drivers/infiniband/core/security.c - third_party/kernel - Git at Google

 /*
  * Copyright (c) 2016 Mellanox Technologies Ltd.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
  * General Public License (GPL) Version 2, available from the file
  * COPYING in the main directory of this source tree, or the
  * OpenIB.org BSD license below:
  *
  *     Redistribution and use in source and binary forms, with or
  *     without modification, are permitted provided that the following
  *     conditions are met:
  *
  *      - Redistributions of source code must retain the above
  *        copyright notice, this list of conditions and the following
  *        disclaimer.
  *
  *      - Redistributions in binary form must reproduce the above
  *        copyright notice, this list of conditions and the following
  *        disclaimer in the documentation and/or other materials
  *        provided with the distribution.
  *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */

 #include <linux/security.h>
 #include <linux/completion.h>
 #include <linux/list.h>

 #include <rdma/ib_verbs.h>
 #include <rdma/ib_cache.h>
 #include "core_priv.h"
 #include "mad_priv.h"

 static LIST_HEAD(mad_agent_list);
 /* Lock to protect mad_agent_list */
 static DEFINE_SPINLOCK(mad_agent_list_lock);

 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp)
 {
 	struct pkey_index_qp_list *pkey = NULL;
 	struct pkey_index_qp_list *tmp_pkey;
 	struct ib_device *dev = pp->sec->dev;

 	spin_lock(&dev->port_data[pp->port_num].pkey_list_lock);
 	list_for_each_entry (tmp_pkey, &dev->port_data[pp->port_num].pkey_list,
 			     pkey_index_list) {
 		if (tmp_pkey->pkey_index == pp->pkey_index) {
 			pkey = tmp_pkey;
 			break;
 		}
 	}
 	spin_unlock(&dev->port_data[pp->port_num].pkey_list_lock);
 	return pkey;
 }

 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
 				      u16 *pkey,
 				      u64 *subnet_prefix)
 {
 	struct ib_device *dev = pp->sec->dev;
 	int ret;

 	ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
 	if (ret)
 		return ret;

 	ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);

 	return ret;
 }

 static int enforce_qp_pkey_security(u16 pkey,
 				    u64 subnet_prefix,
 				    struct ib_qp_security *qp_sec)
 {
 	struct ib_qp_security *shared_qp_sec;
 	int ret;

 	ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
 	if (ret)
 		return ret;

 	list_for_each_entry(shared_qp_sec,
 			    &qp_sec->shared_qp_list,
 			    shared_qp_list) {
 		ret = security_ib_pkey_access(shared_qp_sec->security,
 					      subnet_prefix,
 					      pkey);
 		if (ret)
 			return ret;
 	}
 	return 0;
 }

 /* The caller of this function must hold the QP security
  * mutex of the QP of the security structure in *pps.
  *
  * It takes separate ports_pkeys and security structure
  * because in some cases the pps will be for a new settings
  * or the pps will be for the real QP and security structure
  * will be for a shared QP.
  */
 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
 				       struct ib_qp_security *sec)
 {
 	u64 subnet_prefix;
 	u16 pkey;
 	int ret = 0;

 	if (!pps)
 		return 0;

 	if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
 		ret = get_pkey_and_subnet_prefix(&pps->main,
 						 &pkey,
 						 &subnet_prefix);
 		if (ret)
 			return ret;

 		ret = enforce_qp_pkey_security(pkey,
 					       subnet_prefix,
 					       sec);
 		if (ret)
 			return ret;
 	}

 	if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
 		ret = get_pkey_and_subnet_prefix(&pps->alt,
 						 &pkey,
 						 &subnet_prefix);
 		if (ret)
 			return ret;

 		ret = enforce_qp_pkey_security(pkey,
 					       subnet_prefix,
 					       sec);
 	}

 	return ret;
 }

 /* The caller of this function must hold the QP security
  * mutex.
  */
 static void qp_to_error(struct ib_qp_security *sec)
 {
 	struct ib_qp_security *shared_qp_sec;
 	struct ib_qp_attr attr = {
 		.qp_state = IB_QPS_ERR
 	};
 	struct ib_event event = {
 		.event = IB_EVENT_QP_FATAL
 	};

 	/* If the QP is in the process of being destroyed
 	 * the qp pointer in the security structure is
 	 * undefined.  It cannot be modified now.
 	 */
 	if (sec->destroying)
 		return;

 	ib_modify_qp(sec->qp,
 		     &attr,
 		     IB_QP_STATE);

 	if (sec->qp->event_handler && sec->qp->qp_context) {
 		event.element.qp = sec->qp;
 		sec->qp->event_handler(&event,
 				       sec->qp->qp_context);
 	}

 	list_for_each_entry(shared_qp_sec,
 			    &sec->shared_qp_list,
 			    shared_qp_list) {
 		struct ib_qp *qp = shared_qp_sec->qp;

 		if (qp->event_handler && qp->qp_context) {
 			event.element.qp = qp;
 			event.device = qp->device;
 			qp->event_handler(&event,
 					  qp->qp_context);
 		}
 	}
 }

