1 /* 2 * Copyright (c) 2017, Mellanox Technologies inc. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 */ 32 33 #include <rdma/rdma_user_ioctl.h> 34 #include <rdma/uverbs_ioctl.h> 35 #include "rdma_core.h" 36 #include "uverbs.h" 37 38 struct bundle_alloc_head { 39 struct bundle_alloc_head *next; 40 u8 data[]; 41 }; 42 43 struct bundle_priv { 44 /* Must be first */ 45 struct bundle_alloc_head alloc_head; 46 struct bundle_alloc_head *allocated_mem; 47 size_t internal_avail; 48 size_t internal_used; 49 50 struct radix_tree_root *radix; 51 const struct uverbs_api_ioctl_method *method_elm; 52 void __rcu **radix_slots; 53 unsigned long radix_slots_len; 54 u32 method_key; 55 56 struct ib_uverbs_attr __user *user_attrs; 57 struct ib_uverbs_attr *uattrs; 58 59 DECLARE_BITMAP(uobj_finalize, UVERBS_API_ATTR_BKEY_LEN); 60 DECLARE_BITMAP(spec_finalize, UVERBS_API_ATTR_BKEY_LEN); 61 62 /* 63 * Must be last. bundle ends in a flex array which overlaps 64 * internal_buffer. 65 */ 66 struct uverbs_attr_bundle bundle; 67 u64 internal_buffer[32]; 68 }; 69 70 /* 71 * Each method has an absolute minimum amount of memory it needs to allocate, 72 * precompute that amount and determine if the onstack memory can be used or 73 * if allocation is need. 74 */ 75 void uapi_compute_bundle_size(struct uverbs_api_ioctl_method *method_elm, 76 unsigned int num_attrs) 77 { 78 struct bundle_priv *pbundle; 79 size_t bundle_size = 80 offsetof(struct bundle_priv, internal_buffer) + 81 sizeof(*pbundle->bundle.attrs) * method_elm->key_bitmap_len + 82 sizeof(*pbundle->uattrs) * num_attrs; 83 84 method_elm->use_stack = bundle_size <= sizeof(*pbundle); 85 method_elm->bundle_size = 86 ALIGN(bundle_size + 256, sizeof(*pbundle->internal_buffer)); 87 88 /* Do not want order-2 allocations for this. */ 89 WARN_ON_ONCE(method_elm->bundle_size > PAGE_SIZE); 90 } 91 92 /** 93 * uverbs_alloc() - Quickly allocate memory for use with a bundle 94 * @bundle: The bundle 95 * @size: Number of bytes to allocate 96 * @flags: Allocator flags 97 * 98 * The bundle allocator is intended for allocations that are connected with 99 * processing the system call related to the bundle. The allocated memory is 100 * always freed once the system call completes, and cannot be freed any other 101 * way. 102 * 103 * This tries to use a small pool of pre-allocated memory for performance. 104 */ 105 __malloc void *_uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size, 106 gfp_t flags) 107 { 108 struct bundle_priv *pbundle = 109 container_of(bundle, struct bundle_priv, bundle); 110 size_t new_used; 111 void *res; 112 113 if (check_add_overflow(size, pbundle->internal_used, &new_used)) 114 return ERR_PTR(-EOVERFLOW); 115 116 if (new_used > pbundle->internal_avail) { 117 struct bundle_alloc_head *buf; 118 119 buf = kvmalloc(struct_size(buf, data, size), flags); 120 if (!buf) 121 return ERR_PTR(-ENOMEM); 122 buf->next = pbundle->allocated_mem; 123 pbundle->allocated_mem = buf; 124 return buf->data; 125 } 126 127 res = (void *)pbundle->internal_buffer + pbundle->internal_used; 128 pbundle->internal_used = 129 ALIGN(new_used, sizeof(*pbundle->internal_buffer)); 130 if (want_init_on_alloc(flags)) 131 memset(res, 0, size); 132 return res; 133 } 134 EXPORT_SYMBOL(_uverbs_alloc); 