1 /*
2 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
3 *
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
9 *
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
12 * conditions are met:
13 *
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer.
17 *
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30 * SOFTWARE.
31 */
32
33 #ifdef CONFIG_SECURITY_INFINIBAND
34
35 #include <linux/security.h>
36 #include <linux/completion.h>
37 #include <linux/list.h>
38
39 #include <rdma/ib_verbs.h>
40 #include <rdma/ib_cache.h>
41 #include "core_priv.h"
42 #include "mad_priv.h"
43
get_pkey_idx_qp_list(struct ib_port_pkey * pp)44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp)
45 {
46 struct pkey_index_qp_list *pkey = NULL;
47 struct pkey_index_qp_list *tmp_pkey;
48 struct ib_device *dev = pp->sec->dev;
49
50 spin_lock(&dev->port_pkey_list[pp->port_num].list_lock);
51 list_for_each_entry(tmp_pkey,
52 &dev->port_pkey_list[pp->port_num].pkey_list,
53 pkey_index_list) {
54 if (tmp_pkey->pkey_index == pp->pkey_index) {
55 pkey = tmp_pkey;
56 break;
57 }
58 }
59 spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock);
60 return pkey;
61 }
62
get_pkey_and_subnet_prefix(struct ib_port_pkey * pp,u16 * pkey,u64 * subnet_prefix)63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
64 u16 *pkey,
65 u64 *subnet_prefix)
66 {
67 struct ib_device *dev = pp->sec->dev;
68 int ret;
69
70 ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
71 if (ret)
72 return ret;
73
74 ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);
75
76 return ret;
77 }
78
enforce_qp_pkey_security(u16 pkey,u64 subnet_prefix,struct ib_qp_security * qp_sec)79 static int enforce_qp_pkey_security(u16 pkey,
80 u64 subnet_prefix,
81 struct ib_qp_security *qp_sec)
82 {
83 struct ib_qp_security *shared_qp_sec;
84 int ret;
85
86 ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
87 if (ret)
88 return ret;
89
90 list_for_each_entry(shared_qp_sec,
91 &qp_sec->shared_qp_list,
92 shared_qp_list) {
93 ret = security_ib_pkey_access(shared_qp_sec->security,
94 subnet_prefix,
95 pkey);
96 if (ret)
97 return ret;
98 }
99 return 0;
100 }
101
102 /* The caller of this function must hold the QP security
103 * mutex of the QP of the security structure in *pps.
104 *
105 * It takes separate ports_pkeys and security structure
106 * because in some cases the pps will be for a new settings
107 * or the pps will be for the real QP and security structure
108 * will be for a shared QP.
109 */
check_qp_port_pkey_settings(struct ib_ports_pkeys * pps,struct ib_qp_security * sec)110 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
111 struct ib_qp_security *sec)
112 {
113 u64 subnet_prefix;
114 u16 pkey;
115 int ret = 0;
116
117 if (!pps)
118 return 0;
119
120 if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
121 ret = get_pkey_and_subnet_prefix(&pps->main,
122 &pkey,
123 &subnet_prefix);
124 if (ret)
125 return ret;
126
127 ret = enforce_qp_pkey_security(pkey,
128 subnet_prefix,
129 sec);
130 if (ret)
131 return ret;
132 }
133
134 if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
135 ret = get_pkey_and_subnet_prefix(&pps->alt,
136 &pkey,
137 &subnet_prefix);
138 if (ret)
139 return ret;
140
141 ret = enforce_qp_pkey_security(pkey,
142 subnet_prefix,
143 sec);
144 }
145
146 return ret;
147 }
148
149 /* The caller of this function must hold the QP security
150 * mutex.
151 */
qp_to_error(struct ib_qp_security * sec)152 static void qp_to_error(struct ib_qp_security *sec)
153 {
154 struct ib_qp_security *shared_qp_sec;
155 struct ib_qp_attr attr = {
156 .qp_state = IB_QPS_ERR
157 };
158 struct ib_event event = {
159 .event = IB_EVENT_QP_FATAL
160 };
161
162 /* If the QP is in the process of being destroyed
163 * the qp pointer in the security structure is
164 * undefined. It cannot be modified now.
