1 /*
2  * Copyright (c) 2016 Mellanox Technologies Ltd.  All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  */
32 
33 #ifdef CONFIG_SECURITY_INFINIBAND
34 
35 #include <linux/security.h>
36 #include <linux/completion.h>
37 #include <linux/list.h>
38 
39 #include <rdma/ib_verbs.h>
40 #include <rdma/ib_cache.h>
41 #include "core_priv.h"
42 #include "mad_priv.h"
43 
44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp)
45 {
46 	struct pkey_index_qp_list *pkey = NULL;
47 	struct pkey_index_qp_list *tmp_pkey;
48 	struct ib_device *dev = pp->sec->dev;
49 
50 	spin_lock(&dev->port_pkey_list[pp->port_num].list_lock);
51 	list_for_each_entry(tmp_pkey,
52 			    &dev->port_pkey_list[pp->port_num].pkey_list,
53 			    pkey_index_list) {
54 		if (tmp_pkey->pkey_index == pp->pkey_index) {
55 			pkey = tmp_pkey;
56 			break;
57 		}
58 	}
59 	spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock);
60 	return pkey;
61 }
62 
63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
64 				      u16 *pkey,
65 				      u64 *subnet_prefix)
66 {
67 	struct ib_device *dev = pp->sec->dev;
68 	int ret;
69 
70 	ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
71 	if (ret)
72 		return ret;
73 
74 	ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);
75 
76 	return ret;
77 }
78 
79 static int enforce_qp_pkey_security(u16 pkey,
80 				    u64 subnet_prefix,
81 				    struct ib_qp_security *qp_sec)
82 {
83 	struct ib_qp_security *shared_qp_sec;
84 	int ret;
85 
86 	ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
87 	if (ret)
88 		return ret;
89 
90 	list_for_each_entry(shared_qp_sec,
91 			    &qp_sec->shared_qp_list,
92 			    shared_qp_list) {
93 		ret = security_ib_pkey_access(shared_qp_sec->security,
94 					      subnet_prefix,
95 					      pkey);
96 		if (ret)
97 			return ret;
98 	}
99 	return 0;
100 }
101 
102 /* The caller of this function must hold the QP security
103  * mutex of the QP of the security structure in *pps.
104  *
105  * It takes separate ports_pkeys and security structure
106  * because in some cases the pps will be for a new settings
107  * or the pps will be for the real QP and security structure
108  * will be for a shared QP.
109  */
110 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
111 				       struct ib_qp_security *sec)
112 {
113 	u64 subnet_prefix;
114 	u16 pkey;
115 	int ret = 0;
116 
117 	if (!pps)
118 		return 0;
119 
120 	if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
121 		ret = get_pkey_and_subnet_prefix(&pps->main,
122 						 &pkey,
123 						 &subnet_prefix);
124 		if (ret)
125 			return ret;
126 
127 		ret = enforce_qp_pkey_security(pkey,
128 					       subnet_prefix,
129 					       sec);
130 		if (ret)
131 			return ret;
132 	}
133 
134 	if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
135 		ret = get_pkey_and_subnet_prefix(&pps->alt,
136 						 &pkey,
137 						 &subnet_prefix);
138 		if (ret)
139 			return ret;
140 
141 		ret = enforce_qp_pkey_security(pkey,
142 					       subnet_prefix,
143 					       sec);
144 	}
145 
146 	return ret;
147 }
148 
149 /* The caller of this function must hold the QP security
150  * mutex.
151  */
152 static void qp_to_error(struct ib_qp_security *sec)
153 {
154 	struct ib_qp_security *shared_qp_sec;
155 	struct ib_qp_attr attr = {
156 		.qp_state = IB_QPS_ERR
157 	};
158 	struct ib_event event = {
159 		.event = IB_EVENT_QP_FATAL
160 	};
161 
162 	/* If the QP is in the process of being destroyed
163 	 * the qp pointer in the security structure is
164 	 * undefined.  It cannot be modified now.