135 136 static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr, 137 u16 len) 138 { 139 if (uattr->len > sizeof(((struct ib_uverbs_attr *)0)->data)) 140 return ib_is_buffer_cleared(u64_to_user_ptr(uattr->data) + len, 141 uattr->len - len); 142 143 return !memchr_inv((const void *)&uattr->data + len, 144 0, uattr->len - len); 145 } 146 147 static int uverbs_set_output(const struct uverbs_attr_bundle *bundle, 148 const struct uverbs_attr *attr) 149 { 150 struct bundle_priv *pbundle = 151 container_of(bundle, struct bundle_priv, bundle); 152 u16 flags; 153 154 flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags | 155 UVERBS_ATTR_F_VALID_OUTPUT; 156 if (put_user(flags, 157 &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags)) 158 return -EFAULT; 159 return 0; 160 } 161 162 static int uverbs_process_idrs_array(struct bundle_priv *pbundle, 163 const struct uverbs_api_attr *attr_uapi, 164 struct uverbs_objs_arr_attr *attr, 165 struct ib_uverbs_attr *uattr, 166 u32 attr_bkey) 167 { 168 const struct uverbs_attr_spec *spec = &attr_uapi->spec; 169 size_t array_len; 170 u32 *idr_vals; 171 int ret = 0; 172 size_t i; 173 174 if (uattr->attr_data.reserved) 175 return -EINVAL; 176 177 if (uattr->len % sizeof(u32)) 178 return -EINVAL; 179 180 array_len = uattr->len / sizeof(u32); 181 if (array_len < spec->u2.objs_arr.min_len || 182 array_len > spec->u2.objs_arr.max_len) 183 return -EINVAL; 184 185 attr->uobjects = 186 uverbs_alloc(&pbundle->bundle, 187 array_size(array_len, sizeof(*attr->uobjects))); 188 if (IS_ERR(attr->uobjects)) 189 return PTR_ERR(attr->uobjects); 190 191 /* 192 * Since idr is 4B and *uobjects is >= 4B, we can use attr->uobjects 193 * to store idrs array and avoid additional memory allocation. The 194 * idrs array is offset to the end of the uobjects array so we will be 195 * able to read idr and replace with a pointer. 196 */ 197 idr_vals = (u32 *)(attr->uobjects + array_len) - array_len; 198 199 if (uattr->len > sizeof(uattr->data)) { 200 ret = copy_from_user(idr_vals, u64_to_user_ptr(uattr->data), 201 uattr->len); 202 if (ret) 203 return -EFAULT; 204 } else { 205 memcpy(idr_vals, &uattr->data, uattr->len); 206 } 207 208 for (i = 0; i != array_len; i++) { 209 attr->uobjects[i] = uverbs_get_uobject_from_file( 210 spec->u2.objs_arr.obj_type, spec->u2.objs_arr.access, 211 idr_vals[i], &pbundle->bundle); 212 if (IS_ERR(attr->uobjects[i])) { 213 ret = PTR_ERR(attr->uobjects[i]); 214 break; 215 } 216 } 217 218 attr->len = i; 219 __set_bit(attr_bkey, pbundle->spec_finalize); 220 return ret; 221 } 222 223 static void uverbs_free_idrs_array(const struct uverbs_api_attr *attr_uapi, 224 struct uverbs_objs_arr_attr *attr, 225 bool commit, 226 struct uverbs_attr_bundle *attrs) 227 { 228 const struct uverbs_attr_spec *spec = &attr_uapi->spec; 229 size_t i; 230 231 for (i = 0; i != attr->len; i++) 232 uverbs_finalize_object(attr->uobjects[i], 233 spec->u2.objs_arr.access, commit, attrs); 234 } 235 236 static int uverbs_process_attr(struct bundle_priv *pbundle, 237 const struct uverbs_api_attr *attr_uapi, 238 struct ib_uverbs_attr *uattr, u32 attr_bkey) 239 { 240 const struct uverbs_attr_spec *spec = &attr_uapi->spec; 241 struct uverbs_attr *e = &pbundle->bundle.attrs[attr_bkey]; 