GNU Linux-libre 4.14.259-gnu1
[releases.git] / drivers / infiniband / core / security.c
1 /*
2  * Copyright (c) 2016 Mellanox Technologies Ltd.  All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  */
32
33 #ifdef CONFIG_SECURITY_INFINIBAND
34
35 #include <linux/security.h>
36 #include <linux/completion.h>
37 #include <linux/list.h>
38
39 #include <rdma/ib_verbs.h>
40 #include <rdma/ib_cache.h>
41 #include "core_priv.h"
42 #include "mad_priv.h"
43
44 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp)
45 {
46         struct pkey_index_qp_list *pkey = NULL;
47         struct pkey_index_qp_list *tmp_pkey;
48         struct ib_device *dev = pp->sec->dev;
49
50         spin_lock(&dev->port_pkey_list[pp->port_num].list_lock);
51         list_for_each_entry(tmp_pkey,
52                             &dev->port_pkey_list[pp->port_num].pkey_list,
53                             pkey_index_list) {
54                 if (tmp_pkey->pkey_index == pp->pkey_index) {
55                         pkey = tmp_pkey;
56                         break;
57                 }
58         }
59         spin_unlock(&dev->port_pkey_list[pp->port_num].list_lock);
60         return pkey;
61 }
62
63 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp,
64                                       u16 *pkey,
65                                       u64 *subnet_prefix)
66 {
67         struct ib_device *dev = pp->sec->dev;
68         int ret;
69
70         ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey);
71         if (ret)
72                 return ret;
73
74         ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix);
75
76         return ret;
77 }
78
79 static int enforce_qp_pkey_security(u16 pkey,
80                                     u64 subnet_prefix,
81                                     struct ib_qp_security *qp_sec)
82 {
83         struct ib_qp_security *shared_qp_sec;
84         int ret;
85
86         ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey);
87         if (ret)
88                 return ret;
89
90         list_for_each_entry(shared_qp_sec,
91                             &qp_sec->shared_qp_list,
92                             shared_qp_list) {
93                 ret = security_ib_pkey_access(shared_qp_sec->security,
94                                               subnet_prefix,
95                                               pkey);
96                 if (ret)
97                         return ret;
98         }
99         return 0;
100 }
101
102 /* The caller of this function must hold the QP security
103  * mutex of the QP of the security structure in *pps.
104  *
105  * It takes separate ports_pkeys and security structure
106  * because in some cases the pps will be for a new settings
107  * or the pps will be for the real QP and security structure
108  * will be for a shared QP.
109  */
110 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps,
111                                        struct ib_qp_security *sec)
112 {
113         u64 subnet_prefix;
114         u16 pkey;
115         int ret = 0;
116
117         if (!pps)
118                 return 0;
119
120         if (pps->main.state != IB_PORT_PKEY_NOT_VALID) {
121                 ret = get_pkey_and_subnet_prefix(&pps->main,
122                                                  &pkey,
123                                                  &subnet_prefix);
124                 if (ret)
125                         return ret;
126
127                 ret = enforce_qp_pkey_security(pkey,
128                                                subnet_prefix,
129                                                sec);
130                 if (ret)
131                         return ret;
132         }
133
134         if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) {
135                 ret = get_pkey_and_subnet_prefix(&pps->alt,
136                                                  &pkey,
137                                                  &subnet_prefix);
138                 if (ret)
139                         return ret;
140
141                 ret = enforce_qp_pkey_security(pkey,
142                                                subnet_prefix,
143                                                sec);
144         }
145
146         return ret;
147 }
148
149 /* The caller of this function must hold the QP security
150  * mutex.
151  */
152 static void qp_to_error(struct ib_qp_security *sec)
153 {
154         struct ib_qp_security *shared_qp_sec;
155         struct ib_qp_attr attr = {
156                 .qp_state = IB_QPS_ERR
157         };
158         struct ib_event event = {
159                 .event = IB_EVENT_QP_FATAL
160         };
161
162         /* If the QP is in the process of being destroyed
163          * the qp pointer in the security structure is
164          * undefined.  It cannot be modified now.