 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
 				  struct ib_device *device,
 				  u32 port_num,
 				  u64 subnet_prefix)
 {
 	struct ib_port_pkey *pp, *tmp_pp;
 	bool comp;
 	LIST_HEAD(to_error_list);
 	u16 pkey_val;

 	if (!ib_get_cached_pkey(device,
 				port_num,
 				pkey->pkey_index,
 				&pkey_val)) {
 		spin_lock(&pkey->qp_list_lock);
 		list_for_each_entry(pp, &pkey->qp_list, qp_list) {
 			if (atomic_read(&pp->sec->error_list_count))
 				continue;

 			if (enforce_qp_pkey_security(pkey_val,
 						     subnet_prefix,
 						     pp->sec)) {
 				atomic_inc(&pp->sec->error_list_count);
 				list_add(&pp->to_error_list,
 					 &to_error_list);
 			}
 		}
 		spin_unlock(&pkey->qp_list_lock);
 	}

 	list_for_each_entry_safe(pp,
 				 tmp_pp,
 				 &to_error_list,
 				 to_error_list) {
 		mutex_lock(&pp->sec->mutex);
 		qp_to_error(pp->sec);
 		list_del(&pp->to_error_list);
 		atomic_dec(&pp->sec->error_list_count);
 		comp = pp->sec->destroying;
 		mutex_unlock(&pp->sec->mutex);

 		if (comp)
 			complete(&pp->sec->error_complete);
 	}
 }

 /* The caller of this function must hold the QP security
  * mutex.
  */
 static int port_pkey_list_insert(struct ib_port_pkey *pp)
 {
 	struct pkey_index_qp_list *tmp_pkey;
 	struct pkey_index_qp_list *pkey;
 	struct ib_device *dev;
 	u32 port_num = pp->port_num;
 	int ret = 0;

 	if (pp->state != IB_PORT_PKEY_VALID)
 		return 0;

 	dev = pp->sec->dev;

 	pkey = get_pkey_idx_qp_list(pp);

 	if (!pkey) {
 		bool found = false;

 		pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
 		if (!pkey)
 			return -ENOMEM;

 		spin_lock(&dev->port_data[port_num].pkey_list_lock);
 		/* Check for the PKey again.  A racing process may
 		 * have created it.
 		 */
 		list_for_each_entry(tmp_pkey,
 				    &dev->port_data[port_num].pkey_list,
 				    pkey_index_list) {
 			if (tmp_pkey->pkey_index == pp->pkey_index) {
 				kfree(pkey);
 				pkey = tmp_pkey;
 				found = true;
 				break;
 			}
 		}

 		if (!found) {
 			pkey->pkey_index = pp->pkey_index;
 			spin_lock_init(&pkey->qp_list_lock);
 			INIT_LIST_HEAD(&pkey->qp_list);
 			list_add(&pkey->pkey_index_list,
 				 &dev->port_data[port_num].pkey_list);
 		}
 		spin_unlock(&dev->port_data[port_num].pkey_list_lock);
 	}

 	spin_lock(&pkey->qp_list_lock);
 	list_add(&pp->qp_list, &pkey->qp_list);
 	spin_unlock(&pkey->qp_list_lock);

 	pp->state = IB_PORT_PKEY_LISTED;

 	return ret;
 }

 /* The caller of this function must hold the QP security
  * mutex.
  */
 static void port_pkey_list_remove(struct ib_port_pkey *pp)
 {
 	struct pkey_index_qp_list *pkey;

 	if (pp->state != IB_PORT_PKEY_LISTED)
 		return;

 	pkey = get_pkey_idx_qp_list(pp);

 	spin_lock(&pkey->qp_list_lock);
 	list_del(&pp->qp_list);
 	spin_unlock(&pkey->qp_list_lock);

 	/* The setting may still be valid, i.e. after
 	 * a destroy has failed for example.
 	 */
 	pp->state = IB_PORT_PKEY_VALID;
 }

 static void destroy_qp_security(struct ib_qp_security *sec)
 {
 	security_ib_free_security(sec->security);
 	kfree(sec->ports_pkeys);
 	kfree(sec);
 }

 /* The caller of this function must hold the QP security
  * mutex.
  */
 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
 					  const struct ib_qp_attr *qp_attr,
 					  int qp_attr_mask)
 {
 	struct ib_ports_pkeys *new_pps;
 	struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;

 	new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
 	if (!new_pps)
 		return NULL;

 	if (qp_attr_mask & IB_QP_PORT)
 		new_pps->main.port_num = qp_attr->port_num;
 	else if (qp_pps)
 		new_pps->main.port_num = qp_pps->main.port_num;

 	if (qp_attr_mask & IB_QP_PKEY_INDEX)
 		new_pps->main.pkey_index = qp_attr->pkey_index;
 	else if (qp_pps)
 		new_pps->main.pkey_index = qp_pps->main.pkey_index;

 	if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
 	     (qp_attr_mask & IB_QP_PORT)) ||
 	    (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
 		new_pps->main.state = IB_PORT_PKEY_VALID;

 	if (qp_attr_mask & IB_QP_ALT_PATH) {
 		new_pps->alt.port_num = qp_attr->alt_port_num;
 		new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
 		new_pps->alt.state = IB_PORT_PKEY_VALID;
 	} else if (qp_pps) {
 		new_pps->alt.port_num = qp_pps->alt.port_num;
 		new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
 		if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
 			new_pps->alt.state = IB_PORT_PKEY_VALID;
 	}

 	new_pps->main.sec = qp->qp_sec;
 	new_pps->alt.sec = qp->qp_sec;
 	return new_pps;
 }