242 const struct uverbs_attr_spec *val_spec = spec; 243 struct uverbs_obj_attr *o_attr; 244 245 switch (spec->type) { 246 case UVERBS_ATTR_TYPE_ENUM_IN: 247 if (uattr->attr_data.enum_data.elem_id >= spec->u.enum_def.num_elems) 248 return -EOPNOTSUPP; 249 250 if (uattr->attr_data.enum_data.reserved) 251 return -EINVAL; 252 253 val_spec = &spec->u2.enum_def.ids[uattr->attr_data.enum_data.elem_id]; 254 255 /* Currently we only support PTR_IN based enums */ 256 if (val_spec->type != UVERBS_ATTR_TYPE_PTR_IN) 257 return -EOPNOTSUPP; 258 259 e->ptr_attr.enum_id = uattr->attr_data.enum_data.elem_id; 260 /* fall through */ 261 case UVERBS_ATTR_TYPE_PTR_IN: 262 /* Ensure that any data provided by userspace beyond the known 263 * struct is zero. Userspace that knows how to use some future 264 * longer struct will fail here if used with an old kernel and 265 * non-zero content, making ABI compat/discovery simpler. 266 */ 267 if (uattr->len > val_spec->u.ptr.len && 268 val_spec->zero_trailing && 269 !uverbs_is_attr_cleared(uattr, val_spec->u.ptr.len)) 270 return -EOPNOTSUPP; 271 272 /* fall through */ 273 case UVERBS_ATTR_TYPE_PTR_OUT: 274 if (uattr->len < val_spec->u.ptr.min_len || 275 (!val_spec->zero_trailing && 276 uattr->len > val_spec->u.ptr.len)) 277 return -EINVAL; 278 279 if (spec->type != UVERBS_ATTR_TYPE_ENUM_IN && 280 uattr->attr_data.reserved) 281 return -EINVAL; 282 283 e->ptr_attr.uattr_idx = uattr - pbundle->uattrs; 284 e->ptr_attr.len = uattr->len; 285 286 if (val_spec->alloc_and_copy && !uverbs_attr_ptr_is_inline(e)) { 287 void *p; 288 289 p = uverbs_alloc(&pbundle->bundle, uattr->len); 290 if (IS_ERR(p)) 291 return PTR_ERR(p); 292 293 e->ptr_attr.ptr = p; 294 295 if (copy_from_user(p, u64_to_user_ptr(uattr->data), 296 uattr->len)) 297 return -EFAULT; 298 } else { 299 e->ptr_attr.data = uattr->data; 300 } 301 break; 302 303 case UVERBS_ATTR_TYPE_IDR: 304 case UVERBS_ATTR_TYPE_FD: 305 if (uattr->attr_data.reserved) 306 return -EINVAL; 307 308 if (uattr->len != 0) 309 return -EINVAL; 310 311 o_attr = &e->obj_attr; 312 o_attr->attr_elm = attr_uapi; 313 314 /* 315 * The type of uattr->data is u64 for UVERBS_ATTR_TYPE_IDR and 316 * s64 for UVERBS_ATTR_TYPE_FD. We can cast the u64 to s64 317 * here without caring about truncation as we know that the 318 * IDR implementation today rejects negative IDs 319 */ 320 o_attr->uobject = uverbs_get_uobject_from_file( 321 spec->u.obj.obj_type, spec->u.obj.access, 322 uattr->data_s64, &pbundle->bundle); 323 if (IS_ERR(o_attr->uobject)) 324 return PTR_ERR(o_attr->uobject); 325 __set_bit(attr_bkey, pbundle->uobj_finalize); 326 327 if (spec->u.obj.access == UVERBS_ACCESS_NEW) { 328 unsigned int uattr_idx = uattr - pbundle->uattrs; 329 s64 id = o_attr->uobject->id; 330 331 /* Copy the allocated id to the user-space */ 332 if (put_user(id, &pbundle->user_attrs[uattr_idx].data)) 333 return -EFAULT; 334 } 335 336 break; 337 338 case UVERBS_ATTR_TYPE_IDRS_ARRAY: 339 return uverbs_process_idrs_array(pbundle, attr_uapi, 340 &e->objs_arr_attr, uattr, 341 attr_bkey); 342 default: 343 return -EOPNOTSUPP; 344 } 345 346 return 0; 347 } 348 349 /* 350 * We search the radix tree with the method prefix and now we want to fast 351 * search the suffix bits to