165 */
166 if (sec->destroying)
167 return;
168
169 ib_modify_qp(sec->qp,
170 &attr,
171 IB_QP_STATE);
172
173 if (sec->qp->event_handler && sec->qp->qp_context) {
174 event.element.qp = sec->qp;
175 sec->qp->event_handler(&event,
176 sec->qp->qp_context);
177 }
178
179 list_for_each_entry(shared_qp_sec,
180 &sec->shared_qp_list,
181 shared_qp_list) {
182 struct ib_qp *qp = shared_qp_sec->qp;
183
184 if (qp->event_handler && qp->qp_context) {
185 event.element.qp = qp;
186 event.device = qp->device;
187 qp->event_handler(&event,
188 qp->qp_context);
189 }
190 }
191 }
192
check_pkey_qps(struct pkey_index_qp_list * pkey,struct ib_device * device,u8 port_num,u64 subnet_prefix)193 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
194 struct ib_device *device,
195 u8 port_num,
196 u64 subnet_prefix)
197 {
198 struct ib_port_pkey *pp, *tmp_pp;
199 bool comp;
200 LIST_HEAD(to_error_list);
201 u16 pkey_val;
202
203 if (!ib_get_cached_pkey(device,
204 port_num,
205 pkey->pkey_index,
206 &pkey_val)) {
207 spin_lock(&pkey->qp_list_lock);
208 list_for_each_entry(pp, &pkey->qp_list, qp_list) {
209 if (atomic_read(&pp->sec->error_list_count))
210 continue;
211
212 if (enforce_qp_pkey_security(pkey_val,
213 subnet_prefix,
214 pp->sec)) {
215 atomic_inc(&pp->sec->error_list_count);
216 list_add(&pp->to_error_list,
217 &to_error_list);
218 }
219 }
220 spin_unlock(&pkey->qp_list_lock);
221 }
222
223 list_for_each_entry_safe(pp,
224 tmp_pp,
225 &to_error_list,
226 to_error_list) {
227 mutex_lock(&pp->sec->mutex);
228 qp_to_error(pp->sec);
229 list_del(&pp->to_error_list);
230 atomic_dec(&pp->sec->error_list_count);
231 comp = pp->sec->destroying;
232 mutex_unlock(&pp->sec->mutex);
233
234 if (comp)
235 complete(&pp->sec->error_complete);
236 }
237 }
238
239 /* The caller of this function must hold the QP security
240 * mutex.
241 */
port_pkey_list_insert(struct ib_port_pkey * pp)242 static int port_pkey_list_insert(struct ib_port_pkey *pp)
243 {
244 struct pkey_index_qp_list *tmp_pkey;
245 struct pkey_index_qp_list *pkey;
246 struct ib_device *dev;
247 u8 port_num = pp->port_num;
248 int ret = 0;
249
250 if (pp->state != IB_PORT_PKEY_VALID)
251 return 0;
252
253 dev = pp->sec->dev;
254
255 pkey = get_pkey_idx_qp_list(pp);
256
257 if (!pkey) {
258 bool found = false;
259
260 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
261 if (!pkey)
262 return -ENOMEM;
263
264 spin_lock(&dev->port_pkey_list[port_num].list_lock);
265 /* Check for the PKey again. A racing process may
266 * have created it.