 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
 {
 	struct ib_qp *real_qp = qp->real_qp;
 	int ret;

 	ret = ib_create_qp_security(qp, dev);

 	if (ret)
 		return ret;

 	if (!qp->qp_sec)
 		return 0;

 	mutex_lock(&real_qp->qp_sec->mutex);
 	ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
 					  qp->qp_sec);

 	if (ret)
 		goto ret;

 	if (qp != real_qp)
 		list_add(&qp->qp_sec->shared_qp_list,
 			 &real_qp->qp_sec->shared_qp_list);
 ret:
 	mutex_unlock(&real_qp->qp_sec->mutex);
 	if (ret)
 		destroy_qp_security(qp->qp_sec);

 	return ret;
 }

 void ib_close_shared_qp_security(struct ib_qp_security *sec)
 {
 	struct ib_qp *real_qp = sec->qp->real_qp;

 	mutex_lock(&real_qp->qp_sec->mutex);
 	list_del(&sec->shared_qp_list);
 	mutex_unlock(&real_qp->qp_sec->mutex);

 	destroy_qp_security(sec);
 }

 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
 {
 	unsigned int i;
 	bool is_ib = false;
 	int ret;

 	rdma_for_each_port (dev, i) {
 		is_ib = rdma_protocol_ib(dev, i);
 		if (is_ib)
 			break;
 	}

 	/* If this isn't an IB device don't create the security context */
 	if (!is_ib)
 		return 0;

 	qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
 	if (!qp->qp_sec)
 		return -ENOMEM;

 	qp->qp_sec->qp = qp;
 	qp->qp_sec->dev = dev;
 	mutex_init(&qp->qp_sec->mutex);
 	INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
 	atomic_set(&qp->qp_sec->error_list_count, 0);
 	init_completion(&qp->qp_sec->error_complete);
 	ret = security_ib_alloc_security(&qp->qp_sec->security);
 	if (ret) {
 		kfree(qp->qp_sec);
 		qp->qp_sec = NULL;
 	}

 	return ret;
 }
 EXPORT_SYMBOL(ib_create_qp_security);

 void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
 {
 	/* Return if not IB */
 	if (!sec)
 		return;

 	mutex_lock(&sec->mutex);

 	/* Remove the QP from the lists so it won't get added to
 	 * a to_error_list during the destroy process.
 	 */
 	if (sec->ports_pkeys) {
 		port_pkey_list_remove(&sec->ports_pkeys->main);
 		port_pkey_list_remove(&sec->ports_pkeys->alt);
 	}

 	/* If the QP is already in one or more of those lists
 	 * the destroying flag will ensure the to error flow
 	 * doesn't operate on an undefined QP.
 	 */
 	sec->destroying = true;

 	/* Record the error list count to know how many completions
 	 * to wait for.
 	 */
 	sec->error_comps_pending = atomic_read(&sec->error_list_count);

 	mutex_unlock(&sec->mutex);
 }

 void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
 {
 	int ret;
 	int i;

 	/* Return if not IB */
 	if (!sec)
 		return;

 	/* If a concurrent cache update is in progress this
 	 * QP security could be marked for an error state
 	 * transition.  Wait for this to complete.
 	 */
 	for (i = 0; i < sec->error_comps_pending; i++)
 		wait_for_completion(&sec->error_complete);

 	mutex_lock(&sec->mutex);
 	sec->destroying = false;

 	/* Restore the position in the lists and verify
 	 * access is still allowed in case a cache update
 	 * occurred while attempting to destroy.
 	 *
 	 * Because these setting were listed already
 	 * and removed during ib_destroy_qp_security_begin
 	 * we know the pkey_index_qp_list for the PKey
 	 * already exists so port_pkey_list_insert won't fail.
 	 */
 	if (sec->ports_pkeys) {
 		port_pkey_list_insert(&sec->ports_pkeys->main);
 		port_pkey_list_insert(&sec->ports_pkeys->alt);
 	}

 	ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
 	if (ret)
 		qp_to_error(sec);

 	mutex_unlock(&sec->mutex);
 }

 void ib_destroy_qp_security_end(struct ib_qp_security *sec)
 {
 	int i;

 	/* Return if not IB */
 	if (!sec)
 		return;

 	/* If a concurrent cache update is occurring we must
 	 * wait until this QP security structure is processed
 	 * in the QP to error flow before destroying it because
 	 * the to_error_list is in use.
 	 */
 	for (i = 0; i < sec->error_comps_pending; i++)
 		wait_for_completion(&sec->error_complete);

 	destroy_qp_security(sec);
 }

 void ib_security_cache_change(struct ib_device *device,
 			      u32 port_num,
 			      u64 subnet_prefix)
 {
 	struct pkey_index_qp_list *pkey;

 	list_for_each_entry (pkey, &device->port_data[port_num].pkey_list,
 			     pkey_index_list) {
 		check_pkey_qps(pkey,
 			       device,
 			       port_num,
 			       subnet_prefix);
 	}
 }

 void ib_security_release_port_pkey_list(struct ib_device *device)
 {
 	struct pkey_index_qp_list *pkey, *tmp_pkey;
 	unsigned int i;

