1 /* 2 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 */ 32 33 #ifdef CONFIG_SECURITY_INFINIBAND 34 35 #include <linux/security.h> 36 #include <linux/completion.h> 37 #include <linux/list.h> 38 39 #include <rdma/ib_verbs.h> 40 #include <rdma/ib_cache.h> 41 #include "core_priv.h" 42 #include "mad_priv.h" 43 44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp) 45 { 46 struct pkey_index_qp_list *pkey = NULL; 47 struct pkey_index_qp_list *tmp_pkey; 48 struct ib_device *dev = pp->sec->dev; 49 50 spin_lock(&dev->port_pkey_list[pp->port_num].list_lock); 51 list_for_each_entry(tmp_pkey, 52 &dev->port_pkey_list[pp->port_num].pkey_list, 53 pkey_index_list) { 54 if (tmp_pkey->pkey_index == pp->pkey_index) { 55 pkey = tmp_pkey; 56 break; 57 } 58 } 59 spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock); 60 return pkey; 61 } 62 63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp, 64 u16 *pkey, 65 u64 *subnet_prefix) 66 { 67 struct ib_device *dev = pp->sec->dev; 68 int ret; 69 70 ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey); 71 if (ret) 72 return ret; 73 74 ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix); 75 76 return ret; 77 } 78 79 static int enforce_qp_pkey_security(u16 pkey, 80 u64 subnet_prefix, 81 struct ib_qp_security *qp_sec) 82 { 83 struct ib_qp_security *shared_qp_sec; 84 int ret; 85 86 ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey); 87 if (ret) 88 return ret; 89 90 if (qp_sec->qp == qp_sec->qp->real_qp) { 91 list_for_each_entry(shared_qp_sec, 92 &qp_sec->shared_qp_list, 93 shared_qp_list) { 94 ret = security_ib_pkey_access(shared_qp_sec->security, 95 subnet_prefix, 96 pkey); 97 if (ret) 98 return ret; 99 } 100 } 101 return 0; 102 } 103 104 /* The caller of this function must hold the QP security 105 * mutex of the QP of the security structure in *pps. 106 * 107 * It takes separate ports_pkeys and security structure 108 * because in some cases the pps will be for a new settings 109 * or the pps will be for the real QP and security structure 110 * will be for a shared QP. 111 */ 112 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps, 113 struct ib_qp_security *sec) 114 { 115 u64 subnet_prefix; 116 u16 pkey; 117 int ret = 0; 118 119 if (!pps) 120 return 0; 121 122 if (pps->main.state != IB_PORT_PKEY_NOT_VALID) { 123 ret = get_pkey_and_subnet_prefix(&pps->main, 124 &pkey, 125 &subnet_prefix); 126 if (ret) 127 return ret; 128 129 ret = enforce_qp_pkey_security(pkey, 130 subnet_prefix, 131 sec); 132 if (ret) 133 return ret; 134 } 135 136 if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) { 137 ret = get_pkey_and_subnet_prefix(&pps->alt, 138 &pkey, 139 &subnet_prefix); 140 if (ret) 141 return ret; 142 143 ret = enforce_qp_pkey_security(pkey, 144 subnet_prefix, 145 sec); 146 } 147 148 return ret; 149 } 150 151 /* The caller of this function must hold the QP security 152 * mutex. 153 */ 154 static void qp_to_error(struct ib_qp_security *sec) 155 { 156 struct ib_qp_security *shared_qp_sec; 157 struct ib_qp_attr attr = { 158 .qp_state = IB_QPS_ERR 159 }; 160 struct ib_event event = { 161 .event = IB_EVENT_QP_FATAL 162 }; 163 164 /* If the QP is in the process of being destroyed 165 * the qp pointer in the security structure is 166 * undefined. It cannot be modified now. 167 */ 168 if (sec->destroying) 169 return; 170 171 ib_modify_qp(sec->qp, 172 &attr, 173 IB_QP_STATE); 174 175 if (sec->qp->event_handler && sec->qp->qp_context) { 176 