
 674                 return ret;
 675
 676         return security_ib_pkey_access(sec, subnet_prefix, pkey);
 677 }
 678
 679 static int ib_mad_agent_security_change(struct notifier_block *nb,
 680                                         unsigned long event,
 681                                         void *data)
 682 {
 683         struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb);
 684
 685         if (event != LSM_POLICY_CHANGE)
 686                 return NOTIFY_DONE;
 687
 688         ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security,
 689                                                              ag->device->name,
 690                                                              ag->port_num);
 691
 692         return NOTIFY_OK;
 693 }
 694
 695 int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
 696                                 enum ib_qp_type qp_type)
 697 {
 698         int ret;
 699
 700         if (!rdma_protocol_ib(agent->device, agent->port_num))
 701                 return 0;
 702
 703         ret = security_ib_alloc_security(&agent->security);
 704         if (ret)
 705                 return ret;
 706
 707         if (qp_type != IB_QPT_SMI)
 708                 return 0;
 709
 710         ret = security_ib_endport_manage_subnet(agent->security,
 711                                                 agent->device->name,
 712                                                 agent->port_num);
 713         if (ret)
 714                 return ret;
 715
 716         agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
 717         ret = register_lsm_notifier(&agent->lsm_nb);
 718         if (ret)
 719                 return ret;
 720
 721         agent->smp_allowed = true;
 722         agent->lsm_nb_reg = true;
 723         return 0;
 724 }
 725
 726 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
 727 {
 728         if (!rdma_protocol_ib(agent->device, agent->port_num))
 729                 return;
 730
 731         security_ib_free_security(agent->security);
 732         if (agent->lsm_nb_reg)
 733                 unregister_lsm_notifier(&agent->lsm_nb);
 734 }
 735
 736 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
 737 {
 738         if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
 739                 return 0;
 740
 741         if (map->agent.qp->qp_type == IB_QPT_SMI) {
 742                 if (!map->agent.smp_allowed)
 743                         return -EACCES;
 744                 return 0;
 745         }
 746
 747         return ib_security_pkey_access(map->agent.device,
 748                                        map->agent.port_num,
 749                                        pkey_index,
 750                                        map->agent.security);
 751 }