 	rdma_for_each_port (device, i) {
 		list_for_each_entry_safe(pkey,
 					 tmp_pkey,
 					 &device->port_data[i].pkey_list,
 					 pkey_index_list) {
 			list_del(&pkey->pkey_index_list);
 			kfree(pkey);
 		}
 	}
 }

 int ib_security_modify_qp(struct ib_qp *qp,
 			  struct ib_qp_attr *qp_attr,
 			  int qp_attr_mask,
 			  struct ib_udata *udata)
 {
 	int ret = 0;
 	struct ib_ports_pkeys *tmp_pps;
 	struct ib_ports_pkeys *new_pps = NULL;
 	struct ib_qp *real_qp = qp->real_qp;
 	bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
 			   real_qp->qp_type == IB_QPT_GSI ||
 			   real_qp->qp_type >= IB_QPT_RESERVED1);
 	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
 			   (qp_attr_mask & IB_QP_ALT_PATH));

 	WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
 		   rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
 		   !real_qp->qp_sec),
 		   "%s: QP security is not initialized for IB QP: %u\n",
 		   __func__, real_qp->qp_num);

 	/* The port/pkey settings are maintained only for the real QP. Open
 	 * handles on the real QP will be in the shared_qp_list. When
 	 * enforcing security on the real QP all the shared QPs will be
 	 * checked as well.
 	 */

 	if (pps_change && !special_qp && real_qp->qp_sec) {
 		mutex_lock(&real_qp->qp_sec->mutex);
 		new_pps = get_new_pps(real_qp,
 				      qp_attr,
 				      qp_attr_mask);
 		if (!new_pps) {
 			mutex_unlock(&real_qp->qp_sec->mutex);
 			return -ENOMEM;
 		}
 		/* Add this QP to the lists for the new port
 		 * and pkey settings before checking for permission
 		 * in case there is a concurrent cache update
 		 * occurring.  Walking the list for a cache change
 		 * doesn't acquire the security mutex unless it's
 		 * sending the QP to error.
 		 */
 		ret = port_pkey_list_insert(&new_pps->main);

 		if (!ret)
 			ret = port_pkey_list_insert(&new_pps->alt);

 		if (!ret)
 			ret = check_qp_port_pkey_settings(new_pps,
 							  real_qp->qp_sec);
 	}

 	if (!ret)
 		ret = real_qp->device->ops.modify_qp(real_qp,
 						     qp_attr,
 						     qp_attr_mask,
 						     udata);

 	if (new_pps) {
 		/* Clean up the lists and free the appropriate
 		 * ports_pkeys structure.
 		 */
 		if (ret) {
 			tmp_pps = new_pps;
 		} else {
 			tmp_pps = real_qp->qp_sec->ports_pkeys;
 			real_qp->qp_sec->ports_pkeys = new_pps;
 		}

 		if (tmp_pps) {
 			port_pkey_list_remove(&tmp_pps->main);
 			port_pkey_list_remove(&tmp_pps->alt);
 		}
 		kfree(tmp_pps);
 		mutex_unlock(&real_qp->qp_sec->mutex);
 	}
 	return ret;
 }

 static int ib_security_pkey_access(struct ib_device *dev,
 				   u32 port_num,
 				   u16 pkey_index,
 				   void *sec)
 {
 	u64 subnet_prefix;
 	u16 pkey;
 	int ret;

 	if (!rdma_protocol_ib(dev, port_num))
 		return 0;

 	ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
 	if (ret)
 		return ret;

 	ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);

 	return security_ib_pkey_access(sec, subnet_prefix, pkey);
 }

 void ib_mad_agent_security_change(void)
 {
 	struct ib_mad_agent *ag;

 	spin_lock(&mad_agent_list_lock);
 	list_for_each_entry(ag,
 			    &mad_agent_list,
 			    mad_agent_sec_list)
 		WRITE_ONCE(ag->smp_allowed,
 			   !security_ib_endport_manage_subnet(ag->security,
 				dev_name(&ag->device->dev), ag->port_num));
 	spin_unlock(&mad_agent_list_lock);
 }

 int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
 				enum ib_qp_type qp_type)
 {
 	int ret;

 	if (!rdma_protocol_ib(agent->device, agent->port_num))
 		return 0;

 	INIT_LIST_HEAD(&agent->mad_agent_sec_list);

 	ret = security_ib_alloc_security(&agent->security);
 	if (ret)
 		return ret;

 	if (qp_type != IB_QPT_SMI)
 		return 0;

 	spin_lock(&mad_agent_list_lock);
 	ret = security_ib_endport_manage_subnet(agent->security,
 						dev_name(&agent->device->dev),
 						agent->port_num);
 	if (ret)
 		goto free_security;

 	WRITE_ONCE(agent->smp_allowed, true);
 	list_add(&agent->mad_agent_sec_list, &mad_agent_list);
 	spin_unlock(&mad_agent_list_lock);
 	return 0;

 free_security:
 	spin_unlock(&mad_agent_list_lock);
 	security_ib_free_security(agent->security);
 	return ret;
 }

