1 /* 2 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 */ 32 33 #ifdef CONFIG_SECURITY_INFINIBAND 34 35 #include <linux/security.h> 36 #include <linux/completion.h> 37 #include <linux/list.h> 38 39 #include <rdma/ib_verbs.h> 40 #include <rdma/ib_cache.h> 41 #include "core_priv.h" 42 #include "mad_priv.h" 43 44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp) 45 { 46 struct pkey_index_qp_list *pkey = NULL; 47 struct pkey_index_qp_list *tmp_pkey; 48 struct ib_device *dev = pp->sec->dev; 49 50 spin_lock(&dev->port_pkey_list[pp->port_num].list_lock); 51 list_for_each_entry(tmp_pkey, 52 &dev->port_pkey_list[pp->port_num].pkey_list, 53 pkey_index_list) { 54 if (tmp_pkey->pkey_index == pp->pkey_index) { 55 pkey = tmp_pkey; 56 break; 57 } 58 } 59 spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock); 60 return pkey; 61 } 62 63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp, 64 u16 *pkey, 65 u64 *subnet_prefix) 66 { 67 struct ib_device *dev = pp->sec->dev; 68 int ret; 69 70 ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey); 71 if (ret) 72 return ret; 73 74 ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix); 75 76 return ret; 77 } 78 79 static int enforce_qp_pkey_security(u16 pkey, 80 u64 subnet_prefix, 81 struct ib_qp_security *qp_sec) 82 { 83 struct ib_qp_security *shared_qp_sec; 84 int ret; 85 86 ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey); 87 if (ret) 88 return ret; 89 90 list_for_each_entry(shared_qp_sec, 91 &qp_sec->shared_qp_list, 92 shared_qp_list) { 93 ret = security_ib_pkey_access(shared_qp_sec->security, 94 subnet_prefix, 95 pkey); 96 if (ret) 97 return ret; 98 } 99 return 0; 100 } 101 102 /* The caller of this function must hold the QP security 103 * mutex of the QP of the security structure in *pps. 104 * 105 * It takes separate ports_pkeys and security structure 106 * because in some cases the pps will be for a new settings 107 * or the pps will be for the real QP and security structure 108 * will be for a shared QP. 109 */ 110 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps, 111 struct ib_qp_security *sec) 112 { 113 u64 subnet_prefix; 114 u16 pkey; 115 int ret = 0; 116 117 if (!pps) 118 return 0; 119 120 if (pps->main.state != IB_PORT_PKEY_NOT_VALID) { 121 ret = get_pkey_and_subnet_prefix(&pps->main, 122 &pkey, 123 &subnet_prefix); 124 if (ret) 125 return ret; 126 127 ret = enforce_qp_pkey_security(pkey, 128 subnet_prefix, 129 sec); 130 if (ret) 131 return ret; 132 } 133 134 if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) { 135 ret = get_pkey_and_subnet_prefix(&pps->alt, 136 &pkey, 137 &subnet_prefix); 138 if (ret) 139 return ret; 140 141 ret = enforce_qp_pkey_security(pkey, 142 subnet_prefix, 143 sec); 144 } 145 146 return ret; 147 } 148 149 /* The caller of this function must hold the QP security 150 * mutex. 151 */ 152 static void qp_to_error(struct ib_qp_security *sec) 153 { 154 struct ib_qp_security *shared_qp_sec; 155 struct ib_qp_attr attr = { 156 .qp_state = IB_QPS_ERR 157 }; 158 struct ib_event event = { 159 .event = IB_EVENT_QP_FATAL 160 }; 161 162 /* If the QP is in the process of being destroyed 163 * the qp pointer in the security structure is 164 * undefined. It cannot be modified now. 165 */ 166 if (sec->destroying) 167 return; 168 169 ib_modify_qp(sec->qp, 170 &attr, 171 IB_QP_STATE); 172 173 if (sec->qp->event_handler && sec->qp->qp_context) { 174 event.element.qp = sec->qp; 175 sec->qp->event_handler(&event, 176 sec->qp->qp_context); 