1 /* 2 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 */ 32 33 #ifdef CONFIG_SECURITY_INFINIBAND 34 35 #include <linux/security.h> 36 #include <linux/completion.h> 37 #include <linux/list.h> 38 39 #include <rdma/ib_verbs.h> 40 #include <rdma/ib_cache.h> 41 #include "core_priv.h" 42 #include "mad_priv.h" 43 44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp) 45 { 46 struct pkey_index_qp_list *pkey = NULL; 47 struct pkey_index_qp_list *tmp_pkey; 48 struct ib_device *dev = pp->sec->dev; 49 50 spin_lock(&dev->port_pkey_list[pp->port_num].list_lock); 51 list_for_each_entry(tmp_pkey, 52 &dev->port_pkey_list[pp->port_num].pkey_list, 53 pkey_index_list) { 54 if (tmp_pkey->pkey_index == pp->pkey_index) { 55 pkey = tmp_pkey; 56 break; 57 } 58 } 59 spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock); 60 return pkey; 61 } 62 63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp, 64 u16 *pkey, 65 u64 *subnet_prefix) 66 { 67 struct ib_device *dev = pp->sec->dev; 68 int ret; 69 70 ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey); 71 if (ret) 72 return ret; 73 74 ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix); 75 76 return ret; 77 } 78 79 static int enforce_qp_pkey_security(u16 pkey, 80 u64 subnet_prefix, 81 struct ib_qp_security *qp_sec) 82 { 83 struct ib_qp_security *shared_qp_sec; 84 int ret; 85 86 ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey); 87 if (ret) 88 return ret; 89 90 if (qp_sec->qp == qp_sec->qp->real_qp) { 91 list_for_each_entry(shared_qp_sec, 92 &qp_sec->shared_qp_list, 93 shared_qp_list) { 94 ret = security_ib_pkey_access(shared_qp_sec->security, 95 subnet_prefix, 96 pkey); 97 if (ret) 98 return ret; 99 } 100 } 101 return 0; 102 } 103 104 /* The caller of this function must hold the QP security 105 * mutex of the QP of the security structure in *pps. 106 * 107 * It takes separate ports_pkeys and security structure 108 * because in some cases the pps will be for a new settings 109 * or the pps will be for the real QP and security structure 110 * will be for a shared QP. 111 */ 112 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps, 113 struct ib_qp_security *sec) 114 { 115 u64 subnet_prefix; 116 u16 pkey; 117 int ret = 0; 118 119 if (!pps) 120 return 0; 121 122 if (pps->main.state != IB_PORT_PKEY_NOT_VALID) { 123 ret = get_pkey_and_subnet_prefix(&pps->main, 124 &pkey, 125 &subnet_prefix); 126 if (ret) 127 return ret; 128 129 ret = enforce_qp_pkey_security(pkey, 130 subnet_prefix, 131 sec); 132 if (ret) 133 return ret; 134 } 135 136 if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) { 137 ret = get_pkey_and_subnet_prefix(&pps->alt, 138 &pkey, 139 &subnet_prefix); 140 if (ret) 141 return ret; 142 143 ret = enforce_qp_pkey_security(pkey, 144 subnet_prefix, 145 sec); 146 } 147 148 return ret; 149 } 150 151 /* The caller of this function must hold the QP security 152 * mutex. 153 */ 154 static void qp_to_error(struct ib_qp_security *sec) 155 { 156 struct ib_qp_security *shared_qp_sec; 157 struct ib_qp_attr attr = { 158 .qp_state = IB_QPS_ERR 159 }; 160 struct ib_event event = { 161 .event = IB_EVENT_QP_FATAL 162 }; 163 164 /* If the QP is in the process of being destroyed 165 * the qp pointer in the security structure is 166 * undefined. It cannot be modified now. 167 */ 168 if (sec->destroying) 169 return; 170 171 ib_modify_qp(sec->qp, 172 &attr, 173 IB_QP_STATE); 174 175 if (sec->qp->event_handler && sec->qp->qp_context) { 