165 	 */
166 	if (sec->destroying)
167 		return;
168 
169 	ib_modify_qp(sec->qp,
170 		     &attr,
171 		     IB_QP_STATE);
172 
173 	if (sec->qp->event_handler && sec->qp->qp_context) {
174 		event.element.qp = sec->qp;
175 		sec->qp->event_handler(&event,
176 				       sec->qp->qp_context);
177 	}
178 
179 	list_for_each_entry(shared_qp_sec,
180 			    &sec->shared_qp_list,
181 			    shared_qp_list) {
182 		struct ib_qp *qp = shared_qp_sec->qp;
183 
184 		if (qp->event_handler && qp->qp_context) {
185 			event.element.qp = qp;
186 			event.device = qp->device;
187 			qp->event_handler(&event,
188 					  qp->qp_context);
189 		}
190 	}
191 }
192 
193 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
194 				  struct ib_device *device,
195 				  u8 port_num,
196 				  u64 subnet_prefix)
197 {
198 	struct ib_port_pkey *pp, *tmp_pp;
199 	bool comp;
200 	LIST_HEAD(to_error_list);
201 	u16 pkey_val;
202 
203 	if (!ib_get_cached_pkey(device,
204 				port_num,
205 				pkey->pkey_index,
206 				&pkey_val)) {
207 		spin_lock(&pkey->qp_list_lock);
208 		list_for_each_entry(pp, &pkey->qp_list, qp_list) {
209 			if (atomic_read(&pp->sec->error_list_count))
210 				continue;
211 
212 			if (enforce_qp_pkey_security(pkey_val,
213 						     subnet_prefix,
214 						     pp->sec)) {
215 				atomic_inc(&pp->sec->error_list_count);
216 				list_add(&pp->to_error_list,
217 					 &to_error_list);
218 			}
219 		}
220 		spin_unlock(&pkey->qp_list_lock);
221 	}
222 
223 	list_for_each_entry_safe(pp,
224 				 tmp_pp,
225 				 &to_error_list,
226 				 to_error_list) {
227 		mutex_lock(&pp->sec->mutex);
228 		qp_to_error(pp->sec);
229 		list_del(&pp->to_error_list);
230 		atomic_dec(&pp->sec->error_list_count);
231 		comp = pp->sec->destroying;
232 		mutex_unlock(&pp->sec->mutex);
233 
234 		if (comp)
235 			complete(&pp->sec->error_complete);
236 	}
237 }
238 
239 /* The caller of this function must hold the QP security
240  * mutex.
241  */
242 static int port_pkey_list_insert(struct ib_port_pkey *pp)
243 {
244 	struct pkey_index_qp_list *tmp_pkey;
245 	struct pkey_index_qp_list *pkey;
246 	struct ib_device *dev;
247 	u8 port_num = pp->port_num;
248 	int ret = 0;
249 
250 	if (pp->state != IB_PORT_PKEY_VALID)
251 		return 0;
252 
253 	dev = pp->sec->dev;
254 
255 	pkey = get_pkey_idx_qp_list(pp);
256 
257 	if (!pkey) {
258 		bool found = false;
259 
260 		pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
261 		if (!pkey)
262 			return -ENOMEM;
263 
264 		spin_lock(&dev->port_pkey_list[port_num].list_lock);
265 		/* Check for the PKey again.  A racing process may
266 		 * have created it.