event.element.qp = sec->qp; 177 sec->qp->event_handler(&event, 178 sec->qp->qp_context); 179 } 180 181 list_for_each_entry(shared_qp_sec, 182 &sec->shared_qp_list, 183 shared_qp_list) { 184 struct ib_qp *qp = shared_qp_sec->qp; 185 186 if (qp->event_handler && qp->qp_context) { 187 event.element.qp = qp; 188 event.device = qp->device; 189 qp->event_handler(&event, 190 qp->qp_context); 191 } 192 } 193 } 194 195 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey, 196 struct ib_device *device, 197 u8 port_num, 198 u64 subnet_prefix) 199 { 200 struct ib_port_pkey *pp, *tmp_pp; 201 bool comp; 202 LIST_HEAD(to_error_list); 203 u16 pkey_val; 204 205 if (!ib_get_cached_pkey(device, 206 port_num, 207 pkey->pkey_index, 208 &pkey_val)) { 209 spin_lock(&pkey->qp_list_lock); 210 list_for_each_entry(pp, &pkey->qp_list, qp_list) { 211 if (atomic_read(&pp->sec->error_list_count)) 212 continue; 213 214 if (enforce_qp_pkey_security(pkey_val, 215 subnet_prefix, 216 pp->sec)) { 217 atomic_inc(&pp->sec->error_list_count); 218 list_add(&pp->to_error_list, 219 &to_error_list); 220 } 221 } 222 spin_unlock(&pkey->qp_list_lock); 223 } 224 225 list_for_each_entry_safe(pp, 226 tmp_pp, 227 &to_error_list, 228 to_error_list) { 229 mutex_lock(&pp->sec->mutex); 230 qp_to_error(pp->sec); 231 list_del(&pp->to_error_list); 232 atomic_dec(&pp->sec->error_list_count); 233 comp = pp->sec->destroying; 234 mutex_unlock(&pp->sec->mutex); 235 236 if (comp) 237 complete(&pp->sec->error_complete); 238 } 239 } 240 241 /* The caller of this function must hold the QP security 242 * mutex. 243 */ 244 static int port_pkey_list_insert(struct ib_port_pkey *pp) 245 { 246 struct pkey_index_qp_list *tmp_pkey; 247 struct pkey_index_qp_list *pkey; 248 struct ib_device *dev; 249 u8 port_num = pp->port_num; 250 int ret = 0; 251 252 if (pp->state != IB_PORT_PKEY_VALID) 253 return 0; 254 255 dev = pp->sec->dev; 256 257 pkey = get_pkey_idx_qp_list(pp); 258 259 if (!pkey) { 260 bool found = false; 261 262 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL); 263 if (!pkey) 264 return -ENOMEM; 265 266 spin_lock(&dev->port_pkey_list[port_num].list_lock); 267 /* Check for the PKey again. A racing process may 268 * have created it. 269 */ 270 list_for_each_entry(tmp_pkey, 271 &dev->port_pkey_list[port_num].pkey_list, 272 pkey_index_list) { 273 if (tmp_pkey->pkey_index == pp->pkey_index) { 274 kfree(pkey); 275 pkey = tmp_pkey; 276 found = true; 277 break; 278 } 279 } 280 281 if (!found) { 282 pkey->pkey_index = pp->pkey_index; 283 spin_lock_init(&pkey->qp_list_lock); 284 INIT_LIST_HEAD(&pkey->qp_list); 285 list_add(&pkey->pkey_index_list, 286 &dev->port_pkey_list[port_num].pkey_list); 287 } 288 spin_unlock(&dev->port_pkey_list[port_num].list_lock); 289 } 290 291 spin_lock(&pkey->qp_list_lock); 292 list_add(&pp->qp_list, &pkey->qp_list); 293 spin_unlock(&pkey->qp_list_lock); 294 295 pp->state = IB_PORT_PKEY_LISTED; 296 297 return ret; 298 } 299 300 /* The caller of this function must hold the QP security 301 * mutex. 302 */ 303 static void port_pkey_list_remove(struct ib_port_pkey *pp) 304 { 305 struct pkey_index_qp_list *pkey; 306 307 if (pp->state != IB_PORT_PKEY_LISTED) 308 return; 309 310 pkey = get_pkey_idx_qp_list(pp); 311 312 spin_lock(&pkey->qp_list_lock); 313 list_del(&pp->qp_list); 314 spin_unlock(&pkey->qp_list_lock); 315 316 /* The setting may still be valid, i.e. after 317 * a destroy has failed for example. 