 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
 {
 	if (!rdma_protocol_ib(agent->device, agent->port_num))
 		return;

 	if (agent->qp->qp_type == IB_QPT_SMI) {
 		spin_lock(&mad_agent_list_lock);
 		list_del(&agent->mad_agent_sec_list);
 		spin_unlock(&mad_agent_list_lock);
 	}

 	security_ib_free_security(agent->security);
 }

 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
 {
 	if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
 		return 0;

 	if (map->agent.qp->qp_type == IB_QPT_SMI) {
 		if (!READ_ONCE(map->agent.smp_allowed))
 			return -EACCES;
 		return 0;
 	}

 	return ib_security_pkey_access(map->agent.device,
 				       map->agent.port_num,
 				       pkey_index,
 				       map->agent.security);
 }
	/*
	* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
	*
	* This software is available to you under a choice of one of two
	* licenses. You may choose to be licensed under the terms of the GNU
	* General Public License (GPL) Version 2, available from the file
	* COPYING in the main directory of this source tree, or the
	* OpenIB.org BSD license below:
	*
	* Redistribution and use in source and binary forms, with or
	* without modification, are permitted provided that the following
	* conditions are met:
	*
	* - Redistributions of source code must retain the above
	* copyright notice, this list of conditions and the following
	* disclaimer.
	*
	* - Redistributions in binary form must reproduce the above
	* copyright notice, this list of conditions and the following
	* disclaimer in the documentation and/or other materials
	* provided with the distribution.
	*
	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
	* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
	* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
	* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
	* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
	* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
	* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
	* SOFTWARE.
	*/

	#include <linux/security.h>
	#include <linux/completion.h>
	#include <linux/list.h>

	#include <rdma/ib_verbs.h>
	#include <rdma/ib_cache.h>
	#include "core_priv.h"
	#include "mad_priv.h"

	static LIST_HEAD(mad_agent_list);
	/* Lock to protect mad_agent_list */
	static DEFINE_SPINLOCK(mad_agent_list_lock);

	static struct pkey_index_qp_list get_pkey_idx_qp_list(struct ib_port_pkey pp)
	{
	struct pkey_index_qp_list *pkey = NULL;
	struct pkey_index_qp_list *tmp_pkey;
	struct ib_device *dev = pp->sec->dev;

	spin_lock(&dev->port_data[pp->port_num].pkey_list_lock);
	list_for_each_entry (tmp_pkey, &dev->port_data[pp->port_num].pkey_list,
	pkey_index_list) {
	if (tmp_pkey->pkey_index == pp->pkey_index) {
	pkey = tmp_pkey;
	break;
	}
	}
	spin_unlock(&dev->port_data[pp->port_num].pkey_list_lock);
	return pkey;
	}

	static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
	u16 *pkey,
	u64 *subnet_prefix)
	{
	struct ib_device *dev = pp->sec->dev;
	int ret;

	ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
	if (ret)
	return ret;

	ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);

	return ret;
	}

	static int enforce_qp_pkey_security(u16 pkey,
	u64 subnet_prefix,
	struct ib_qp_security *qp_sec)
	{
	struct ib_qp_security *shared_qp_sec;
	int ret;

	ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
	if (ret)
	return ret;

	list_for_each_entry(shared_qp_sec,
	&qp_sec->shared_qp_list,
	shared_qp_list) {
	ret = security_ib_pkey_access(shared_qp_sec->security,
	subnet_prefix,
	pkey);
	if (ret)
	return ret;
	}
	return 0;
	}

	/* The caller of this function must hold the QP security
	* mutex of the QP of the security structure in *pps.
	*
	* It takes separate ports_pkeys and security structure
	* because in some cases the pps will be for a new settings
	* or the pps will be for the real QP and security structure
	* will be for a shared QP.
	*/
	static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
	struct ib_qp_security *sec)
	{
	u64 subnet_prefix;
	u16 pkey;
	int ret = 0;

	if (!pps)
	return 0;

	if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
	ret = get_pkey_and_subnet_prefix(&pps->main,
	&pkey,
	&subnet_prefix);
	if (ret)
	return ret;

	ret = enforce_qp_pkey_security(pkey,
	subnet_prefix,
	sec);
	if (ret)
	return ret;
	}

	if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
	ret = get_pkey_and_subnet_prefix(&pps->alt,
	&pkey,
	&subnet_prefix);
	if (ret)
	return ret;

	ret = enforce_qp_pkey_security(pkey,
	subnet_prefix,
	sec);
	}

	return ret;
	}

	/* The caller of this function must hold the QP security
	* mutex.
	*/
	static void qp_to_error(struct ib_qp_security *sec)
	{
	struct ib_qp_security *shared_qp_sec;
	struct ib_qp_attr attr = {
	.qp_state = IB_QPS_ERR
	};
	struct ib_event event = {
	.event = IB_EVENT_QP_FATAL
	};