267 		 */
268 		list_for_each_entry(tmp_pkey,
269 				    &dev->port_pkey_list[port_num].pkey_list,
270 				    pkey_index_list) {
271 			if (tmp_pkey->pkey_index == pp->pkey_index) {
272 				kfree(pkey);
273 				pkey = tmp_pkey;
274 				found = true;
275 				break;
276 			}
277 		}
278 
279 		if (!found) {
280 			pkey->pkey_index = pp->pkey_index;
281 			spin_lock_init(&pkey->qp_list_lock);
282 			INIT_LIST_HEAD(&pkey->qp_list);
283 			list_add(&pkey->pkey_index_list,
284 				 &dev->port_pkey_list[port_num].pkey_list);
285 		}
286 		spin_unlock(&dev->port_pkey_list[port_num].list_lock);
287 	}
288 
289 	spin_lock(&pkey->qp_list_lock);
290 	list_add(&pp->qp_list, &pkey->qp_list);
291 	spin_unlock(&pkey->qp_list_lock);
292 
293 	pp->state = IB_PORT_PKEY_LISTED;
294 
295 	return ret;
296 }
297 
298 /* The caller of this function must hold the QP security
299  * mutex.
300  */
301 static void port_pkey_list_remove(struct ib_port_pkey *pp)
302 {
303 	struct pkey_index_qp_list *pkey;
304 
305 	if (pp->state != IB_PORT_PKEY_LISTED)
306 		return;
307 
308 	pkey = get_pkey_idx_qp_list(pp);
309 
310 	spin_lock(&pkey->qp_list_lock);
311 	list_del(&pp->qp_list);
312 	spin_unlock(&pkey->qp_list_lock);
313 
314 	/* The setting may still be valid, i.e. after
315 	 * a destroy has failed for example.
316 	 */
317 	pp->state = IB_PORT_PKEY_VALID;
318 }
319 
320 static void destroy_qp_security(struct ib_qp_security *sec)
321 {
322 	security_ib_free_security(sec->security);
323 	kfree(sec->ports_pkeys);
324 	kfree(sec);
325 }
326 
327 /* The caller of this function must hold the QP security
328  * mutex.
329  */
330 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
331 					  const struct ib_qp_attr *qp_attr,
332 					  int qp_attr_mask)
333 {
334 	struct ib_ports_pkeys *new_pps;
335 	struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;
336 
337 	new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
338 	if (!new_pps)
339 		return NULL;
340 
341 	if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) {
342 		if (!qp_pps) {
343 			new_pps->main.port_num = qp_attr->port_num;
344 			new_pps->main.pkey_index = qp_attr->pkey_index;
345 		} else {
346 			new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ?
347 						  qp_attr->port_num :
348 						  qp_pps->main.port_num;
349 
350 			new_pps->main.pkey_index =
351 					(qp_attr_mask & IB_QP_PKEY_INDEX) ?
352 					 qp_attr->pkey_index :
353 					 qp_pps->main.pkey_index;
354 		}
355 		new_pps->main.state = IB_PORT_PKEY_VALID;
356 	} else if (qp_pps) {
357 		new_pps->main.port_num = qp_pps->main.port_num;
358 		new_pps->main.pkey_index = qp_pps->main.pkey_index;
359 		if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
360 			new_pps->main.state = IB_PORT_PKEY_VALID;
361 	}
362 
363 	if (qp_attr_mask & IB_QP_ALT_PATH) {
364 		new_pps->alt.port_num = qp_attr->alt_port_num;
365 		new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
366 		new_pps->alt.state = IB_PORT_PKEY_VALID;
367 	} else if (qp_pps) {
368 		new_pps->alt.port_num = qp_pps->alt.port_num;
369 		new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
370 		if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
371 			new_pps->alt.state = IB_PORT_PKEY_VALID;
372 	}
373 
374 	new_pps->main.sec = qp->qp_sec;
375 	new_pps->alt.sec = qp->qp_sec;
376 	return new_pps;
377 }
378 
379 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
380 {
381 	struct ib_qp *real_qp = qp->real_qp;
382 	int ret;
383 