get a particular attribute pointer. It is not 352 * totally clear to me if this breaks the radix tree encasulation or not, but 353 * it uses the iter data to determine if the method iter points at the same 354 * chunk that will store the attribute, if so it just derefs it directly. By 355 * construction in most kernel configs the method and attrs will all fit in a 356 * single radix chunk, so in most cases this will have no search. Other cases 357 * this falls back to a full search. 358 */ 359 static void __rcu **uapi_get_attr_for_method(struct bundle_priv *pbundle, 360 u32 attr_key) 361 { 362 void __rcu **slot; 363 364 if (likely(attr_key < pbundle->radix_slots_len)) { 365 void *entry; 366 367 slot = pbundle->radix_slots + attr_key; 368 entry = rcu_dereference_raw(*slot); 369 if (likely(!radix_tree_is_internal_node(entry) && entry)) 370 return slot; 371 } 372 373 return radix_tree_lookup_slot(pbundle->radix, 374 pbundle->method_key | attr_key); 375 } 376 377 static int uverbs_set_attr(struct bundle_priv *pbundle, 378 struct ib_uverbs_attr *uattr) 379 { 380 u32 attr_key = uapi_key_attr(uattr->attr_id); 381 u32 attr_bkey = uapi_bkey_attr(attr_key); 382 const struct uverbs_api_attr *attr; 383 void __rcu **slot; 384 int ret; 385 386 slot = uapi_get_attr_for_method(pbundle, attr_key); 387 if (!slot) { 388 /* 389 * Kernel does not support the attribute but user-space says it 390 * is mandatory 391 */ 392 if (uattr->flags & UVERBS_ATTR_F_MANDATORY) 393 return -EPROTONOSUPPORT; 394 return 0; 395 } 396 attr = rcu_dereference_protected(*slot, true); 397 398 /* Reject duplicate attributes from user-space */ 399 if (test_bit(attr_bkey, pbundle->bundle.attr_present)) 400 return -EINVAL; 401 402 ret = uverbs_process_attr(pbundle, attr, uattr, attr_bkey); 403 if (ret) 404 return ret; 405 406 __set_bit(attr_bkey, pbundle->bundle.attr_present); 407 408 return 0; 409 } 410 411 static int ib_uverbs_run_method(struct bundle_priv *pbundle, 412 unsigned int num_attrs) 413 { 414 int (*handler)(struct uverbs_attr_bundle *attrs); 415 size_t uattrs_size = array_size(sizeof(*pbundle->uattrs), num_attrs); 416 unsigned int destroy_bkey = pbundle->method_elm->destroy_bkey; 417 unsigned int i; 418 int ret; 419 420 /* See uverbs_disassociate_api() */ 421 handler = srcu_dereference( 422 pbundle->method_elm->handler, 423 &pbundle->bundle.ufile->device->disassociate_srcu); 424 if (!handler) 425 return -EIO; 426 427 pbundle->uattrs = uverbs_alloc(&pbundle->bundle, uattrs_size); 428 if (IS_ERR(pbundle->uattrs)) 429 return PTR_ERR(pbundle->uattrs); 430 if (copy_from_user(pbundle->uattrs, pbundle->user_attrs, uattrs_size)) 431 return -EFAULT; 432 433 for (i = 0; i != num_attrs; i++) { 434 ret = uverbs_set_attr(pbundle, &pbundle->uattrs[i]); 435 if (unlikely(ret)) 436 return ret; 437 } 438 439 /* User space did not provide all the mandatory attributes */ 440 if (unlikely(!bitmap_subset(pbundle->method_elm->attr_mandatory, 441 pbundle->bundle.attr_present, 442 pbundle->method_elm->key_bitmap_len))) 443 return -EINVAL; 444 445 if (pbundle->method_elm->has_udata) 446 uverbs_fill_udata(&pbundle->bundle, 447 &pbundle->bundle.driver_udata, 448 UVERBS_ATTR_UHW_IN, UVERBS_ATTR_UHW_OUT); 449 else 450 pbundle->bundle.driver_udata = (struct