176 event.element.qp = sec->qp; 177 sec->qp->event_handler(&event, 178 sec->qp->qp_context); 179 } 180 181 list_for_each_entry(shared_qp_sec, 182 &sec->shared_qp_list, 183 shared_qp_list) { 184 struct ib_qp *qp = shared_qp_sec->qp; 185 186 if (qp->event_handler && qp->qp_context) { 187 event.element.qp = qp; 188 event.device = qp->device; 189 qp->event_handler(&event, 190 qp->qp_context); 191 } 192 } 193 } 194 195 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey, 196 struct ib_device *device, 197 u8 port_num, 198 u64 subnet_prefix) 199 { 200 struct ib_port_pkey *pp, *tmp_pp; 201 bool comp; 202 LIST_HEAD(to_error_list); 203 u16 pkey_val; 204 205 if (!ib_get_cached_pkey(device, 206 port_num, 207 pkey->pkey_index, 208 &pkey_val)) { 209 spin_lock(&pkey->qp_list_lock); 210 list_for_each_entry(pp, &pkey->qp_list, qp_list) { 211 if (atomic_read(&pp->sec->error_list_count)) 212 continue; 213 214 if (enforce_qp_pkey_security(pkey_val, 215 subnet_prefix, 216 pp->sec)) { 217 atomic_inc(&pp->sec->error_list_count); 218 list_add(&pp->to_error_list, 219 &to_error_list); 220 } 221 } 222 spin_unlock(&pkey->qp_list_lock); 223 } 224 225 list_for_each_entry_safe(pp, 226 tmp_pp, 227 &to_error_list, 228 to_error_list) { 229 mutex_lock(&pp->sec->mutex); 230 qp_to_error(pp->sec); 231 list_del(&pp->to_error_list); 232 atomic_dec(&pp->sec->error_list_count); 233 comp = pp->sec->destroying; 234 mutex_unlock(&pp->sec->mutex); 235 236 if (comp) 237 complete(&pp->sec->error_complete); 238 } 239 } 240 241 /* The caller of this function must hold the QP security 242 * mutex. 243 */ 244 static int port_pkey_list_insert(struct ib_port_pkey *pp) 245 { 246 struct pkey_index_qp_list *tmp_pkey; 247 struct pkey_index_qp_list *pkey; 248 struct ib_device *dev; 249 u8 port_num = pp->port_num; 250 int ret = 0; 251 252 if (pp->state != IB_PORT_PKEY_VALID) 253 return 0; 254 255 dev = pp->sec->dev; 256 257 pkey = get_pkey_idx_qp_list(pp); 258 259 if (!pkey) { 260 bool found = false; 261 262 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL); 263 if (!pkey) 264 return -ENOMEM; 265 266 spin_lock(&dev->port_pkey_list[port_num].list_lock); 267 /* Check for the PKey again. A racing process may 268 * have created it. 269 */ 270 list_for_each_entry(tmp_pkey, 271 &dev->port_pkey_list[port_num].pkey_list, 272 pkey_index_list) { 273 if (tmp_pkey->pkey_index == pp->pkey_index) { 274 kfree(pkey); 275 pkey = tmp_pkey; 276 found = true; 277 break; 278 } 279 } 280 281 if (!found) { 282 pkey->pkey_index = pp->pkey_index; 283 spin_lock_init(&pkey->qp_list_lock); 284 INIT_LIST_HEAD(&pkey->qp_list); 285 list_add(&pkey->pkey_index_list, 286 &dev->port_pkey_list[port_num].pkey_list); 287 } 288 spin_unlock(&dev->port_pkey_list[port_num].list_lock); 289 } 290 291 spin_lock(&pkey->qp_list_lock); 292 list_add(&pp->qp_list, &pkey->qp_list); 293 spin_unlock(&pkey->qp_list_lock); 294 295 pp->state = IB_PORT_PKEY_LISTED; 296 297 return ret; 298 } 299 300 /* The caller of this function must hold the QP security 301 * mutex. 302 */ 303 static void port_pkey_list_remove(struct ib_port_pkey *pp) 304 { 305 struct pkey_index_qp_list *pkey; 306 307 if (pp->state != IB_PORT_PKEY_LISTED) 308 return; 309 310 pkey = get_pkey_idx_qp_list(pp); 311 312 spin_lock(&pkey->qp_list_lock); 313 list_del(&pp->qp_list); 314 spin_unlock(&pkey->qp_list_lock); 315 316 /* The setting may still be valid, i.e. after 317 * a destroy has failed for example. 