384 	ret = ib_create_qp_security(qp, dev);
385 
386 	if (ret)
387 		return ret;
388 
389 	if (!qp->qp_sec)
390 		return 0;
391 
392 	mutex_lock(&real_qp->qp_sec->mutex);
393 	ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
394 					  qp->qp_sec);
395 
396 	if (ret)
397 		goto ret;
398 
399 	if (qp != real_qp)
400 		list_add(&qp->qp_sec->shared_qp_list,
401 			 &real_qp->qp_sec->shared_qp_list);
402 ret:
403 	mutex_unlock(&real_qp->qp_sec->mutex);
404 	if (ret)
405 		destroy_qp_security(qp->qp_sec);
406 
407 	return ret;
408 }
409 
410 void ib_close_shared_qp_security(struct ib_qp_security *sec)
411 {
412 	struct ib_qp *real_qp = sec->qp->real_qp;
413 
414 	mutex_lock(&real_qp->qp_sec->mutex);
415 	list_del(&sec->shared_qp_list);
416 	mutex_unlock(&real_qp->qp_sec->mutex);
417 
418 	destroy_qp_security(sec);
419 }
420 
421 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
422 {
423 	u8 i = rdma_start_port(dev);
424 	bool is_ib = false;
425 	int ret;
426 
427 	while (i <= rdma_end_port(dev) && !is_ib)
428 		is_ib = rdma_protocol_ib(dev, i++);
429 
430 	/* If this isn't an IB device don't create the security context */
431 	if (!is_ib)
432 		return 0;
433 
434 	qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
435 	if (!qp->qp_sec)
436 		return -ENOMEM;
437 
438 	qp->qp_sec->qp = qp;
439 	qp->qp_sec->dev = dev;
440 	mutex_init(&qp->qp_sec->mutex);
441 	INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
442 	atomic_set(&qp->qp_sec->error_list_count, 0);
443 	init_completion(&qp->qp_sec->error_complete);
444 	ret = security_ib_alloc_security(&qp->qp_sec->security);
445 	if (ret) {
446 		kfree(qp->qp_sec);
447 		qp->qp_sec = NULL;
448 	}
449 
450 	return ret;
451 }
452 EXPORT_SYMBOL(ib_create_qp_security);
453 
454 void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
455 {
456 	/* Return if not IB */
457 	if (!sec)
458 		return;
459 
460 	mutex_lock(&sec->mutex);
461 
462 	/* Remove the QP from the lists so it won't get added to
463 	 * a to_error_list during the destroy process.
464 	 */
465 	if (sec->ports_pkeys) {
466 		port_pkey_list_remove(&sec->ports_pkeys->main);
467 		port_pkey_list_remove(&sec->ports_pkeys->alt);
468 	}
469 
470 	/* If the QP is already in one or more of those lists
471 	 * the destroying flag will ensure the to error flow
472 	 * doesn't operate on an undefined QP.
473 	 */
474 	sec->destroying = true;
475 
476 	/* Record the error list count to know how many completions
477 	 * to wait for.
478 	 */
479 	sec->error_comps_pending = atomic_read(&sec->error_list_count);
480 
481 	mutex_unlock(&sec->mutex);
482 }
483 
484 void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
485 {
486 	int ret;
487 	int i;
488 
489 	/* Return if not IB */
490 	if (!sec)
491 		return;
492 
493 	/* If a concurrent cache update is in progress this
494 	 * QP security could be marked for an error state
495 	 * transition.  Wait for this to complete.
496 	 */
497 	for (i = 0; i < sec->error_comps_pending; i++)
498 		wait_for_completion(&sec->error_complete);
499 
500 	mutex_lock(&sec->mutex);
501 	sec->destroying = false;
502 
503 	/* Restore the position in the lists and verify
504 	 * access is still allowed in case a cache update
505 	 * occurred while attempting to destroy.
506 	 *
507 	 * Because these setting were listed already
508 	 * and removed during ib_destroy_qp_security_begin
509 	 * we know the pkey_index_qp_list for the PKey
510 	 * already exists so port_pkey_list_insert won't fail.