ib_udata){}; 451 452 if (destroy_bkey != UVERBS_API_ATTR_BKEY_LEN) { 453 struct uverbs_obj_attr *destroy_attr = 454 &pbundle->bundle.attrs[destroy_bkey].obj_attr; 455 456 ret = uobj_destroy(destroy_attr->uobject, &pbundle->bundle); 457 if (ret) 458 return ret; 459 __clear_bit(destroy_bkey, pbundle->uobj_finalize); 460 461 ret = handler(&pbundle->bundle); 462 uobj_put_destroy(destroy_attr->uobject); 463 } else { 464 ret = handler(&pbundle->bundle); 465 } 466 467 /* 468 * Until the drivers are revised to use the bundle directly we have to 469 * assume that the driver wrote to its UHW_OUT and flag userspace 470 * appropriately. 471 */ 472 if (!ret && pbundle->method_elm->has_udata) { 473 const struct uverbs_attr *attr = 474 uverbs_attr_get(&pbundle->bundle, UVERBS_ATTR_UHW_OUT); 475 476 if (!IS_ERR(attr)) 477 ret = uverbs_set_output(&pbundle->bundle, attr); 478 } 479 480 /* 481 * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can 482 * not invoke the method because the request is not supported. No 483 * other cases should return this code. 484 */ 485 if (WARN_ON_ONCE(ret == -EPROTONOSUPPORT)) 486 return -EINVAL; 487 488 return ret; 489 } 490 491 static void bundle_destroy(struct bundle_priv *pbundle, bool commit) 492 { 493 unsigned int key_bitmap_len = pbundle->method_elm->key_bitmap_len; 494 struct bundle_alloc_head *memblock; 495 unsigned int i; 496 497 /* fast path for simple uobjects */ 498 i = -1; 499 while ((i = find_next_bit(pbundle->uobj_finalize, key_bitmap_len, 500 i + 1)) < key_bitmap_len) { 501 struct uverbs_attr *attr = &pbundle->bundle.attrs[i]; 502 503 uverbs_finalize_object( 504 attr->obj_attr.uobject, 505 attr->obj_attr.attr_elm->spec.u.obj.access, commit, 506 &pbundle->bundle); 507 } 508 509 i = -1; 510 while ((i = find_next_bit(pbundle->spec_finalize, key_bitmap_len, 511 i + 1)) < key_bitmap_len) { 512 struct uverbs_attr *attr = &pbundle->bundle.attrs[i]; 513 const struct uverbs_api_attr *attr_uapi; 514 void __rcu **slot; 515 516 slot = uapi_get_attr_for_method( 517 pbundle, 518 pbundle->method_key | uapi_bkey_to_key_attr(i)); 519 if (WARN_ON(!slot)) 520 continue; 521 522 attr_uapi = rcu_dereference_protected(*slot, true); 523 524 if (attr_uapi->spec.type == UVERBS_ATTR_TYPE_IDRS_ARRAY) { 525 uverbs_free_idrs_array(attr_uapi, &attr->objs_arr_attr, 526 commit, &pbundle->bundle); 527 } 528 } 529 530 for (memblock = pbundle->allocated_mem; memblock;) { 531 struct bundle_alloc_head *tmp = memblock; 532 533 memblock = memblock->next; 534 kvfree(tmp); 535 } 536 } 537 538 static int ib_uverbs_cmd_verbs(struct ib_uverbs_file *ufile, 539 struct ib_uverbs_ioctl_hdr *hdr, 540 struct ib_uverbs_attr __user *user_attrs) 541 { 542 const struct uverbs_api_ioctl_method *method_elm; 543 struct uverbs_api *uapi = ufile->device->uapi; 544 struct radix_tree_iter attrs_iter; 545 struct bundle_priv *pbundle; 546 struct bundle_priv onstack; 547 void __rcu **slot; 548 int ret; 549 550 if (unlikely(hdr->driver_id != uapi->driver_id)) 551 return -EINVAL; 552 553 slot = radix_tree_iter_lookup( 554 &uapi->radix, &attrs_iter, 555 uapi_key_obj(hdr->object_id) | 556 uapi_key_ioctl_method(hdr->method_id)); 557 if (unlikely(!slot)) 558 return -EPROTONOSUPPORT; 559 method_elm = rcu_dereference_protected(*slot, true); 