318 */ 319 pp->state = IB_PORT_PKEY_VALID; 320 } 321 322 static void destroy_qp_security(struct ib_qp_security *sec) 323 { 324 security_ib_free_security(sec->security); 325 kfree(sec->ports_pkeys); 326 kfree(sec); 327 } 328 329 /* The caller of this function must hold the QP security 330 * mutex. 331 */ 332 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, 333 const struct ib_qp_attr *qp_attr, 334 int qp_attr_mask) 335 { 336 struct ib_ports_pkeys *new_pps; 337 struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys; 338 339 new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL); 340 if (!new_pps) 341 return NULL; 342 343 if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) { 344 if (!qp_pps) { 345 new_pps->main.port_num = qp_attr->port_num; 346 new_pps->main.pkey_index = qp_attr->pkey_index; 347 } else { 348 new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ? 349 qp_attr->port_num : 350 qp_pps->main.port_num; 351 352 new_pps->main.pkey_index = 353 (qp_attr_mask & IB_QP_PKEY_INDEX) ? 354 qp_attr->pkey_index : 355 qp_pps->main.pkey_index; 356 } 357 new_pps->main.state = IB_PORT_PKEY_VALID; 358 } else if (qp_pps) { 359 new_pps->main.port_num = qp_pps->main.port_num; 360 new_pps->main.pkey_index = qp_pps->main.pkey_index; 361 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) 362 new_pps->main.state = IB_PORT_PKEY_VALID; 363 } 364 365 if (qp_attr_mask & IB_QP_ALT_PATH) { 366 new_pps->alt.port_num = qp_attr->alt_port_num; 367 new_pps->alt.pkey_index = qp_attr->alt_pkey_index; 368 new_pps->alt.state = IB_PORT_PKEY_VALID; 369 } else if (qp_pps) { 370 new_pps->alt.port_num = qp_pps->alt.port_num; 371 new_pps->alt.pkey_index = qp_pps->alt.pkey_index; 372 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID) 373 new_pps->alt.state = IB_PORT_PKEY_VALID; 374 } 375 376 new_pps->main.sec = qp->qp_sec; 377 new_pps->alt.sec = qp->qp_sec; 378 return new_pps; 379 } 380 381 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev) 382 { 383 struct ib_qp *real_qp = qp->real_qp; 384 int ret; 385 386 ret = ib_create_qp_security(qp, dev); 387 388 if (ret) 389 return ret; 390 391 mutex_lock(&real_qp->qp_sec->mutex); 392 ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys, 393 qp->qp_sec); 394 395 if (ret) 396 goto ret; 397 398 if (qp != real_qp) 399 list_add(&qp->qp_sec->shared_qp_list, 400 &real_qp->qp_sec->shared_qp_list); 401 ret: 402 mutex_unlock(&real_qp->qp_sec->mutex); 403 if (ret) 404 destroy_qp_security(qp->qp_sec); 405 406 return ret; 407 } 408 409 void ib_close_shared_qp_security(struct ib_qp_security *sec) 410 { 411 struct ib_qp *real_qp = sec->qp->real_qp; 412 413 mutex_lock(&real_qp->qp_sec->mutex); 414 list_del(&sec->shared_qp_list); 415 mutex_unlock(&real_qp->qp_sec->mutex); 416 417 destroy_qp_security(sec); 418 } 419 420 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) 421 { 422 int ret; 423 424 qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL); 425 if (!qp->qp_sec) 426 return -ENOMEM; 427 428 qp->qp_sec->qp = qp; 429 qp->qp_sec->dev = dev; 430 mutex_init(&qp->qp_sec->mutex); 431 INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list); 432 atomic_set(&qp->qp_sec->error_list_count, 0); 433 init_completion(&qp->qp_sec->error_complete); 434 ret = security_ib_alloc_security(&qp->qp_sec->security); 435 if (ret) { 436 kfree(qp->qp_sec); 437 qp->qp_sec = NULL; 438 } 439 440 return ret; 441 } 442 EXPORT_SYMBOL(ib_create_qp_security); 443 444 void ib_destroy_qp_security_begin(struct ib_qp_security *sec) 445 { 446 mutex_lock(&sec->mutex); 447 448 /* Remove the QP from the lists so it won't get added to 449 * a to_error_list during the destroy process. 