318 */ 319 pp->state = IB_PORT_PKEY_VALID; 320 } 321 322 static void destroy_qp_security(struct ib_qp_security *sec) 323 { 324 security_ib_free_security(sec->security); 325 kfree(sec->ports_pkeys); 326 kfree(sec); 327 } 328 329 /* The caller of this function must hold the QP security 330 * mutex. 331 */ 332 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, 333 const struct ib_qp_attr *qp_attr, 334 int qp_attr_mask) 335 { 336 struct ib_ports_pkeys *new_pps; 337 struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys; 338 339 new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL); 340 if (!new_pps) 341 return NULL; 342 343 if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) { 344 if (!qp_pps) { 345 new_pps->main.port_num = qp_attr->port_num; 346 new_pps->main.pkey_index = qp_attr->pkey_index; 347 } else { 348 new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ? 349 qp_attr->port_num : 350 qp_pps->main.port_num; 351 352 new_pps->main.pkey_index = 353 (qp_attr_mask & IB_QP_PKEY_INDEX) ? 354 qp_attr->pkey_index : 355 qp_pps->main.pkey_index; 356 } 357 new_pps->main.state = IB_PORT_PKEY_VALID; 358 } else if (qp_pps) { 359 new_pps->main.port_num = qp_pps->main.port_num; 360 new_pps->main.pkey_index = qp_pps->main.pkey_index; 361 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) 362 new_pps->main.state = IB_PORT_PKEY_VALID; 363 } 364 365 if (qp_attr_mask & IB_QP_ALT_PATH) { 366 new_pps->alt.port_num = qp_attr->alt_port_num; 367 new_pps->alt.pkey_index = qp_attr->alt_pkey_index; 368 new_pps->alt.state = IB_PORT_PKEY_VALID; 369 } else if (qp_pps) { 370 new_pps->alt.port_num = qp_pps->alt.port_num; 371 new_pps->alt.pkey_index = qp_pps->alt.pkey_index; 372 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID) 373 new_pps->alt.state = IB_PORT_PKEY_VALID; 374 } 375 376 new_pps->main.sec = qp->qp_sec; 377 new_pps->alt.sec = qp->qp_sec; 378 return new_pps; 379 } 380 381 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev) 382 { 383 struct ib_qp *real_qp = qp->real_qp; 384 int ret; 385 386 ret = ib_create_qp_security(qp, dev); 387 388 if (ret) 389 return ret; 390 391 mutex_lock(&real_qp->qp_sec->mutex); 392 ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys, 393 qp->qp_sec); 394 395 if (ret) 396 goto ret; 397 398 if (qp != real_qp) 399 list_add(&qp->qp_sec->shared_qp_list, 400 &real_qp->qp_sec->shared_qp_list); 401 ret: 402 mutex_unlock(&real_qp->qp_sec->mutex); 403 if (ret) 404 destroy_qp_security(qp->qp_sec); 405 406 return ret; 407 } 408 409 void ib_close_shared_qp_security(struct ib_qp_security *sec) 410 { 411 struct ib_qp *real_qp = sec->qp->real_qp; 412 413 mutex_lock(&real_qp->qp_sec->mutex); 414 list_del(&sec->shared_qp_list); 415 mutex_unlock(&real_qp->qp_sec->mutex); 416 417 destroy_qp_security(sec); 418 } 419 420 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) 421 { 422 int ret; 423 424 qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL); 425 if (!qp->qp_sec) 426 return -ENOMEM; 427 428 qp->qp_sec->qp = qp; 429 qp->qp_sec->dev = dev; 430 mutex_init(&qp->qp_sec->mutex); 431 INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list); 432 atomic_set(&qp->qp_sec->error_list_count, 0); 433 init_completion(&qp->qp_sec->error_complete); 434 ret = security_ib_alloc_security(&qp->qp_sec->security); 435 if (ret) 436 kfree(qp->qp_sec); 437 438 return ret; 439 } 440 EXPORT_SYMBOL(ib_create_qp_security); 441 442 void ib_destroy_qp_security_begin(struct ib_qp_security *sec) 443 { 444 mutex_lock(&sec->mutex); 445 446 /* Remove the QP from the lists so it won't get added to 447 * a to_error_list during the destroy process. 