	/* If the QP is in the process of being destroyed
	* the qp pointer in the security structure is
	* undefined. It cannot be modified now.
	*/
	if (sec->destroying)
	return;

	ib_modify_qp(sec->qp,
	&attr,
	IB_QP_STATE);

	if (sec->qp->event_handler && sec->qp->qp_context) {
	event.element.qp = sec->qp;
	sec->qp->event_handler(&event,
	sec->qp->qp_context);
	}

	list_for_each_entry(shared_qp_sec,
	&sec->shared_qp_list,
	shared_qp_list) {
	struct ib_qp *qp = shared_qp_sec->qp;

	if (qp->event_handler && qp->qp_context) {
	event.element.qp = qp;
	event.device = qp->device;
	qp->event_handler(&event,
	qp->qp_context);
	}
	}
	}

	static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
	struct ib_device *device,
	u32 port_num,
	u64 subnet_prefix)
	{
	struct ib_port_pkey pp, tmp_pp;
	bool comp;
	LIST_HEAD(to_error_list);
	u16 pkey_val;

	if (!ib_get_cached_pkey(device,
	port_num,
	pkey->pkey_index,
	&pkey_val)) {
	spin_lock(&pkey->qp_list_lock);
	list_for_each_entry(pp, &pkey->qp_list, qp_list) {
	if (atomic_read(&pp->sec->error_list_count))
	continue;

	if (enforce_qp_pkey_security(pkey_val,
	subnet_prefix,
	pp->sec)) {
	atomic_inc(&pp->sec->error_list_count);
	list_add(&pp->to_error_list,
	&to_error_list);
	}
	}
	spin_unlock(&pkey->qp_list_lock);
	}

	list_for_each_entry_safe(pp,
	tmp_pp,
	&to_error_list,
	to_error_list) {
	mutex_lock(&pp->sec->mutex);
	qp_to_error(pp->sec);
	list_del(&pp->to_error_list);
	atomic_dec(&pp->sec->error_list_count);
	comp = pp->sec->destroying;
	mutex_unlock(&pp->sec->mutex);

	if (comp)
	complete(&pp->sec->error_complete);
	}
	}

	/* The caller of this function must hold the QP security
	* mutex.
	*/
	static int port_pkey_list_insert(struct ib_port_pkey *pp)
	{
	struct pkey_index_qp_list *tmp_pkey;
	struct pkey_index_qp_list *pkey;
	struct ib_device *dev;
	u32 port_num = pp->port_num;
	int ret = 0;

	if (pp->state != IB_PORT_PKEY_VALID)
	return 0;

	dev = pp->sec->dev;

	pkey = get_pkey_idx_qp_list(pp);

	if (!pkey) {
	bool found = false;

	pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
	if (!pkey)
	return -ENOMEM;

	spin_lock(&dev->port_data[port_num].pkey_list_lock);
	/* Check for the PKey again. A racing process may
	* have created it.
	*/
	list_for_each_entry(tmp_pkey,
	&dev->port_data[port_num].pkey_list,
	pkey_index_list) {
	if (tmp_pkey->pkey_index == pp->pkey_index) {
	kfree(pkey);
	pkey = tmp_pkey;
	found = true;
	break;
	}
	}

	if (!found) {
	pkey->pkey_index = pp->pkey_index;
	spin_lock_init(&pkey->qp_list_lock);
	INIT_LIST_HEAD(&pkey->qp_list);
	list_add(&pkey->pkey_index_list,
	&dev->port_data[port_num].pkey_list);
	}
	spin_unlock(&dev->port_data[port_num].pkey_list_lock);
	}

	spin_lock(&pkey->qp_list_lock);
	list_add(&pp->qp_list, &pkey->qp_list);
	spin_unlock(&pkey->qp_list_lock);

	pp->state = IB_PORT_PKEY_LISTED;

	return ret;
	}

	/* The caller of this function must hold the QP security
	* mutex.
	*/
	static void port_pkey_list_remove(struct ib_port_pkey *pp)
	{
	struct pkey_index_qp_list *pkey;

	if (pp->state != IB_PORT_PKEY_LISTED)
	return;

	pkey = get_pkey_idx_qp_list(pp);

	spin_lock(&pkey->qp_list_lock);
	list_del(&pp->qp_list);
	spin_unlock(&pkey->qp_list_lock);

	/* The setting may still be valid, i.e. after
	* a destroy has failed for example.
	*/
	pp->state = IB_PORT_PKEY_VALID;
	}

	static void destroy_qp_security(struct ib_qp_security *sec)
	{
	security_ib_free_security(sec->security);
	kfree(sec->ports_pkeys);
	kfree(sec);
	}

	/* The caller of this function must hold the QP security
	* mutex.
	*/
	static struct ib_ports_pkeys get_new_pps(const struct ib_qp qp,
	const struct ib_qp_attr *qp_attr,
	int qp_attr_mask)
	{
	struct ib_ports_pkeys *new_pps;
	struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;

	new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
	if (!new_pps)
	return NULL;

	if (qp_attr_mask & IB_QP_PORT)
	new_pps->main.port_num = qp_attr->port_num;
	else if (qp_pps)
	new_pps->main.port_num = qp_pps->main.port_num;

	if (qp_attr_mask & IB_QP_PKEY_INDEX)
	new_pps->main.pkey_index = qp_attr->pkey_index;
	else if (qp_pps)
	new_pps->main.pkey_index = qp_pps->main.pkey_index;

	if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
	(qp_attr_mask & IB_QP_PORT)) \|\|
	(qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
	new_pps->main.state = IB_PORT_PKEY_VALID;

	if (qp_attr_mask & IB_QP_ALT_PATH) {
	new_pps->alt.port_num = qp_attr->alt_port_num;
	new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
	new_pps->alt.state = IB_PORT_PKEY_VALID;
	} else if (qp_pps) {
	new_pps->alt.port_num = qp_pps->alt.port_num;
	new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
	if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
	new_pps->alt.state = IB_PORT_PKEY_VALID;
	}