511 	 */
512 	if (sec->ports_pkeys) {
513 		port_pkey_list_insert(&sec->ports_pkeys->main);
514 		port_pkey_list_insert(&sec->ports_pkeys->alt);
515 	}
516 
517 	ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
518 	if (ret)
519 		qp_to_error(sec);
520 
521 	mutex_unlock(&sec->mutex);
522 }
523 
524 void ib_destroy_qp_security_end(struct ib_qp_security *sec)
525 {
526 	int i;
527 
528 	/* Return if not IB */
529 	if (!sec)
530 		return;
531 
532 	/* If a concurrent cache update is occurring we must
533 	 * wait until this QP security structure is processed
534 	 * in the QP to error flow before destroying it because
535 	 * the to_error_list is in use.
536 	 */
537 	for (i = 0; i < sec->error_comps_pending; i++)
538 		wait_for_completion(&sec->error_complete);
539 
540 	destroy_qp_security(sec);
541 }
542 
543 void ib_security_cache_change(struct ib_device *device,
544 			      u8 port_num,
545 			      u64 subnet_prefix)
546 {
547 	struct pkey_index_qp_list *pkey;
548 
549 	list_for_each_entry(pkey,
550 			    &device->port_pkey_list[port_num].pkey_list,
551 			    pkey_index_list) {
552 		check_pkey_qps(pkey,
553 			       device,
554 			       port_num,
555 			       subnet_prefix);
556 	}
557 }
558 
559 void ib_security_destroy_port_pkey_list(struct ib_device *device)
560 {
561 	struct pkey_index_qp_list *pkey, *tmp_pkey;
562 	int i;
563 
564 	for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
565 		spin_lock(&device->port_pkey_list[i].list_lock);
566 		list_for_each_entry_safe(pkey,
567 					 tmp_pkey,
568 					 &device->port_pkey_list[i].pkey_list,
569 					 pkey_index_list) {
570 			list_del(&pkey->pkey_index_list);
571 			kfree(pkey);
572 		}
573 		spin_unlock(&device->port_pkey_list[i].list_lock);
574 	}
575 }
576 
577 int ib_security_modify_qp(struct ib_qp *qp,
578 			  struct ib_qp_attr *qp_attr,
579 			  int qp_attr_mask,
580 			  struct ib_udata *udata)
581 {
582 	int ret = 0;
583 	struct ib_ports_pkeys *tmp_pps;
584 	struct ib_ports_pkeys *new_pps = NULL;
585 	struct ib_qp *real_qp = qp->real_qp;
586 	bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
587 			   real_qp->qp_type == IB_QPT_GSI ||
588 			   real_qp->qp_type >= IB_QPT_RESERVED1);
589 	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
590 			   (qp_attr_mask & IB_QP_ALT_PATH));
591 
592 	WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
593 		   rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
594 		   !real_qp->qp_sec),
595 		   "%s: QP security is not initialized for IB QP: %d\n",
596 		   __func__, real_qp->qp_num);
597 
598 	/* The port/pkey settings are maintained only for the real QP. Open
599 	 * handles on the real QP will be in the shared_qp_list. When
600 	 * enforcing security on the real QP all the shared QPs will be
601 	 * checked as well.
602 	 */
603 
604 	if (pps_change && !special_qp && real_qp->qp_sec) {
605 		mutex_lock(&real_qp->qp_sec->mutex);
606 		new_pps = get_new_pps(real_qp,
607 				      qp_attr,
608 				      qp_attr_mask);
609 		if (!new_pps) {
610 			mutex_unlock(&real_qp->qp_sec->mutex);
611 			return -ENOMEM;
612 		}
613 		/* Add this QP to the lists for the new port
614 		 * and pkey settings before checking for permission
615 		 * in case there is a concurrent cache update
616 		 * occurring.  Walking the list for a cache change
617 		 * doesn't acquire the security mutex unless it's
618 		 * sending the QP to error.