560 561 if (!method_elm->use_stack) { 562 pbundle = kmalloc(method_elm->bundle_size, GFP_KERNEL); 563 if (!pbundle) 564 return -ENOMEM; 565 pbundle->internal_avail = 566 method_elm->bundle_size - 567 offsetof(struct bundle_priv, internal_buffer); 568 pbundle->alloc_head.next = NULL; 569 pbundle->allocated_mem = &pbundle->alloc_head; 570 } else { 571 pbundle = &onstack; 572 pbundle->internal_avail = sizeof(pbundle->internal_buffer); 573 pbundle->allocated_mem = NULL; 574 } 575 576 /* Space for the pbundle->bundle.attrs flex array */ 577 pbundle->method_elm = method_elm; 578 pbundle->method_key = attrs_iter.index; 579 pbundle->bundle.ufile = ufile; 580 pbundle->bundle.context = NULL; /* only valid if bundle has uobject */ 581 pbundle->radix = &uapi->radix; 582 pbundle->radix_slots = slot; 583 pbundle->radix_slots_len = radix_tree_chunk_size(&attrs_iter); 584 pbundle->user_attrs = user_attrs; 585 586 pbundle->internal_used = ALIGN(pbundle->method_elm->key_bitmap_len * 587 sizeof(*pbundle->bundle.attrs), 588 sizeof(*pbundle->internal_buffer)); 589 memset(pbundle->bundle.attr_present, 0, 590 sizeof(pbundle->bundle.attr_present)); 591 memset(pbundle->uobj_finalize, 0, sizeof(pbundle->uobj_finalize)); 592 memset(pbundle->spec_finalize, 0, sizeof(pbundle->spec_finalize)); 593 594 ret = ib_uverbs_run_method(pbundle, hdr->num_attrs); 595 bundle_destroy(pbundle, ret == 0); 596 return ret; 597 } 598 599 long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 600 { 601 struct ib_uverbs_file *file = filp->private_data; 602 struct ib_uverbs_ioctl_hdr __user *user_hdr = 603 (struct ib_uverbs_ioctl_hdr __user *)arg; 604 struct ib_uverbs_ioctl_hdr hdr; 605 int srcu_key; 606 int err; 607 608 if (unlikely(cmd != RDMA_VERBS_IOCTL)) 609 return -ENOIOCTLCMD; 610 611 err = copy_from_user(&hdr, user_hdr, sizeof(hdr)); 612 if (err) 613 return -EFAULT; 614 615 if (hdr.length > PAGE_SIZE || 616 hdr.length != struct_size(&hdr, attrs, hdr.num_attrs)) 617 return -EINVAL; 618 619 if (hdr.reserved1 || hdr.reserved2) 620 return -EPROTONOSUPPORT; 621 622 srcu_key = srcu_read_lock(&file->device->disassociate_srcu); 623 err = ib_uverbs_cmd_verbs(file, &hdr, user_hdr->attrs); 624 srcu_read_unlock(&file->device->disassociate_srcu, srcu_key); 625 return err; 626 } 627 628 int uverbs_get_flags64(u64 *to, const struct uverbs_attr_bundle *attrs_bundle, 629 size_t idx, u64 allowed_bits) 630 { 631 const struct uverbs_attr *attr; 632 u64 flags; 633 634 attr = uverbs_attr_get(attrs_bundle, idx); 635 /* Missing attribute means 0 flags */ 636 if (IS_ERR(attr)) { 637 *to = 0; 638 return 0; 639 } 640 641 /* 642 * New userspace code should use 8 bytes to pass flags, but we 643 * transparently support old userspaces that were using 4 bytes as 644 * well. 645 */ 646 if (attr->ptr_attr.len == 8) 647 flags = attr->ptr_attr.data; 648 else if (attr->ptr_attr.len == 4) 649 flags = *(u32 *)&attr->ptr_attr.data; 650 else 651 return -EINVAL; 652 653 if (flags & ~allowed_bits) 654 return -EINVAL; 655 656 *to = flags; 657 return 0; 658 } 659 EXPORT_SYMBOL(uverbs_get_flags64); 660 661 int uverbs_get_flags32(u32 *to, const struct uverbs_attr_bundle *attrs_bundle, 662 size_t idx, u64 allowed_bits) 663 { 664 u64 flags; 665 int ret; 666 667 ret = uverbs_get_flags64(&flags, attrs_bundle, idx, allowed_bits); 668 if (ret) 669 return ret; 670 671 if (flags > U32_MAX) 672 return -EINVAL; 673 *to = flags; 674 675 return 0; 676 } 677 EXPORT_SYMBOL(uverbs_get_flags32); 678 679 /* 680 * Fill a ib_udata struct (core or uhw) using the given attribute IDs. 681 * This is primarily used to convert the UVERBS_ATTR_UHW() into the 682 * ib_udata format used by the drivers. 