	new_pps->main.sec = qp->qp_sec;
	new_pps->alt.sec = qp->qp_sec;
	return new_pps;
	}

	int ib_open_shared_qp_security(struct ib_qp qp, struct ib_device dev)
	{
	struct ib_qp *real_qp = qp->real_qp;
	int ret;

	ret = ib_create_qp_security(qp, dev);

	if (ret)
	return ret;

	if (!qp->qp_sec)
	return 0;

	mutex_lock(&real_qp->qp_sec->mutex);
	ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
	qp->qp_sec);

	if (ret)
	goto ret;

	if (qp != real_qp)
	list_add(&qp->qp_sec->shared_qp_list,
	&real_qp->qp_sec->shared_qp_list);
	ret:
	mutex_unlock(&real_qp->qp_sec->mutex);
	if (ret)
	destroy_qp_security(qp->qp_sec);

	return ret;
	}

	void ib_close_shared_qp_security(struct ib_qp_security *sec)
	{
	struct ib_qp *real_qp = sec->qp->real_qp;

	mutex_lock(&real_qp->qp_sec->mutex);
	list_del(&sec->shared_qp_list);
	mutex_unlock(&real_qp->qp_sec->mutex);

	destroy_qp_security(sec);
	}

	int ib_create_qp_security(struct ib_qp qp, struct ib_device dev)
	{
	unsigned int i;
	bool is_ib = false;
	int ret;

	rdma_for_each_port (dev, i) {
	is_ib = rdma_protocol_ib(dev, i);
	if (is_ib)
	break;
	}

	/* If this isn't an IB device don't create the security context */
	if (!is_ib)
	return 0;

	qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
	if (!qp->qp_sec)
	return -ENOMEM;

	qp->qp_sec->qp = qp;
	qp->qp_sec->dev = dev;
	mutex_init(&qp->qp_sec->mutex);
	INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
	atomic_set(&qp->qp_sec->error_list_count, 0);
	init_completion(&qp->qp_sec->error_complete);
	ret = security_ib_alloc_security(&qp->qp_sec->security);
	if (ret) {
	kfree(qp->qp_sec);
	qp->qp_sec = NULL;
	}

	return ret;
	}
	EXPORT_SYMBOL(ib_create_qp_security);

	void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
	{
	/* Return if not IB */
	if (!sec)
	return;

	mutex_lock(&sec->mutex);

	/* Remove the QP from the lists so it won't get added to
	* a to_error_list during the destroy process.
	*/
	if (sec->ports_pkeys) {
	port_pkey_list_remove(&sec->ports_pkeys->main);
	port_pkey_list_remove(&sec->ports_pkeys->alt);
	}

	/* If the QP is already in one or more of those lists
	* the destroying flag will ensure the to error flow
	* doesn't operate on an undefined QP.
	*/
	sec->destroying = true;

	/* Record the error list count to know how many completions
	* to wait for.
	*/
	sec->error_comps_pending = atomic_read(&sec->error_list_count);

	mutex_unlock(&sec->mutex);
	}

	void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
	{
	int ret;
	int i;

	/* Return if not IB */
	if (!sec)
	return;

	/* If a concurrent cache update is in progress this
	* QP security could be marked for an error state
	* transition. Wait for this to complete.
	*/
	for (i = 0; i < sec->error_comps_pending; i++)
	wait_for_completion(&sec->error_complete);

	mutex_lock(&sec->mutex);
	sec->destroying = false;

	/* Restore the position in the lists and verify
	* access is still allowed in case a cache update
	* occurred while attempting to destroy.
	*
	* Because these setting were listed already
	* and removed during ib_destroy_qp_security_begin
	* we know the pkey_index_qp_list for the PKey
	* already exists so port_pkey_list_insert won't fail.
	*/
	if (sec->ports_pkeys) {
	port_pkey_list_insert(&sec->ports_pkeys->main);
	port_pkey_list_insert(&sec->ports_pkeys->alt);
	}

	ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
	if (ret)
	qp_to_error(sec);

	mutex_unlock(&sec->mutex);
	}

	void ib_destroy_qp_security_end(struct ib_qp_security *sec)
	{
	int i;

	/* Return if not IB */
	if (!sec)
	return;

	/* If a concurrent cache update is occurring we must
	* wait until this QP security structure is processed
	* in the QP to error flow before destroying it because
	* the to_error_list is in use.
	*/
	for (i = 0; i < sec->error_comps_pending; i++)
	wait_for_completion(&sec->error_complete);

	destroy_qp_security(sec);
	}

	void ib_security_cache_change(struct ib_device *device,
	u32 port_num,
	u64 subnet_prefix)
	{
	struct pkey_index_qp_list *pkey;

	list_for_each_entry (pkey, &device->port_data[port_num].pkey_list,
	pkey_index_list) {
	check_pkey_qps(pkey,
	device,
	port_num,
	subnet_prefix);
	}
	}

	void ib_security_release_port_pkey_list(struct ib_device *device)
	{
	struct pkey_index_qp_list pkey, tmp_pkey;
	unsigned int i;

	rdma_for_each_port (device, i) {
	list_for_each_entry_safe(pkey,
	tmp_pkey,
	&device->port_data[i].pkey_list,
	pkey_index_list) {
	list_del(&pkey->pkey_index_list);
	kfree(pkey);
	}
	}
	}

	int ib_security_modify_qp(struct ib_qp *qp,
	struct ib_qp_attr *qp_attr,
	int qp_attr_mask,
	struct ib_udata *udata)
	{
	int ret = 0;
	struct ib_ports_pkeys *tmp_pps;
	struct ib_ports_pkeys *new_pps = NULL;
	struct ib_qp *real_qp = qp->real_qp;
	bool special_qp = (real_qp->qp_type == IB_QPT_SMI \|\|
	real_qp->qp_type == IB_QPT_GSI \|\|
	real_qp->qp_type >= IB_QPT_RESERVED1);
	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX \| IB_QP_PORT)) \|\|
	(qp_attr_mask & IB_QP_ALT_PATH));

	WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
	rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
	!real_qp->qp_sec),
	"%s: QP security is not initialized for IB QP: %u\n",
	__func__, real_qp->qp_num);

	/* The port/pkey settings are maintained only for the real QP. Open
	* handles on the real QP will be in the shared_qp_list. When
	* enforcing security on the real QP all the shared QPs will be
	* checked as well.
	*/

	if (pps_change && !special_qp && real_qp->qp_sec) {
	mutex_lock(&real_qp->qp_sec->mutex);
	new_pps = get_new_pps(real_qp,
	qp_attr,
	qp_attr_mask);
	if (!new_pps) {
	mutex_unlock(&real_qp->qp_sec->mutex);
	return -ENOMEM;
	}
	/* Add this QP to the lists for the new port
	* and pkey settings before checking for permission
	* in case there is a concurrent cache update
	* occurring. Walking the list for a cache change
	* doesn't acquire the security mutex unless it's
	* sending the QP to error.
	*/
	ret = port_pkey_list_insert(&new_pps->main);

	if (!ret)
	ret = port_pkey_list_insert(&new_pps->alt);

	if (!ret)
	ret = check_qp_port_pkey_settings(new_pps,
	real_qp->qp_sec);
	}

	if (!ret)
	ret = real_qp->device->ops.modify_qp(real_qp,
	qp_attr,
	qp_attr_mask,
	udata);

	if (new_pps) {
	/* Clean up the lists and free the appropriate
	* ports_pkeys structure.
	*/
	if (ret) {
	tmp_pps = new_pps;
	} else {
	tmp_pps = real_qp->qp_sec->ports_pkeys;
	real_qp->qp_sec->ports_pkeys = new_pps;
	}

	if (tmp_pps) {
	port_pkey_list_remove(&tmp_pps->main);
	port_pkey_list_remove(&tmp_pps->alt);
	}
	kfree(tmp_pps);
	mutex_unlock(&real_qp->qp_sec->mutex);
	}
	return ret;
	}

	static int ib_security_pkey_access(struct ib_device *dev,
	u32 port_num,
	u16 pkey_index,
	void *sec)
	{
	u64 subnet_prefix;
	u16 pkey;
	int ret;

	if (!rdma_protocol_ib(dev, port_num))
	return 0;

	ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
	if (ret)
	return ret;

	ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);

	return security_ib_pkey_access(sec, subnet_prefix, pkey);
	}

	void ib_mad_agent_security_change(void)
	{
	struct ib_mad_agent *ag;

	spin_lock(&mad_agent_list_lock);
	list_for_each_entry(ag,
	&mad_agent_list,
	mad_agent_sec_list)
	WRITE_ONCE(ag->smp_allowed,
	!security_ib_endport_manage_subnet(ag->security,
	dev_name(&ag->device->dev), ag->port_num));
	spin_unlock(&mad_agent_list_lock);
	}

	int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
	enum ib_qp_type qp_type)
	{
	int ret;

	if (!rdma_protocol_ib(agent->device, agent->port_num))
	return 0;

	INIT_LIST_HEAD(&agent->mad_agent_sec_list);

	ret = security_ib_alloc_security(&agent->security);
	if (ret)
	return ret;

	if (qp_type != IB_QPT_SMI)
	return 0;

	spin_lock(&mad_agent_list_lock);
	ret = security_ib_endport_manage_subnet(agent->security,
	dev_name(&agent->device->dev),
	agent->port_num);
	if (ret)
	goto free_security;

	WRITE_ONCE(agent->smp_allowed, true);
	list_add(&agent->mad_agent_sec_list, &mad_agent_list);
	spin_unlock(&mad_agent_list_lock);
	return 0;

	free_security:
	spin_unlock(&mad_agent_list_lock);
	security_ib_free_security(agent->security);
	return ret;
	}

	void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
	{
	if (!rdma_protocol_ib(agent->device, agent->port_num))
	return;

	if (agent->qp->qp_type == IB_QPT_SMI) {
	spin_lock(&mad_agent_list_lock);
	list_del(&agent->mad_agent_sec_list);
	spin_unlock(&mad_agent_list_lock);
	}

	security_ib_free_security(agent->security);
	}

	int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
	{
	if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
	return 0;

	if (map->agent.qp->qp_type == IB_QPT_SMI) {
	if (!READ_ONCE(map->agent.smp_allowed))
	return -EACCES;
	return 0;
	}

	return ib_security_pkey_access(map->agent.device,
	map->agent.port_num,
	pkey_index,
	map->agent.security);
	}