450 */ 451 if (sec->ports_pkeys) { 452 port_pkey_list_remove(&sec->ports_pkeys->main); 453 port_pkey_list_remove(&sec->ports_pkeys->alt); 454 } 455 456 /* If the QP is already in one or more of those lists 457 * the destroying flag will ensure the to error flow 458 * doesn't operate on an undefined QP. 459 */ 460 sec->destroying = true; 461 462 /* Record the error list count to know how many completions 463 * to wait for. 464 */ 465 sec->error_comps_pending = atomic_read(&sec->error_list_count); 466 467 mutex_unlock(&sec->mutex); 468 } 469 470 void ib_destroy_qp_security_abort(struct ib_qp_security *sec) 471 { 472 int ret; 473 int i; 474 475 /* If a concurrent cache update is in progress this 476 * QP security could be marked for an error state 477 * transition. Wait for this to complete. 478 */ 479 for (i = 0; i < sec->error_comps_pending; i++) 480 wait_for_completion(&sec->error_complete); 481 482 mutex_lock(&sec->mutex); 483 sec->destroying = false; 484 485 /* Restore the position in the lists and verify 486 * access is still allowed in case a cache update 487 * occurred while attempting to destroy. 488 * 489 * Because these setting were listed already 490 * and removed during ib_destroy_qp_security_begin 491 * we know the pkey_index_qp_list for the PKey 492 * already exists so port_pkey_list_insert won't fail. 493 */ 494 if (sec->ports_pkeys) { 495 port_pkey_list_insert(&sec->ports_pkeys->main); 496 port_pkey_list_insert(&sec->ports_pkeys->alt); 497 } 498 499 ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec); 500 if (ret) 501 qp_to_error(sec); 502 503 mutex_unlock(&sec->mutex); 504 } 505 506 void ib_destroy_qp_security_end(struct ib_qp_security *sec) 507 { 508 int i; 509 510 /* If a concurrent cache update is occurring we must 511 * wait until this QP security structure is processed 512 * in the QP to error flow before destroying it because 513 * the to_error_list is in use. 514 */ 515 for (i = 0; i < sec->error_comps_pending; i++) 516 wait_for_completion(&sec->error_complete); 517 518 destroy_qp_security(sec); 519 } 520 521 void ib_security_cache_change(struct ib_device *device, 522 u8 port_num, 523 u64 subnet_prefix) 524 { 525 struct pkey_index_qp_list *pkey; 526 527 list_for_each_entry(pkey, 528 &device->port_pkey_list[port_num].pkey_list, 529 pkey_index_list) { 530 check_pkey_qps(pkey, 531 device, 532 port_num, 533 subnet_prefix); 534 } 535 } 536 537 void ib_security_destroy_port_pkey_list(struct ib_device *device) 538 { 539 struct pkey_index_qp_list *pkey, *tmp_pkey; 540 int i; 541 542 for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) { 543 spin_lock(&device->port_pkey_list[i].list_lock); 544 list_for_each_entry_safe(pkey, 545 tmp_pkey, 546 &device->port_pkey_list[i].pkey_list, 547 pkey_index_list) { 548 list_del(&pkey->pkey_index_list); 549 kfree(pkey); 550 } 551 spin_unlock(&device->port_pkey_list[i].list_lock); 552 } 553 } 554 555 int ib_security_modify_qp(struct ib_qp *qp, 556 struct ib_qp_attr *qp_attr, 557 int qp_attr_mask, 558 struct ib_udata *udata) 559 { 560 int ret = 0; 561 struct ib_ports_pkeys *tmp_pps; 562 struct ib_ports_pkeys *new_pps; 563 bool special_qp = (qp->qp_type == IB_QPT_SMI || 564 qp->qp_type == IB_QPT_GSI || 565 qp->qp_type >= IB_QPT_RESERVED1); 566 bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) || 567 (qp_attr_mask & IB_QP_ALT_PATH)); 568 569 if (pps_change && !special_qp) { 570 mutex_lock(&qp->qp_sec->mutex); 571 new_pps = get_new_pps(qp, 572 qp_attr, 573 qp_attr_mask); 574 575 /* Add this QP to the lists for the new port 576 * and pkey settings before checking for permission 577 * in case there is a concurrent cache update 578 * occurring. Walking the list for a cache change 579 * doesn't acquire the security mutex unless it's 580 * sending the QP to error. 581 */ 582 ret = port_pkey_list_insert(&new_pps->main); 583 584 if (!ret) 585 ret = port_pkey_list_insert(&new_pps->alt); 586 587 if (!ret) 588 ret = check_qp_port_pkey_settings(new_pps, 589 qp->qp_sec); 590 } 591 592 if (!ret) 593 ret = qp->device->modify_qp(qp->real_qp, 594 qp_attr, 595 qp_attr_mask, 596 udata); 597 598 if (pps_change && !special_qp) { 599 /* Clean up the lists and free the appropriate 600 * ports_pkeys structure. 601 */ 602 if (ret) { 603 tmp_pps = new_pps; 604 } else { 605 tmp_pps = qp->qp_sec->ports_pkeys; 606 qp->qp_sec->ports_pkeys = new_pps; 607 } 608 609 if (tmp_pps) { 610 port_pkey_list_remove(&tmp_pps->main); 611 port_pkey_list_remove(&tmp_pps->alt); 612 } 613 kfree(tmp_pps); 614 mutex_unlock(&qp->qp_sec->mutex); 615 } 616 return ret; 617 } 618 EXPORT_SYMBOL(ib_security_modify_qp); 619 620 int ib_security_pkey_access(struct ib_device *dev, 621 u8 port_num, 622 u16 pkey_index, 623 void *sec) 624 { 625 u64 subnet_prefix; 626 u16 pkey; 627 int ret; 628 629 ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey); 630 if (ret) 631 return ret; 632 633 ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix); 634 635 if (ret) 636 return ret; 637 638 return security_ib_pkey_access(sec, subnet_prefix, pkey); 639 } 640 EXPORT_SYMBOL(ib_security_pkey_access); 641 642 static int ib_mad_agent_security_change(struct notifier_block *nb, 643 unsigned long event, 644 void *data) 645 { 646 struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb); 647 648 if (event != LSM_POLICY_CHANGE) 649 return NOTIFY_DONE; 650 651 ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security, 652 ag->device->name, 653 ag->port_num); 654 655 return NOTIFY_OK; 656 } 657 658 int ib_mad_agent_security_setup(struct ib_mad_agent *agent, 659 enum ib_qp_type qp_type) 660 { 661 int ret; 662 663 ret = security_ib_alloc_security(&agent->security); 664 if (ret) 665 return ret; 666 667 if (qp_type != IB_QPT_SMI) 668 return 0; 669 670 ret = security_ib_endport_manage_subnet(agent->security, 671 agent->device->name, 672 agent->port_num); 673 if (ret) 674 return ret; 675 676 agent->lsm_nb.notifier_call = ib_mad_agent_security_change; 677 ret = register_lsm_notifier(&agent->lsm_nb); 678 if (ret) 679 return ret; 680 681 agent->smp_allowed = true; 682 agent->lsm_nb_reg = true; 683 return 0; 684 } 685 686 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent) 687 { 688 security_ib_free_security(agent->security); 689 if (agent->lsm_nb_reg) 690 unregister_lsm_notifier(&agent->lsm_nb); 691 } 692 693 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index) 694 { 695 int ret; 696 697 if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed) 698 return -EACCES; 699 700 ret = ib_security_pkey_access(map->agent.device, 701 map->agent.port_num, 702 pkey_index, 703 map->agent.security); 704 705 if (ret) 706 return ret; 707 708 return 0; 709 } 710 711 #endif /* CONFIG_SECURITY_INFINIBAND */ 712