683 */ 684 void uverbs_fill_udata(struct uverbs_attr_bundle *bundle, 685 struct ib_udata *udata, unsigned int attr_in, 686 unsigned int attr_out) 687 { 688 struct bundle_priv *pbundle = 689 container_of(bundle, struct bundle_priv, bundle); 690 const struct uverbs_attr *in = 691 uverbs_attr_get(&pbundle->bundle, attr_in); 692 const struct uverbs_attr *out = 693 uverbs_attr_get(&pbundle->bundle, attr_out); 694 695 if (!IS_ERR(in)) { 696 udata->inlen = in->ptr_attr.len; 697 if (uverbs_attr_ptr_is_inline(in)) 698 udata->inbuf = 699 &pbundle->user_attrs[in->ptr_attr.uattr_idx] 700 .data; 701 else 702 udata->inbuf = u64_to_user_ptr(in->ptr_attr.data); 703 } else { 704 udata->inbuf = NULL; 705 udata->inlen = 0; 706 } 707 708 if (!IS_ERR(out)) { 709 udata->outbuf = u64_to_user_ptr(out->ptr_attr.data); 710 udata->outlen = out->ptr_attr.len; 711 } else { 712 udata->outbuf = NULL; 713 udata->outlen = 0; 714 } 715 } 716 717 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx, 718 const void *from, size_t size) 719 { 720 const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx); 721 size_t min_size; 722 723 if (IS_ERR(attr)) 724 return PTR_ERR(attr); 725 726 min_size = min_t(size_t, attr->ptr_attr.len, size); 727 if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size)) 728 return -EFAULT; 729 730 return uverbs_set_output(bundle, attr); 731 } 732 EXPORT_SYMBOL(uverbs_copy_to); 733 734 735 /* 736 * This is only used if the caller has directly used copy_to_use to write the 737 * data. It signals to user space that the buffer is filled in. 738 */ 739 int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx) 740 { 741 const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx); 742 743 if (IS_ERR(attr)) 744 return PTR_ERR(attr); 745 746 return uverbs_set_output(bundle, attr); 747 } 748 749 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle, 750 size_t idx, s64 lower_bound, u64 upper_bound, 751 s64 *def_val) 752 { 753 const struct uverbs_attr *attr; 754 755 attr = uverbs_attr_get(attrs_bundle, idx); 756 if (IS_ERR(attr)) { 757 if ((PTR_ERR(attr) != -ENOENT) || !def_val) 758 return PTR_ERR(attr); 759 760 *to = *def_val; 761 } else { 762 *to = attr->ptr_attr.data; 763 } 764 765 if (*to < lower_bound || (*to > 0 && (u64)*to > upper_bound)) 766 return -EINVAL; 767 768 return 0; 769 } 770 EXPORT_SYMBOL(_uverbs_get_const); 771 772 int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle, 773 size_t idx, const void *from, size_t size) 774 { 775 const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx); 776 777 if (IS_ERR(attr)) 778 return PTR_ERR(attr); 779 780 if (size < attr->ptr_attr.len) { 781 if (clear_user(u64_to_user_ptr(attr->ptr_attr.data) + size, 782 attr->ptr_attr.len - size)) 783 return -EFAULT; 784 } 785 return uverbs_copy_to(bundle, idx, from, size); 786 } 787