177 } 178 179 list_for_each_entry(shared_qp_sec, 180 &sec->shared_qp_list, 181 shared_qp_list) { 182 struct ib_qp *qp = shared_qp_sec->qp; 183 184 if (qp->event_handler && qp->qp_context) { 185 event.element.qp = qp; 186 event.device = qp->device; 187 qp->event_handler(&event, 188 qp->qp_context); 189 } 190 } 191 } 192 193 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey, 194 struct ib_device *device, 195 u8 port_num, 196 u64 subnet_prefix) 197 { 198 struct ib_port_pkey *pp, *tmp_pp; 199 bool comp; 200 LIST_HEAD(to_error_list); 201 u16 pkey_val; 202 203 if (!ib_get_cached_pkey(device, 204 port_num, 205 pkey->pkey_index, 206 &pkey_val)) { 207 spin_lock(&pkey->qp_list_lock); 208 list_for_each_entry(pp, &pkey->qp_list, qp_list) { 209 if (atomic_read(&pp->sec->error_list_count)) 210 continue; 211 212 if (enforce_qp_pkey_security(pkey_val, 213 subnet_prefix, 214 pp->sec)) { 215 atomic_inc(&pp->sec->error_list_count); 216 list_add(&pp->to_error_list, 217 &to_error_list); 218 } 219 } 220 spin_unlock(&pkey->qp_list_lock); 221 } 222 223 list_for_each_entry_safe(pp, 224 tmp_pp, 225 &to_error_list, 226 to_error_list) { 227 mutex_lock(&pp->sec->mutex); 228 qp_to_error(pp->sec); 229 list_del(&pp->to_error_list); 230 atomic_dec(&pp->sec->error_list_count); 231 comp = pp->sec->destroying; 232 mutex_unlock(&pp->sec->mutex); 233 234 if (comp) 235 complete(&pp->sec->error_complete); 236 } 237 } 238 239 /* The caller of this function must hold the QP security 240 * mutex. 241 */ 242 static int port_pkey_list_insert(struct ib_port_pkey *pp) 243 { 244 struct pkey_index_qp_list *tmp_pkey; 245 struct pkey_index_qp_list *pkey; 246 struct ib_device *dev; 247 u8 port_num = pp->port_num; 248 int ret = 0; 249 250 if (pp->state != IB_PORT_PKEY_VALID) 251 return 0; 252 253 dev = pp->sec->dev; 254 255 pkey = get_pkey_idx_qp_list(pp); 256 257 if (!pkey) { 258 bool found = false; 259 260 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL); 261 if (!pkey) 262 return -ENOMEM; 263 264 spin_lock(&dev->port_pkey_list[port_num].list_lock); 265 /* Check for the PKey again. A racing process may 266 * have created it. 267 */ 268 list_for_each_entry(tmp_pkey, 269 &dev->port_pkey_list[port_num].pkey_list, 270 pkey_index_list) { 271 if (tmp_pkey->pkey_index == pp->pkey_index) { 272 kfree(pkey); 273 pkey = tmp_pkey; 274 found = true; 275 break; 276 } 277 } 278 279 if (!found) { 280 pkey->pkey_index = pp->pkey_index; 281 spin_lock_init(&pkey->qp_list_lock); 282 INIT_LIST_HEAD(&pkey->qp_list); 283 list_add(&pkey->pkey_index_list, 284 &dev->port_pkey_list[port_num].pkey_list); 285 } 286 spin_unlock(&dev->port_pkey_list[port_num].list_lock); 287 } 288 289 spin_lock(&pkey->qp_list_lock); 290 list_add(&pp->qp_list, &pkey->qp_list); 291 spin_unlock(&pkey->qp_list_lock); 292 293 pp->state = IB_PORT_PKEY_LISTED; 294 295 return ret; 296 } 297 298 /* The caller of this function must hold the QP security 299 * mutex. 300 */ 301 static void port_pkey_list_remove(struct ib_port_pkey *pp) 302 { 303 struct pkey_index_qp_list *pkey; 304 305 if (pp->state != IB_PORT_PKEY_LISTED) 306 return; 307 308 pkey = get_pkey_idx_qp_list(pp); 309 310 spin_lock(&pkey->qp_list_lock); 311 list_del(&pp->qp_list); 312 spin_unlock(&pkey->qp_list_lock); 313 314 /* The setting may still be valid, i.e. after 315 * a destroy has failed for example. 316 */ 317 pp->state = IB_PORT_PKEY_VALID; 318 } 319 320 static void destroy_qp_security(struct ib_qp_security *sec) 321 { 322 security_ib_free_security(sec->security); 323 kfree(sec->ports_pkeys); 324 kfree(sec); 325 } 326 327 /* The caller of this function must hold the QP security 328 * mutex. 