165          */
166         if (sec->destroying)
167                 return;
168
169         ib_modify_qp(sec->qp,
170                      &attr,
171                      IB_QP_STATE);
172
173         if (sec->qp->event_handler && sec->qp->qp_context) {
174                 event.element.qp = sec->qp;
175                 sec->qp->event_handler(&event,
176                                        sec->qp->qp_context);
177         }
178
179         list_for_each_entry(shared_qp_sec,
180                             &sec->shared_qp_list,
181                             shared_qp_list) {
182                 struct ib_qp *qp = shared_qp_sec->qp;
183
184                 if (qp->event_handler && qp->qp_context) {
185                         event.element.qp = qp;
186                         event.device = qp->device;
187                         qp->event_handler(&event,
188                                           qp->qp_context);
189                 }
190         }
191 }
192
193 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey,
194                                   struct ib_device *device,
195                                   u8 port_num,
196                                   u64 subnet_prefix)
197 {
198         struct ib_port_pkey *pp, *tmp_pp;
199         bool comp;
200         LIST_HEAD(to_error_list);
201         u16 pkey_val;
202
203         if (!ib_get_cached_pkey(device,
204                                 port_num,
205                                 pkey->pkey_index,
206                                 &pkey_val)) {
207                 spin_lock(&pkey->qp_list_lock);
208                 list_for_each_entry(pp, &pkey->qp_list, qp_list) {
209                         if (atomic_read(&pp->sec->error_list_count))
210                                 continue;
211
212                         if (enforce_qp_pkey_security(pkey_val,
213                                                      subnet_prefix,
214                                                      pp->sec)) {
215                                 atomic_inc(&pp->sec->error_list_count);
216                                 list_add(&pp->to_error_list,
217                                          &to_error_list);
218                         }
219                 }
220                 spin_unlock(&pkey->qp_list_lock);
221         }
222
223         list_for_each_entry_safe(pp,
224                                  tmp_pp,
225                                  &to_error_list,
226                                  to_error_list) {
227                 mutex_lock(&pp->sec->mutex);
228                 qp_to_error(pp->sec);
229                 list_del(&pp->to_error_list);
230                 atomic_dec(&pp->sec->error_list_count);
231                 comp = pp->sec->destroying;
232                 mutex_unlock(&pp->sec->mutex);
233
234                 if (comp)
235                         complete(&pp->sec->error_complete);
236         }
237 }
238
239 /* The caller of this function must hold the QP security
240  * mutex.
241  */
242 static int port_pkey_list_insert(struct ib_port_pkey *pp)
243 {
244         struct pkey_index_qp_list *tmp_pkey;
245         struct pkey_index_qp_list *pkey;
246         struct ib_device *dev;
247         u8 port_num = pp->port_num;
248         int ret = 0;
249
250         if (pp->state != IB_PORT_PKEY_VALID)
251                 return 0;
252
253         dev = pp->sec->dev;
254
255         pkey = get_pkey_idx_qp_list(pp);
256
257         if (!pkey) {
258                 bool found = false;
259
260                 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL);
261                 if (!pkey)
262                         return -ENOMEM;
263
264                 spin_lock(&dev->port_pkey_list[port_num].list_lock);
265                 /* Check for the PKey again.  A racing process may
266                  * have created it.
267                  */
268                 list_for_each_entry(tmp_pkey,
269                                     &dev->port_pkey_list[port_num].pkey_list,
270                                     pkey_index_list) {
271                         if (tmp_pkey->pkey_index == pp->pkey_index) {
272                                 kfree(pkey);
273                                 pkey = tmp_pkey;
274                                 found = true;
275                                 break;
276                         }
277                 }
278
279                 if (!found) {
280                         pkey->pkey_index = pp->pkey_index;
281                         spin_lock_init(&pkey->qp_list_lock);
282                         INIT_LIST_HEAD(&pkey->qp_list);
283                         list_add(&pkey->pkey_index_list,
284                                  &dev->port_pkey_list[port_num].pkey_list);
285                 }
286                 spin_unlock(&dev->port_pkey_list[port_num].list_lock);
287         }
288
289         spin_lock(&pkey->qp_list_lock);
290         list_add(&pp->qp_list, &pkey->qp_list);
291         spin_unlock(&pkey->qp_list_lock);
292
293         pp->state = IB_PORT_PKEY_LISTED;
294
295         return ret;
296 }
297
298 /* The caller of this function must hold the QP security
299  * mutex.
300  */
301 static void port_pkey_list_remove(struct ib_port_pkey *pp)
302 {
303         struct pkey_index_qp_list *pkey;
304
305         if (pp->state != IB_PORT_PKEY_LISTED)
306                 return;
307
308         pkey = get_pkey_idx_qp_list(pp);
309
310         spin_lock(&pkey->qp_list_lock);
311         list_del(&pp->qp_list);
312         spin_unlock(&pkey->qp_list_lock);
313
314         /* The setting may still be valid, i.e. after
315          * a destroy has failed for example.