267 */
268 list_for_each_entry(tmp_pkey,
269 &dev->port_pkey_list[port_num].pkey_list,
270 pkey_index_list) {
271 if (tmp_pkey->pkey_index == pp->pkey_index) {
272 kfree(pkey);
273 pkey = tmp_pkey;
274 found = true;
275 break;
276 }
277 }
278
279 if (!found) {
280 pkey->pkey_index = pp->pkey_index;
281 spin_lock_init(&pkey->qp_list_lock);
282 INIT_LIST_HEAD(&pkey->qp_list);
283 list_add(&pkey->pkey_index_list,
284 &dev->port_pkey_list[port_num].pkey_list);
285 }
286 spin_unlock(&dev->port_pkey_list[port_num].list_lock);
287 }
288
289 spin_lock(&pkey->qp_list_lock);
290 list_add(&pp->qp_list, &pkey->qp_list);
291 spin_unlock(&pkey->qp_list_lock);
292
293 pp->state = IB_PORT_PKEY_LISTED;
294
295 return ret;
296 }
297
298 /* The caller of this function must hold the QP security
299 * mutex.
300 */
port_pkey_list_remove(struct ib_port_pkey * pp)301 static void port_pkey_list_remove(struct ib_port_pkey *pp)
302 {
303 struct pkey_index_qp_list *pkey;
304
305 if (pp->state != IB_PORT_PKEY_LISTED)
306 return;
307
308 pkey = get_pkey_idx_qp_list(pp);
309
310 spin_lock(&pkey->qp_list_lock);
311 list_del(&pp->qp_list);
312 spin_unlock(&pkey->qp_list_lock);
313
314 /* The setting may still be valid, i.e. after
315 * a destroy has failed for example.
316 */
317 pp->state = IB_PORT_PKEY_VALID;
318 }
319
destroy_qp_security(struct ib_qp_security * sec)320 static void destroy_qp_security(struct ib_qp_security *sec)
321 {
322 security_ib_free_security(sec->security);
323 kfree(sec->ports_pkeys);
324 kfree(sec);
325 }
326
327 /* The caller of this function must hold the QP security
328 * mutex.
329 */
get_new_pps(const struct ib_qp * qp,const struct ib_qp_attr * qp_attr,int qp_attr_mask)330 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
331 const struct ib_qp_attr *qp_attr,
332 int qp_attr_mask)
333 {
334 struct ib_ports_pkeys *new_pps;
335 struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;
336
337 new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
338 if (!new_pps)
339 return NULL;
340
341 if (qp_attr_mask & IB_QP_PORT)
342 new_pps->main.port_num = qp_attr->port_num;
343 else if (qp_pps)
344 new_pps->main.port_num = qp_pps->main.port_num;
345
346 if (qp_attr_mask & IB_QP_PKEY_INDEX)
347 new_pps->main.pkey_index = qp_attr->pkey_index;
348 else if (qp_pps)
349 new_pps->main.pkey_index = qp_pps->main.pkey_index;
350
351 if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
352 (qp_attr_mask & IB_QP_PORT)) ||
353 (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
354 new_pps->main.state = IB_PORT_PKEY_VALID;
355
356 if (qp_attr_mask & IB_QP_ALT_PATH) {
357 new_pps->alt.port_num = qp_attr->alt_port_num;
358 new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
359 new_pps->alt.state = IB_PORT_PKEY_VALID;
360 } else if (qp_pps) {
361 new_pps->alt.port_num = qp_pps->alt.port_num;
362 new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
363 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
364 new_pps->alt.state = IB_PORT_PKEY_VALID;
365 }
366
367 new_pps->main.sec = qp->qp_sec;
368 new_pps->alt.sec = qp->qp_sec;
369 return new_pps;
370 }
371
ib_open_shared_qp_security(struct ib_qp * qp,struct ib_device * dev)372 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
373 {
374 struct ib_qp *real_qp = qp->real_qp;
375 int ret;
376
377 ret = ib_create_qp_security(qp, dev);
378
379 if (ret)
380 return ret;
381
382 if (!qp->qp_sec)
383 return 0;
384