329 */ 330 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, 331 const struct ib_qp_attr *qp_attr, 332 int qp_attr_mask) 333 { 334 struct ib_ports_pkeys *new_pps; 335 struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys; 336 337 new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL); 338 if (!new_pps) 339 return NULL; 340 341 if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) { 342 if (!qp_pps) { 343 new_pps->main.port_num = qp_attr->port_num; 344 new_pps->main.pkey_index = qp_attr->pkey_index; 345 } else { 346 new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ? 347 qp_attr->port_num : 348 qp_pps->main.port_num; 349 350 new_pps->main.pkey_index = 351 (qp_attr_mask & IB_QP_PKEY_INDEX) ? 352 qp_attr->pkey_index : 353 qp_pps->main.pkey_index; 354 } 355 new_pps->main.state = IB_PORT_PKEY_VALID; 356 } else if (qp_pps) { 357 new_pps->main.port_num = qp_pps->main.port_num; 358 new_pps->main.pkey_index = qp_pps->main.pkey_index; 359 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) 360 new_pps->main.state = IB_PORT_PKEY_VALID; 361 } 362 363 if (qp_attr_mask & IB_QP_ALT_PATH) { 364 new_pps->alt.port_num = qp_attr->alt_port_num; 365 new_pps->alt.pkey_index = qp_attr->alt_pkey_index; 366 new_pps->alt.state = IB_PORT_PKEY_VALID; 367 } else if (qp_pps) { 368 new_pps->alt.port_num = qp_pps->alt.port_num; 369 new_pps->alt.pkey_index = qp_pps->alt.pkey_index; 370 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID) 371 new_pps->alt.state = IB_PORT_PKEY_VALID; 372 } 373 374 new_pps->main.sec = qp->qp_sec; 375 new_pps->alt.sec = qp->qp_sec; 376 return new_pps; 377 } 378 379 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev) 380 { 381 struct ib_qp *real_qp = qp->real_qp; 382 int ret; 383 384 ret = ib_create_qp_security(qp, dev); 385 386 if (ret) 387 return ret; 388 389 mutex_lock(&real_qp->qp_sec->mutex); 390 ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys, 391 qp->qp_sec); 392 393 if (ret) 394 goto ret; 395 396 if (qp != real_qp) 397 list_add(&qp->qp_sec->shared_qp_list, 398 &real_qp->qp_sec->shared_qp_list); 399 ret: 400 mutex_unlock(&real_qp->qp_sec->mutex); 401 if (ret) 402 destroy_qp_security(qp->qp_sec); 403 404 return ret; 405 } 406 407 void ib_close_shared_qp_security(struct ib_qp_security *sec) 408 { 409 struct ib_qp *real_qp = sec->qp->real_qp; 410 411 mutex_lock(&real_qp->qp_sec->mutex); 412 list_del(&sec->shared_qp_list); 413 mutex_unlock(&real_qp->qp_sec->mutex); 414 415 destroy_qp_security(sec); 416 } 417 418 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) 419 { 420 int ret; 421 422 qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL); 423 if (!qp->qp_sec) 424 return -ENOMEM; 425 426 qp->qp_sec->qp = qp; 427 qp->qp_sec->dev = dev; 428 mutex_init(&qp->qp_sec->mutex); 429 INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list); 430 atomic_set(&qp->qp_sec->error_list_count, 0); 431 init_completion(&qp->qp_sec->error_complete); 432 ret = security_ib_alloc_security(&qp->qp_sec->security); 433 if (ret) { 434 kfree(qp->qp_sec); 435 qp->qp_sec = NULL; 436 } 437 438 return ret; 439 } 440 EXPORT_SYMBOL(ib_create_qp_security); 441 442 void ib_destroy_qp_security_begin(struct ib_qp_security *sec) 443 { 444 mutex_lock(&sec->mutex); 445 446 /* Remove the QP from the lists so it won't get added to 447 * a to_error_list during the destroy process. 