From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Jurgens Subject: [PATCH v6 1/9] IB/core: IB cache enhancements to support Infiniband security Date: Wed, 23 Nov 2016 16:17:23 +0200 Message-ID: <1479910651-43246-2-git-send-email-danielj@mellanox.com> References: <1479910651-43246-1-git-send-email-danielj@mellanox.com> Return-path: In-Reply-To: <1479910651-43246-1-git-send-email-danielj-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org> Sender: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: chrisw-69jw2NvuJkxg9hUCZPvPmw@public.gmane.org, paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org, sds-+05T5uksL2qpZYMLLGbcSA@public.gmane.org, eparis-FjpueFixGhCM4zKIHC2jIg@public.gmane.org, dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org, hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org Cc: selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, yevgenyp-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org, Daniel Jurgens List-Id: linux-rdma@vger.kernel.org From: Daniel Jurgens Cache the subnet prefix and add a function to access it. Enforcing security requires frequent queries of the subnet prefix and the pkeys in the pkey table. Also removed an unneded pr_warn about memory allocation failure. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen Reviewed-by: Leon Romanovsky --- v2: - In ib_get_cached_subnet_prefix wait to initialize p until after validation. Yuval Shaia --- drivers/infiniband/core/cache.c | 36 ++++++++++++++++++++++++++++++++++-- drivers/infiniband/core/core_priv.h | 3 +++ include/rdma/ib_verbs.h | 1 + 3 files changed, 38 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c index 1a2984c..affc8ef 100644 --- a/drivers/infiniband/core/cache.c +++ b/drivers/infiniband/core/cache.c @@ -934,6 +934,26 @@ int ib_get_cached_pkey(struct ib_device *device, } EXPORT_SYMBOL(ib_get_cached_pkey); +int ib_get_cached_subnet_prefix(struct ib_device *device, + u8 port_num, + u64 *sn_pfx) +{ + unsigned long flags; + int p; + + if (port_num < rdma_start_port(device) || + port_num > rdma_end_port(device)) + return -EINVAL; + + p = port_num - rdma_start_port(device); + read_lock_irqsave(&device->cache.lock, flags); + *sn_pfx = device->cache.subnet_prefix_cache[p]; + read_unlock_irqrestore(&device->cache.lock, flags); + + return 0; +} +EXPORT_SYMBOL(ib_get_cached_subnet_prefix); + int ib_find_cached_pkey(struct ib_device *device, u8 port_num, u16 pkey, @@ -1110,6 +1130,8 @@ static void ib_cache_update(struct ib_device *device, device->cache.lmc_cache[port - rdma_start_port(device)] = tprops->lmc; + device->cache.subnet_prefix_cache[port - rdma_start_port(device)] = + tprops->subnet_prefix; write_unlock_irq(&device->cache.lock); kfree(gid_cache); @@ -1168,9 +1190,18 @@ int ib_cache_setup_one(struct ib_device *device) (rdma_end_port(device) - rdma_start_port(device) + 1), GFP_KERNEL); + + device->cache.subnet_prefix_cache = + kcalloc((rdma_end_port(device) - rdma_start_port(device) + 1), + sizeof(*device->cache.subnet_prefix_cache), + GFP_KERNEL); + if (!device->cache.pkey_cache || - !device->cache.lmc_cache) { - pr_warn("Couldn't allocate cache for %s\n", device->name); + !device->cache.lmc_cache || + !device->cache.subnet_prefix_cache) { + kfree(device->cache.pkey_cache); + kfree(device->cache.lmc_cache); + kfree(device->cache.subnet_prefix_cache); return -ENOMEM; } @@ -1213,6 +1244,7 @@ void ib_cache_release_one(struct ib_device *device) gid_table_release_one(device); kfree(device->cache.pkey_cache); kfree(device->cache.lmc_cache); + kfree(device->cache.subnet_prefix_cache); } void ib_cache_cleanup_one(struct ib_device *device) diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h index 19d499d..ce826e4 100644 --- a/drivers/infiniband/core/core_priv.h +++ b/drivers/infiniband/core/core_priv.h @@ -153,4 +153,7 