448 */ 449 if (sec->ports_pkeys) { 450 port_pkey_list_remove(&sec->ports_pkeys->main); 451 port_pkey_list_remove(&sec->ports_pkeys->alt); 452 } 453 454 /* If the QP is already in one or more of those lists 455 * the destroying flag will ensure the to error flow 456 * doesn't operate on an undefined QP. 457 */ 458 sec->destroying = true; 459 460 /* Record the error list count to know how many completions 461 * to wait for. 462 */ 463 sec->error_comps_pending = atomic_read(&sec->error_list_count); 464 465 mutex_unlock(&sec->mutex); 466 } 467 468 void ib_destroy_qp_security_abort(struct ib_qp_security *sec) 469 { 470 int ret; 471 int i; 472 473 /* If a concurrent cache update is in progress this 474 * QP security could be marked for an error state 475 * transition. Wait for this to complete. 476 */ 477 for (i = 0; i < sec->error_comps_pending; i++) 478 wait_for_completion(&sec->error_complete); 479 480 mutex_lock(&sec->mutex); 481 sec->destroying = false; 482 483 /* Restore the position in the lists and verify 484 * access is still allowed in case a cache update 485 * occurred while attempting to destroy. 486 * 487 * Because these setting were listed already 488 * and removed during ib_destroy_qp_security_begin 489 * we know the pkey_index_qp_list for the PKey 490 * already exists so port_pkey_list_insert won't fail. 491 */ 492 if (sec->ports_pkeys) { 493 port_pkey_list_insert(&sec->ports_pkeys->main); 494 port_pkey_list_insert(&sec->ports_pkeys->alt); 495 } 496 497 ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec); 498 if (ret) 499 qp_to_error(sec); 500 501 mutex_unlock(&sec->mutex); 502 } 503 504 void ib_destroy_qp_security_end(struct ib_qp_security *sec) 505 { 506 int i; 507 508 /* If a concurrent cache update is occurring we must 509 * wait until this QP security structure is processed 510 * in the QP to error flow before destroying it because 511 * the to_error_list is in use. 512 */ 513 for (i = 0; i < sec->error_comps_pending; i++) 514 wait_for_completion(&sec->error_complete); 515 516 destroy_qp_security(sec); 517 } 518 519 void ib_security_cache_change(struct ib_device *device, 520 u8 port_num, 521 u64 subnet_prefix) 522 { 523 struct pkey_index_qp_list *pkey; 524 525 list_for_each_entry(pkey, 526 &device->port_pkey_list[port_num].pkey_list, 527 pkey_index_list) { 528 check_pkey_qps(pkey, 529 device, 530 port_num, 531 subnet_prefix); 532 } 533 } 534 535 void ib_security_destroy_port_pkey_list(struct ib_device *device) 536 { 537 struct pkey_index_qp_list *pkey, *tmp_pkey; 538 int i; 539 540 for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) { 541 spin_lock(&device->port_pkey_list[i].list_lock); 542 list_for_each_entry_safe(pkey, 543 tmp_pkey, 544 &device->port_pkey_list[i].pkey_list, 545 pkey_index_list) { 546 list_del(&pkey->pkey_index_list); 547 kfree(pkey); 548 } 549 spin_unlock(&device->port_pkey_list[i].list_lock); 550 } 551 } 552 553 int ib_security_modify_qp(struct ib_qp *qp, 554 struct ib_qp_attr *qp_attr, 555 int qp_attr_mask, 556 struct ib_udata *udata) 557 { 558 int ret = 0; 559 struct ib_ports_pkeys *tmp_pps; 560 struct ib_ports_pkeys *new_pps; 561 bool special_qp = (qp->qp_type == IB_QPT_SMI || 562 qp->qp_type == IB_QPT_GSI || 563 qp->qp_type >= IB_QPT_RESERVED1); 564 bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) || 565 (qp_attr_mask & IB_QP_ALT_PATH)); 566 567 if (pps_change && !special_qp) { 568 mutex_lock(&qp->qp_sec->mutex); 569 new_pps = get_new_pps(qp, 570 qp_attr, 571 qp_attr_mask); 572 573 /* Add this QP to the lists for the new port 574 * and pkey settings before checking for permission 575 * in case there is a concurrent cache update 576 * occurring. Walking the list for a cache change 577 * doesn't acquire the security mutex unless it's 578 * sending the QP to error. 579 */ 580 ret = port_pkey_list_insert(&new_pps->main); 581 582 if (!ret) 583 ret = port_pkey_list_insert(&new_pps->alt); 584 585 if (!ret) 586 ret = check_qp_port_pkey_settings(new_pps, 587 qp->qp_sec); 588 } 589 590 if (!ret) 591 ret = qp->device->modify_qp(qp->real_qp, 592 qp_attr, 593 qp_attr_mask, 594 udata); 595 596 if (pps_change && !special_qp) { 597 /* Clean up the lists and free the appropriate 598 * ports_pkeys structure. 599 */ 600 if (ret) { 601 tmp_pps = new_pps; 602 } else { 603 tmp_pps = qp->qp_sec->ports_pkeys; 604 qp->qp_sec->ports_pkeys = new_pps; 605 } 606 607 if (tmp_pps) { 608 port_pkey_list_remove(&tmp_pps->main); 609 port_pkey_list_remove(&tmp_pps->alt); 610 } 611 kfree(tmp_pps); 612 mutex_unlock(&qp->qp_sec->mutex); 613 } 614 return ret; 615 } 616 EXPORT_SYMBOL(ib_security_modify_qp); 617 618 int ib_security_pkey_access(struct ib_device *dev, 619 u8 port_num, 620 u16 pkey_index, 621 void *sec) 622 { 623 u64 subnet_prefix; 624 u16 pkey; 625 int ret; 626 627 ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey); 628 if (ret) 629 return ret; 630 631 ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix); 632 633 if (ret) 634 return ret; 635 636 return security_ib_pkey_access(sec, subnet_prefix, pkey); 637 } 638 EXPORT_SYMBOL(ib_security_pkey_access); 639 640 static int ib_mad_agent_security_change(struct notifier_block *nb, 641 unsigned long event, 642 void *data) 643 { 644 struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb); 645 646 if (event != LSM_POLICY_CHANGE) 647 return NOTIFY_DONE; 648 649 ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security, 650 ag->device->name, 651 ag->port_num); 652 653 return NOTIFY_OK; 654 } 655 656 int ib_mad_agent_security_setup(struct ib_mad_agent *agent, 657 enum ib_qp_type qp_type) 658 { 659 int ret; 660 661 ret = security_ib_alloc_security(&agent->security); 662 if (ret) 663 return ret; 664 665 if (qp_type != IB_QPT_SMI) 666 return 0; 667 668 ret = security_ib_endport_manage_subnet(agent->security, 669 agent->device->name, 670 agent->port_num); 671 if (ret) 672 return ret; 673 674 agent->lsm_nb.notifier_call = ib_mad_agent_security_change; 675 ret = register_lsm_notifier(&agent->lsm_nb); 676 if (ret) 677 return ret; 678 679 agent->smp_allowed = true; 680 agent->lsm_nb_reg = true; 681 return 0; 682 } 683 684 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent) 685 { 686 security_ib_free_security(agent->security); 687 if (agent->lsm_nb_reg) 688 unregister_lsm_notifier(&agent->lsm_nb); 689 } 690 691 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index) 692 { 693 int ret; 694 695 if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed) 696 return -EACCES; 697 698 ret = ib_security_pkey_access(map->agent.device, 699 map->agent.port_num, 700 pkey_index, 701 map->agent.security); 702 703 if (ret) 704 return ret; 705 706 return 0; 707 } 708 709 #endif /* CONFIG_SECURITY_INFINIBAND */ 710