316          */
317         pp->state = IB_PORT_PKEY_VALID;
318 }
319
320 static void destroy_qp_security(struct ib_qp_security *sec)
321 {
322         security_ib_free_security(sec->security);
323         kfree(sec->ports_pkeys);
324         kfree(sec);
325 }
326
327 /* The caller of this function must hold the QP security
328  * mutex.
329  */
330 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
331                                           const struct ib_qp_attr *qp_attr,
332                                           int qp_attr_mask)
333 {
334         struct ib_ports_pkeys *new_pps;
335         struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys;
336
337         new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL);
338         if (!new_pps)
339                 return NULL;
340
341         if (qp_attr_mask & IB_QP_PORT)
342                 new_pps->main.port_num = qp_attr->port_num;
343         else if (qp_pps)
344                 new_pps->main.port_num = qp_pps->main.port_num;
345
346         if (qp_attr_mask & IB_QP_PKEY_INDEX)
347                 new_pps->main.pkey_index = qp_attr->pkey_index;
348         else if (qp_pps)
349                 new_pps->main.pkey_index = qp_pps->main.pkey_index;
350
351         if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
352              (qp_attr_mask & IB_QP_PORT)) ||
353             (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
354                 new_pps->main.state = IB_PORT_PKEY_VALID;
355
356         if (qp_attr_mask & IB_QP_ALT_PATH) {
357                 new_pps->alt.port_num = qp_attr->alt_port_num;
358                 new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
359                 new_pps->alt.state = IB_PORT_PKEY_VALID;
360         } else if (qp_pps) {
361                 new_pps->alt.port_num = qp_pps->alt.port_num;
362                 new_pps->alt.pkey_index = qp_pps->alt.pkey_index;
363                 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID)
364                         new_pps->alt.state = IB_PORT_PKEY_VALID;
365         }
366
367         new_pps->main.sec = qp->qp_sec;
368         new_pps->alt.sec = qp->qp_sec;
369         return new_pps;
370 }
371
372 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev)
373 {
374         struct ib_qp *real_qp = qp->real_qp;
375         int ret;
376
377         ret = ib_create_qp_security(qp, dev);
378
379         if (ret)
380                 return ret;
381
382         if (!qp->qp_sec)
383                 return 0;
384
385         mutex_lock(&real_qp->qp_sec->mutex);
386         ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys,
387                                           qp->qp_sec);
388
389         if (ret)
390                 goto ret;
391
392         if (qp != real_qp)
393                 list_add(&qp->qp_sec->shared_qp_list,
394                          &real_qp->qp_sec->shared_qp_list);
395 ret:
396         mutex_unlock(&real_qp->qp_sec->mutex);
397         if (ret)
398                 destroy_qp_security(qp->qp_sec);
399
400         return ret;
401 }
402
403 void ib_close_shared_qp_security(struct ib_qp_security *sec)
404 {
405         struct ib_qp *real_qp = sec->qp->real_qp;
406
407         mutex_lock(&real_qp->qp_sec->mutex);
408         list_del(&sec->shared_qp_list);
409         mutex_unlock(&real_qp->qp_sec->mutex);
410
411         destroy_qp_security(sec);
412 }
413
414 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
415 {
416         u8 i = rdma_start_port(dev);
417         bool is_ib = false;
418         int ret;
419
420         while (i <= rdma_end_port(dev) && !is_ib)
421                 is_ib = rdma_protocol_ib(dev, i++);
422
423         /* If this isn't an IB device don't create the security context */
424         if (!is_ib)
425                 return 0;
426
427         qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL);
428         if (!qp->qp_sec)
429                 return -ENOMEM;
430
431         qp->qp_sec->qp = qp;
432         qp->qp_sec->dev = dev;
433         mutex_init(&qp->qp_sec->mutex);
434         INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list);
435         atomic_set(&qp->qp_sec->error_list_count, 0);
436         init_completion(&qp->qp_sec->error_complete);
437         ret = security_ib_alloc_security(&qp->qp_sec->security);
438         if (ret) {
439                 kfree(qp->qp_sec);
440                 qp->qp_sec = NULL;
441         }
442
443         return ret;
444 }
445 EXPORT_SYMBOL(ib_create_qp_security);
446
447 void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
448 {
449         /* Return if not IB */
450         if (!sec)
451                 return;
452
453         mutex_lock(&sec->mutex);
454
455         /* Remove the QP from the lists so it won't get added to
456          * a to_error_list during the destroy process.
457          */
458         if (sec->ports_pkeys) {
459                 port_pkey_list_remove(&sec->ports_pkeys->main);
460                 port_pkey_list_remove(&sec->ports_pkeys->alt);
461         }
462
463         /* If the QP is already in one or more of those lists
464          * the destroying flag will ensure the to error flow
465          * doesn't operate on an undefined QP.