448 */ 449 if (sec->ports_pkeys) { 450 port_pkey_list_remove(&sec->ports_pkeys->main); 451 port_pkey_list_remove(&sec->ports_pkeys->alt); 452 } 453 454 /* If the QP is already in one or more of those lists 455 * the destroying flag will ensure the to error flow 456 * doesn't operate on an undefined QP. 457 */ 458 sec->destroying = true; 459 460 /* Record the error list count to know how many completions 461 * to wait for. 462 */ 463 sec->error_comps_pending = atomic_read(&sec->error_list_count); 464 465 mutex_unlock(&sec->mutex); 466 } 467 468 void ib_destroy_qp_security_abort(struct ib_qp_security *sec) 469 { 470 int ret; 471 int i; 472 473 /* If a concurrent cache update is in progress this 474 * QP security could be marked for an error state 475 * transition. Wait for this to complete. 476 */ 477 for (i = 0; i < sec->error_comps_pending; i++) 478 wait_for_completion(&sec->error_complete); 479 480 mutex_lock(&sec->mutex); 481 sec->destroying = false; 482 483 /* Restore the position in the lists and verify 484 * access is still allowed in case a cache update 485 * occurred while attempting to destroy. 486 * 487 * Because these setting were listed already 488 * and removed during ib_destroy_qp_security_begin 489 * we know the pkey_index_qp_list for the PKey 490 * already exists so port_pkey_list_insert won't fail. 491 */ 492 if (sec->ports_pkeys) { 493 port_pkey_list_insert(&sec->ports_pkeys->main); 494 port_pkey_list_insert(&sec->ports_pkeys->alt); 495 } 496 497 ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec); 498 if (ret) 499 qp_to_error(sec); 500 501 mutex_unlock(&sec->mutex); 502 } 503 504 void ib_destroy_qp_security_end(struct ib_qp_security *sec) 505 { 506 int i; 507 508 /* If a concurrent cache update is occurring we must 509 * wait until this QP security structure is processed 510 * in the QP to error flow before destroying it because 511 * the to_error_list is in use. 512 */ 513 for (i = 0; i < sec->error_comps_pending; i++) 514 wait_for_completion(&sec->error_complete); 515 516 destroy_qp_security(sec); 517 } 518 519 void ib_security_cache_change(struct ib_device *device, 520 u8 port_num, 521 u64 subnet_prefix) 522 { 523 struct pkey_index_qp_list *pkey; 524 525 list_for_each_entry(pkey, 526 &device->port_pkey_list[port_num].pkey_list, 527 pkey_index_list) { 528 check_pkey_qps(pkey, 529 device, 530 port_num, 531 subnet_prefix); 532 } 533 } 534 535 void ib_security_destroy_port_pkey_list(struct ib_device *device) 536 { 537 struct pkey_index_qp_list *pkey, *tmp_pkey; 538 int i; 539 540 for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) { 541 spin_lock(&device->port_pkey_list[i].list_lock); 542 list_for_each_entry_safe(pkey, 543 tmp_pkey, 544 &device->port_pkey_list[i].pkey_list, 545 pkey_index_list) { 546 list_del(&pkey->pkey_index_list); 547 kfree(pkey); 548 } 549 spin_unlock(&device->port_pkey_list[i].list_lock); 550 } 551 } 552 553 int ib_security_modify_qp(struct ib_qp *qp, 554 struct ib_qp_attr *qp_attr, 555 int qp_attr_mask, 556 struct ib_udata *udata) 557 { 558 int ret = 0; 559 struct ib_ports_pkeys *tmp_pps; 560 struct ib_ports_pkeys *new_pps; 561 struct ib_qp *real_qp = qp->real_qp; 562 bool special_qp = (real_qp->qp_type == IB_QPT_SMI || 563 real_qp->qp_type == IB_QPT_GSI || 564 real_qp->qp_type >= IB_QPT_RESERVED1); 565 bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) || 566 (qp_attr_mask & IB_QP_ALT_PATH)); 567 568 /* The port/pkey settings are maintained only for the real