385 mutex_lock(&real_qp->qp_sec->mutex);
386 ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
387 qp->qp_sec);
388
389 if (ret)
390 goto ret;
391
392 if (qp != real_qp)
393 list_add(&qp->qp_sec->shared_qp_list,
394 &real_qp->qp_sec->shared_qp_list);
395 ret:
396 mutex_unlock(&real_qp->qp_sec->mutex);
397 if (ret)
398 destroy_qp_security(qp->qp_sec);
399
400 return ret;
401 }
402
ib_close_shared_qp_security(struct ib_qp_security * sec)403 void ib_close_shared_qp_security(struct ib_qp_security *sec)
404 {
405 struct ib_qp *real_qp = sec->qp->real_qp;
406
407 mutex_lock(&real_qp->qp_sec->mutex);
408 list_del(&sec->shared_qp_list);
409 mutex_unlock(&real_qp->qp_sec->mutex);
410
411 destroy_qp_security(sec);
412 }
413
ib_create_qp_security(struct ib_qp * qp,struct ib_device * dev)414 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
415 {
416 u8 i = rdma_start_port(dev);
417 bool is_ib = false;
418 int ret;
419
420 while (i <= rdma_end_port(dev) && !is_ib)
421 is_ib = rdma_protocol_ib(dev, i++);
422
423 /* If this isn't an IB device don't create the security context */
424 if (!is_ib)
425 return 0;
426
427 qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
428 if (!qp->qp_sec)
429 return -ENOMEM;
430
431 qp->qp_sec->qp = qp;
432 qp->qp_sec->dev = dev;
433 mutex_init(&qp->qp_sec->mutex);
434 INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
435 atomic_set(&qp->qp_sec->error_list_count, 0);
436 init_completion(&qp->qp_sec->error_complete);
437 ret = security_ib_alloc_security(&qp->qp_sec->security);
438 if (ret) {
439 kfree(qp->qp_sec);
440 qp->qp_sec = NULL;
441 }
442
443 return ret;
444 }
445 EXPORT_SYMBOL(ib_create_qp_security);
446
ib_destroy_qp_security_begin(struct ib_qp_security * sec)447 void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
448 {
449 /* Return if not IB */
450 if (!sec)
451 return;
452
453 mutex_lock(&sec->mutex);
454
455 /* Remove the QP from the lists so it won't get added to
456 * a to_error_list during the destroy process.
457 */
458 if (sec->ports_pkeys) {
459 port_pkey_list_remove(&sec->ports_pkeys->main);
460 port_pkey_list_remove(&sec->ports_pkeys->alt);
461 }
462
463 /* If the QP is already in one or more of those lists
464 * the destroying flag will ensure the to error flow
465 * doesn't operate on an undefined QP.
466 */
467 sec->destroying = true;
468
469 /* Record the error list count to know how many completions
470 * to wait for.
471 */
472 sec->error_comps_pending = atomic_read(&sec->error_list_count);
473
474 mutex_unlock(&sec->mutex);
475 }
476
ib_destroy_qp_security_abort(struct ib_qp_security * sec)477 void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
478 {
479 int ret;
480 int i;
481
482 /* Return if not IB */
483 if (!sec)
484 return;
485
486 /* If a concurrent cache update is in progress this
487 * QP security could be marked for an error state
488 * transition. Wait for this to complete.
489 */
490 for (i = 0; i < sec->error_comps_pending; i++)
491 wait_for_completion(&sec->error_complete);
492
493 mutex_lock(&sec->mutex);
494 sec->destroying = false;
495
496 /* Restore the position in the lists and verify
497 * access is still allowed in case a cache update
498 * occurred while attempting to destroy.
499 *
500 * Because these setting were listed already
501 * and removed during ib_destroy_qp_security_begin
502 * we know the pkey_index_qp_list for the PKey
503 * already exists so port_pkey_list_insert won't fail.