466          */
467         sec->destroying = true;
468
469         /* Record the error list count to know how many completions
470          * to wait for.
471          */
472         sec->error_comps_pending = atomic_read(&sec->error_list_count);
473
474         mutex_unlock(&sec->mutex);
475 }
476
477 void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
478 {
479         int ret;
480         int i;
481
482         /* Return if not IB */
483         if (!sec)
484                 return;
485
486         /* If a concurrent cache update is in progress this
487          * QP security could be marked for an error state
488          * transition.  Wait for this to complete.
489          */
490         for (i = 0; i < sec->error_comps_pending; i++)
491                 wait_for_completion(&sec->error_complete);
492
493         mutex_lock(&sec->mutex);
494         sec->destroying = false;
495
496         /* Restore the position in the lists and verify
497          * access is still allowed in case a cache update
498          * occurred while attempting to destroy.
499          *
500          * Because these setting were listed already
501          * and removed during ib_destroy_qp_security_begin
502          * we know the pkey_index_qp_list for the PKey
503          * already exists so port_pkey_list_insert won't fail.
504          */
505         if (sec->ports_pkeys) {
506                 port_pkey_list_insert(&sec->ports_pkeys->main);
507                 port_pkey_list_insert(&sec->ports_pkeys->alt);
508         }
509
510         ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec);
511         if (ret)
512                 qp_to_error(sec);
513
514         mutex_unlock(&sec->mutex);
515 }
516
517 void ib_destroy_qp_security_end(struct ib_qp_security *sec)
518 {
519         int i;
520
521         /* Return if not IB */
522         if (!sec)
523                 return;
524
525         /* If a concurrent cache update is occurring we must
526          * wait until this QP security structure is processed
527          * in the QP to error flow before destroying it because
528          * the to_error_list is in use.
529          */
530         for (i = 0; i < sec->error_comps_pending; i++)
531                 wait_for_completion(&sec->error_complete);
532
533         destroy_qp_security(sec);
534 }
535
536 void ib_security_cache_change(struct ib_device *device,
537                               u8 port_num,
538                               u64 subnet_prefix)
539 {
540         struct pkey_index_qp_list *pkey;
541
542         list_for_each_entry(pkey,
543                             &device->port_pkey_list[port_num].pkey_list,
544                             pkey_index_list) {
545                 check_pkey_qps(pkey,
546                                device,
547                                port_num,
548                                subnet_prefix);
549         }
550 }
551
552 void ib_security_destroy_port_pkey_list(struct ib_device *device)
553 {
554         struct pkey_index_qp_list *pkey, *tmp_pkey;
555         int i;
556
557         for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
558                 spin_lock(&device->port_pkey_list[i].list_lock);
559                 list_for_each_entry_safe(pkey,
560                                          tmp_pkey,
561                                          &device->port_pkey_list[i].pkey_list,
562                                          pkey_index_list) {
563                         list_del(&pkey->pkey_index_list);
564                         kfree(pkey);
565                 }
566                 spin_unlock(&device->port_pkey_list[i].list_lock);
567         }
568 }
569
570 int ib_security_modify_qp(struct ib_qp *qp,
571                           struct ib_qp_attr *qp_attr,
572                           int qp_attr_mask,
573                           struct ib_udata *udata)
574 {
575         int ret = 0;
576         struct ib_ports_pkeys *tmp_pps;
577         struct ib_ports_pkeys *new_pps = NULL;
578         struct ib_qp *real_qp = qp->real_qp;
579         bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
580                            real_qp->qp_type == IB_QPT_GSI ||
581                            real_qp->qp_type >= IB_QPT_RESERVED1);
582         bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
583                            (qp_attr_mask & IB_QP_ALT_PATH));
584
585         WARN_ONCE((qp_attr_mask & IB_QP_PORT &&
586                    rdma_protocol_ib(real_qp->device, qp_attr->port_num) &&
587                    !real_qp->qp_sec),
588                    "%s: QP security is not initialized for IB QP: %d\n",
589                    __func__, real_qp->qp_num);
590
591         /* The port/pkey settings are maintained only for the real QP. Open
592          * handles on the real QP will be in the shared_qp_list. When
593          * enforcing security on the real QP all the shared QPs will be
594          * checked as well.