619 		 */
620 		ret = port_pkey_list_insert(&new_pps->main);
621 
622 		if (!ret)
623 			ret = port_pkey_list_insert(&new_pps->alt);
624 
625 		if (!ret)
626 			ret = check_qp_port_pkey_settings(new_pps,
627 							  real_qp->qp_sec);
628 	}
629 
630 	if (!ret)
631 		ret = real_qp->device->modify_qp(real_qp,
632 						 qp_attr,
633 						 qp_attr_mask,
634 						 udata);
635 
636 	if (new_pps) {
637 		/* Clean up the lists and free the appropriate
638 		 * ports_pkeys structure.
639 		 */
640 		if (ret) {
641 			tmp_pps = new_pps;
642 		} else {
643 			tmp_pps = real_qp->qp_sec->ports_pkeys;
644 			real_qp->qp_sec->ports_pkeys = new_pps;
645 		}
646 
647 		if (tmp_pps) {
648 			port_pkey_list_remove(&tmp_pps->main);
649 			port_pkey_list_remove(&tmp_pps->alt);
650 		}
651 		kfree(tmp_pps);
652 		mutex_unlock(&real_qp->qp_sec->mutex);
653 	}
654 	return ret;
655 }
656 
657 static int ib_security_pkey_access(struct ib_device *dev,
658 				   u8 port_num,
659 				   u16 pkey_index,
660 				   void *sec)
661 {
662 	u64 subnet_prefix;
663 	u16 pkey;
664 	int ret;
665 
666 	if (!rdma_protocol_ib(dev, port_num))
667 		return 0;
668 
669 	ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
670 	if (ret)
671 		return ret;
672 
673 	ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);
674 
675 	if (ret)
676 		return ret;
677 
678 	return security_ib_pkey_access(sec, subnet_prefix, pkey);
679 }
680 
681 static int ib_mad_agent_security_change(struct notifier_block *nb,
682 					unsigned long event,
683 					void *data)
684 {
685 	struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb);
686 
687 	if (event != LSM_POLICY_CHANGE)
688 		return NOTIFY_DONE;
689 
690 	ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security,
691 							     ag->device->name,
692 							     ag->port_num);
693 
694 	return NOTIFY_OK;
695 }
696 
697 int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
698 				enum ib_qp_type qp_type)
699 {
700 	int ret;
701 
702 	if (!rdma_protocol_ib(agent->device, agent->port_num))
703 		return 0;
704 
705 	ret = security_ib_alloc_security(&agent->security);
706 	if (ret)
707 		return ret;
708 
709 	if (qp_type != IB_QPT_SMI)
710 		return 0;
711 
712 	ret = security_ib_endport_manage_subnet(agent->security,
713 						agent->device->name,
714 						agent->port_num);
715 	if (ret)
716 		return ret;
717 
718 	agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
719 	ret = register_lsm_notifier(&agent->lsm_nb);
720 	if (ret)
721 		return ret;
722 
723 	agent->smp_allowed = true;
724 	agent->lsm_nb_reg = true;
725 	return 0;
726 }
727 
728 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
729 {
730 	if (!rdma_protocol_ib(agent->device, agent->port_num))
731 		return;
732 
733 	security_ib_free_security(agent->security);
734 	if (agent->lsm_nb_reg)
735 		unregister_lsm_notifier(&agent->lsm_nb);
736 }
737 
738 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
739 {
740 	if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
741 		return 0;
742 
743 	if (map->agent.qp->qp_type == IB_QPT_SMI) {
744 		if (!map->agent.smp_allowed)
745 			return -EACCES;
746 		return 0;
747 	}
748 
749 	return ib_security_pkey_access(map->agent.device,
750 				       map->agent.port_num,
751 				       pkey_index,
752 				       map->agent.security);
753 }
754 
755 #endif /* CONFIG_SECURITY_INFINIBAND */
756