504 */
505 if (sec->ports_pkeys) {
506 port_pkey_list_insert(&sec->ports_pkeys->main);
507 port_pkey_list_insert(&sec->ports_pkeys->alt);
508 }
509
510 ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
511 if (ret)
512 qp_to_error(sec);
513
514 mutex_unlock(&sec->mutex);
515 }
516
ib_destroy_qp_security_end(struct ib_qp_security * sec)517 void ib_destroy_qp_security_end(struct ib_qp_security *sec)
518 {
519 int i;
520
521 /* Return if not IB */
522 if (!sec)
523 return;
524
525 /* If a concurrent cache update is occurring we must
526 * wait until this QP security structure is processed
527 * in the QP to error flow before destroying it because
528 * the to_error_list is in use.
529 */
530 for (i = 0; i < sec->error_comps_pending; i++)
531 wait_for_completion(&sec->error_complete);
532
533 destroy_qp_security(sec);
534 }
535
ib_security_cache_change(struct ib_device * device,u8 port_num,u64 subnet_prefix)536 void ib_security_cache_change(struct ib_device *device,
537 u8 port_num,
538 u64 subnet_prefix)
539 {
540 struct pkey_index_qp_list *pkey;
541
542 list_for_each_entry(pkey,
543 &device->port_pkey_list[port_num].pkey_list,
544 pkey_index_list) {
545 check_pkey_qps(pkey,
546 device,
547 port_num,
548 subnet_prefix);
549 }
550 }
551
ib_security_destroy_port_pkey_list(struct ib_device * device)552 void ib_security_destroy_port_pkey_list(struct ib_device *device)
553 {
554 struct pkey_index_qp_list *pkey, *tmp_pkey;
555 int i;
556
557 for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
558 spin_lock(&device->port_pkey_list[i].list_lock);
559 list_for_each_entry_safe(pkey,
560 tmp_pkey,
561 &device->port_pkey_list[i].pkey_list,
562 pkey_index_list) {
563 list_del(&pkey->pkey_index_list);
564 kfree(pkey);
565 }
566 spin_unlock(&device->port_pkey_list[i].list_lock);
567 }
568 }
569
ib_security_modify_qp(struct ib_qp * qp,struct ib_qp_attr * qp_attr,int qp_attr_mask,struct ib_udata * udata)570 int ib_security_modify_qp(struct ib_qp *qp,
571 struct ib_qp_attr *qp_attr,
572 int qp_attr_mask,
573 struct ib_udata *udata)
574 {
575 int ret = 0;
576 struct ib_ports_pkeys *tmp_pps;
577 struct ib_ports_pkeys *new_pps = NULL;
578 struct ib_qp *real_qp = qp->real_qp;
579 bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
580 real_qp->qp_type == IB_QPT_GSI ||
581 real_qp->qp_type >= IB_QPT_RESERVED1);
582 bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
583 (qp_attr_mask & IB_QP_ALT_PATH));
584
585 WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
586 rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
587 !real_qp->qp_sec),
588 "%s: QP security is not initialized for IB QP: %d\n",
589 __func__, real_qp->qp_num);
590
591 /* The port/pkey settings are maintained only for the real QP. Open
592 * handles on the real QP will be in the shared_qp_list. When
593 * enforcing security on the real QP all the shared QPs will be
594 * checked as well.
595 */
596
597 if (pps_change && !special_qp && real_qp->qp_sec) {
598 mutex_lock(&real_qp->qp_sec->mutex);
599 new_pps = get_new_pps(real_qp,
600 qp_attr,
601 qp_attr_mask);
602 if (!new_pps) {
603 mutex_unlock(&real_qp->qp_sec->mutex);
604 return -ENOMEM;
605 }
606 /* Add this QP to the lists for the new port
607 * and pkey settings before checking for permission
608 * in case there is a concurrent cache update
609 * occurring. Walking the list for a cache change
610 * doesn't acquire the security mutex unless it's
611 * sending the QP to error.