QP. Open 569 * handles on the real QP will be in the shared_qp_list. When 570 * enforcing security on the real QP all the shared QPs will be 571 * checked as well. 572 */ 573 574 if (pps_change && !special_qp) { 575 mutex_lock(&real_qp->qp_sec->mutex); 576 new_pps = get_new_pps(real_qp, 577 qp_attr, 578 qp_attr_mask); 579 580 /* Add this QP to the lists for the new port 581 * and pkey settings before checking for permission 582 * in case there is a concurrent cache update 583 * occurring. Walking the list for a cache change 584 * doesn't acquire the security mutex unless it's 585 * sending the QP to error. 586 */ 587 ret = port_pkey_list_insert(&new_pps->main); 588 589 if (!ret) 590 ret = port_pkey_list_insert(&new_pps->alt); 591 592 if (!ret) 593 ret = check_qp_port_pkey_settings(new_pps, 594 real_qp->qp_sec); 595 } 596 597 if (!ret) 598 ret = real_qp->device->modify_qp(real_qp, 599 qp_attr, 600 qp_attr_mask, 601 udata); 602 603 if (pps_change && !special_qp) { 604 /* Clean up the lists and free the appropriate 605 * ports_pkeys structure. 606 */ 607 if (ret) { 608 tmp_pps = new_pps; 609 } else { 610 tmp_pps = real_qp->qp_sec->ports_pkeys; 611 real_qp->qp_sec->ports_pkeys = new_pps; 612 } 613 614 if (tmp_pps) { 615 port_pkey_list_remove(&tmp_pps->main); 616 port_pkey_list_remove(&tmp_pps->alt); 617 } 618 kfree(tmp_pps); 619 mutex_unlock(&real_qp->qp_sec->mutex); 620 } 621 return ret; 622 } 623 EXPORT_SYMBOL(ib_security_modify_qp); 624 625 int ib_security_pkey_access(struct ib_device *dev, 626 u8 port_num, 627 u16 pkey_index, 628 void *sec) 629 { 630 u64 subnet_prefix; 631 u16 pkey; 632 int ret; 633 634 ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey); 635 if (ret) 636 return ret; 637 638 ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix); 639 640 if (ret) 641 return ret; 642 643 return security_ib_pkey_access(sec, subnet_prefix, pkey); 644 } 645 EXPORT_SYMBOL(ib_security_pkey_access); 646 647 static int ib_mad_agent_security_change(struct notifier_block *nb, 648 unsigned long event, 649 void *data) 650 { 651 struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb); 652 653 if (event != LSM_POLICY_CHANGE) 654 return NOTIFY_DONE; 655 656 ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security, 657 ag->device->name, 658 ag->port_num); 659 660 return NOTIFY_OK; 661 } 662 663 int ib_mad_agent_security_setup(struct ib_mad_agent *agent, 664 enum ib_qp_type qp_type) 665 { 666 int ret; 667 668 ret = security_ib_alloc_security(&agent->security); 669 if (ret) 670 return ret; 671 672 if (qp_type != IB_QPT_SMI) 673 return 0; 674 675 ret = security_ib_endport_manage_subnet(agent->security, 676 agent->device->name, 677 agent->port_num); 678 if (ret) 679 return ret; 680 681 agent->lsm_nb.notifier_call = ib_mad_agent_security_change; 682 ret = register_lsm_notifier(&agent->lsm_nb); 683 if (ret) 684 return ret; 685 686 agent->smp_allowed = true; 687 agent->lsm_nb_reg = true; 688 return 0; 689 } 690 691 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent) 692 { 693 security_ib_free_security(agent->security); 694 if (agent->lsm_nb_reg) 695 unregister_lsm_notifier(&agent->lsm_nb); 696 } 697 698 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index) 699 { 700 if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed) 701 return -EACCES; 702 703 return ib_security_pkey_access(map->agent.device, 704 map->agent.port_num, 705 pkey_index, 706 map->agent.security); 707 } 708 709 #endif /* CONFIG_SECURITY_INFINIBAND */ 710