595          */
596
597         if (pps_change && !special_qp && real_qp->qp_sec) {
598                 mutex_lock(&real_qp->qp_sec->mutex);
599                 new_pps = get_new_pps(real_qp,
600                                       qp_attr,
601                                       qp_attr_mask);
602                 if (!new_pps) {
603                         mutex_unlock(&real_qp->qp_sec->mutex);
604                         return -ENOMEM;
605                 }
606                 /* Add this QP to the lists for the new port
607                  * and pkey settings before checking for permission
608                  * in case there is a concurrent cache update
609                  * occurring.  Walking the list for a cache change
610                  * doesn't acquire the security mutex unless it's
611                  * sending the QP to error.
612                  */
613                 ret = port_pkey_list_insert(&new_pps->main);
614
615                 if (!ret)
616                         ret = port_pkey_list_insert(&new_pps->alt);
617
618                 if (!ret)
619                         ret = check_qp_port_pkey_settings(new_pps,
620                                                           real_qp->qp_sec);
621         }
622
623         if (!ret)
624                 ret = real_qp->device->modify_qp(real_qp,
625                                                  qp_attr,
626                                                  qp_attr_mask,
627                                                  udata);
628
629         if (new_pps) {
630                 /* Clean up the lists and free the appropriate
631                  * ports_pkeys structure.
632                  */
633                 if (ret) {
634                         tmp_pps = new_pps;
635                 } else {
636                         tmp_pps = real_qp->qp_sec->ports_pkeys;
637                         real_qp->qp_sec->ports_pkeys = new_pps;
638                 }
639
640                 if (tmp_pps) {
641                         port_pkey_list_remove(&tmp_pps->main);
642                         port_pkey_list_remove(&tmp_pps->alt);
643                 }
644                 kfree(tmp_pps);
645                 mutex_unlock(&real_qp->qp_sec->mutex);
646         }
647         return ret;
648 }
649 EXPORT_SYMBOL(ib_security_modify_qp);
650
651 int ib_security_pkey_access(struct ib_device *dev,
652                             u8 port_num,
653                             u16 pkey_index,
654                             void *sec)
655 {
656         u64 subnet_prefix;
657         u16 pkey;
658         int ret;
659
660         if (!rdma_protocol_ib(dev, port_num))
661                 return 0;
662
663         ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey);
664         if (ret)
665                 return ret;
666
667         ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix);
668
669         if (ret)
670                 return ret;
671
672         return security_ib_pkey_access(sec, subnet_prefix, pkey);
673 }
674 EXPORT_SYMBOL(ib_security_pkey_access);
675
676 static int ib_mad_agent_security_change(struct notifier_block *nb,
677                                         unsigned long event,
678                                         void *data)
679 {
680         struct ib_mad_agent *ag = container_of(nb, struct ib_mad_agent, lsm_nb);
681
682         if (event != LSM_POLICY_CHANGE)
683                 return NOTIFY_DONE;
684
685         ag->smp_allowed = !security_ib_endport_manage_subnet(ag->security,
686                                                              ag->device->name,
687                                                              ag->port_num);
688
689         return NOTIFY_OK;
690 }
691
692 int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
693                                 enum ib_qp_type qp_type)
694 {
695         int ret;
696
697         if (!rdma_protocol_ib(agent->device, agent->port_num))
698                 return 0;
699
700         ret = security_ib_alloc_security(&agent->security);
701         if (ret)
702                 return ret;
703
704         if (qp_type != IB_QPT_SMI)
705                 return 0;
706
707         ret = security_ib_endport_manage_subnet(agent->security,
708                                                 agent->device->name,
709                                                 agent->port_num);
710         if (ret)
711                 goto free_security;
712
713         agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
714         ret = register_lsm_notifier(&agent->lsm_nb);
715         if (ret)
716                 goto free_security;
717
718         agent->smp_allowed = true;
719         agent->lsm_nb_reg = true;
720         return 0;
721
722 free_security:
723         security_ib_free_security(agent->security);
724         return ret;
725 }
726
727 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
728 {
729         if (!rdma_protocol_ib(agent->device, agent->port_num))
730                 return;
731
732         if (agent->lsm_nb_reg)
733                 unregister_lsm_notifier(&agent->lsm_nb);
734
735         security_ib_free_security(agent->security);
736 }
737
738 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
739 {
740         if (!rdma_protocol_ib(map->agent.device, map->agent.port_num))
741                 return 0;
742
743         if (map->agent.qp->qp_type == IB_QPT_SMI) {
744                 if (!map->agent.smp_allowed)
745                         return -EACCES;
746                 return 0;
747         }
748
749         return ib_security_pkey_access(map->agent.device,
750                                        map->agent.port_num,
751                                        pkey_index,
752                                        map->agent.security);
753 }
754
755 #endif /* CONFIG_SECURITY_INFINIBAND */