612 */
613 ret = port_pkey_list_insert(&new_pps->main);
614
615 if (!ret)
616 ret = port_pkey_list_insert(&new_pps->alt);
617
618 if (!ret)
619 ret = check_qp_port_pkey_settings(new_pps,
620 real_qp->qp_sec);
621 }
622
623 if (!ret)
624 ret = real_qp->device->modify_qp(real_qp,
625 qp_attr,
626 qp_attr_mask,
627 udata);
628
629 if (new_pps) {
630 /* Clean up the lists and free the appropriate
631 * ports_pkeys structure.
632 */
633 if (ret) {
634 tmp_pps = new_pps;
635 } else {
636 tmp_pps = real_qp->qp_sec->ports_pkeys;
637 real_qp->qp_sec->ports_pkeys = new_pps;
638 }
639
640 if (tmp_pps) {
641 port_pkey_list_remove(&tmp_pps->main);
642 port_pkey_list_remove(&tmp_pps->alt);
643 }
644 kfree(tmp_pps);
645 mutex_unlock(&real_qp->qp_sec->mutex);
646 }
647 return ret;
648 }
649 EXPORT_SYMBOL(ib_security_modify_qp);
650
ib_security_pkey_access(struct ib_device * dev,u8 port_num,u16 pkey_index,void * sec)651 int ib_security_pkey_access(struct ib_device *dev,
652 u8 port_num,
653 u16 pkey_index,
654 void *sec)
655 {
656 u64 subnet_prefix;
657 u16 pkey;
658 int ret;
659
660 if (!rdma_protocol_ib(dev, port_num))
661 return 0;
662
663 ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
664 if (ret)
665 return ret;
666
667 ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);
668
669 if (ret)
670 return ret;
671
672 return security_ib_pkey_access(sec, subnet_prefix, pkey);
673 }
674 EXPORT_SYMBOL(ib_security_pkey_access);
675
ib_mad_agent_security_change(struct notifier_block * nb,unsigned long event,void * data)676 static int ib_mad_agent_security_change(struct notifier_block *nb,
677 unsigned long event,
678 void *data)
679 {
680 struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb);
681
682 if (event != LSM_POLICY_CHANGE)
683 return NOTIFY_DONE;
684
685 ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security,
686 ag->device->name,
687 ag->port_num);
688
689 return NOTIFY_OK;
690 }
691
ib_mad_agent_security_setup(struct ib_mad_agent * agent,enum ib_qp_type qp_type)692 int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
693 enum ib_qp_type qp_type)
694 {
695 int ret;
696
697 if (!rdma_protocol_ib(agent->device, agent->port_num))
698 return 0;
699
700 ret = security_ib_alloc_security(&agent->security);
701 if (ret)
702 return ret;
703
704 if (qp_type != IB_QPT_SMI)
705 return 0;
706
707 ret = security_ib_endport_manage_subnet(agent->security,
708 agent->device->name,
709 agent->port_num);
710 if (ret)
711 goto free_security;
712
713 agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
714 ret = register_lsm_notifier(&agent->lsm_nb);
715 if (ret)
716 goto free_security;
717
718 agent->smp_allowed = true;
719 agent->lsm_nb_reg = true;
720 return 0;
721
722 free_security:
723 security_ib_free_security(agent->security);
724 return ret;
725 }
726
ib_mad_agent_security_cleanup(struct ib_mad_agent * agent)727 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
728 {
729 if (!rdma_protocol_ib(agent->device, agent->port_num))
730 return;
731
732 if (agent->lsm_nb_reg)
733 unregister_lsm_notifier(&agent->lsm_nb);
734
735 security_ib_free_security(agent->security);
736 }
737
ib_mad_enforce_security(struct ib_mad_agent_private * map,u16 pkey_index)738 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
739 {
740 if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
741 return 0;
742
743 if (map->agent.qp->qp_type == IB_QPT_SMI) {
744 if (!map->agent.smp_allowed)
745 return -EACCES;
746 return 0;
747 }
748
749 return ib_security_pkey_access(map->agent.device,
750 map->agent.port_num,
751 pkey_index,
752 map->agent.security);
753 }
754
755 #endif /* CONFIG_SECURITY_INFINIBAND */
756