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, int ib_nl_handle_ip_res_resp(struct sk_buff *skb, struct netlink_callback *cb); +int ib_get_cached_subnet_prefix(struct ib_device *device, + u8 port_num, + u64 *sn_pfx); #endif /* _CORE_PRIV_H */ diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 5ad43a4..db178fd 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1761,6 +1761,7 @@ struct ib_cache { struct ib_pkey_cache **pkey_cache; struct ib_gid_table **gid_cache; u8 *lmc_cache; + u64 *subnet_prefix_cache; }; struct ib_dma_mapping_ops { -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id uANEHvQi020006 for ; Wed, 23 Nov 2016 09:18:00 -0500 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Cc: selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, linux-rdma@vger.kernel.org, yevgenyp@mellanox.com, Daniel Jurgens Subject: [PATCH v6 1/9] IB/core: IB cache enhancements to support Infiniband security Date: Wed, 23 Nov 2016 16:17:23 +0200 Message-Id: <1479910651-43246-2-git-send-email-danielj@mellanox.com> In-Reply-To: <1479910651-43246-1-git-send-email-danielj@mellanox.com> References: <1479910651-43246-1-git-send-email-danielj@mellanox.com> List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: From: Daniel Jurgens Cache the subnet prefix and add a function to access it. Enforcing security requires frequent queries of the subnet prefix and the pkeys in the pkey table. Also removed an unneded pr_warn about memory allocation failure. Signed-off-by: Daniel Jurgens Reviewed-by: Eli Cohen Reviewed-by: Leon Romanovsky --- v2: - In ib_get_cached_subnet_prefix wait to initialize p until after validation. Yuval Shaia --- drivers/infiniband/core/cache.c | 36 ++++++++++++++++++++++++++++++++++-- drivers/infiniband/core/core_priv.h | 3 +++ include/rdma/ib_verbs.h | 1 + 3 files changed, 38 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c index 1a2984c..affc8ef 100644 --- a/drivers/infiniband/core/cache.c +++ b/drivers/infiniband/core/cache.c @@ -934,6 +934,26 @@ int ib_get_cached_pkey(struct ib_device *device, } EXPORT_SYMBOL(ib_get_cached_pkey); +int ib_get_cached_subnet_prefix(struct ib_device *device, + u8 port_num, + u64 *sn_pfx) +{ + unsigned long flags; + int p; + + if (port_num < rdma_start_port(device) || + port_num > rdma_end_port(device)) + return -EINVAL; + + p = port_num - rdma_start_port(device); + read_lock_irqsave(&device->cache.lock, flags); + *sn_pfx = device->cache.subnet_prefix_cache[p]; + read_unlock_irqrestore(&device->cache.lock, flags); + + return 0; +} +EXPORT_SYMBOL(ib_get_cached_subnet_prefix); + int ib_find_cached_pkey(struct ib_device *device, u8 port_num, u16 pkey, @@ -1110,6 +1130,8 @@ static void ib_cache_update(struct ib_device *device, device->cache.lmc_cache[port - rdma_start_port(device)] = tprops->lmc; + device->cache.subnet_prefix_cache[port - rdma_start_port(device)] = + tprops->subnet_prefix; write_unlock_irq(&device->cache.lock); kfree(gid_cache); @@ -1168,9 +1190,18 @@ int ib_cache_setup_one(struct ib_device *device) (rdma_end_port(device) - rdma_start_port(device) + 1), GFP_KERNEL); + + device->cache.subnet_prefix_cache = + kcalloc((rdma_end_port(device) - rdma_start_port(device) + 1), + sizeof(*device->cache.subnet_prefix_cache), + GFP_KERNEL); + if (!device->cache.pkey_cache || - !device->cache.lmc_cache) { - pr_warn("Couldn't allocate cache for %s\n", device->name); + !device->cache.lmc_cache || + !device->cache.subnet_prefix_cache) { + kfree(device->cache.pkey_cache); + kfree(device->cache.lmc_cache); + kfree(device->cache.subnet_prefix_cache); return -ENOMEM; } @@ -1213,6 +1244,7 @@ void ib_cache_release_one(struct ib_device *device) gid_table_release_one(device); kfree(device->cache.pkey_cache); kfree(device->cache.lmc_cache); + kfree(device->cache.subnet_prefix_cache); } void ib_cache_cleanup_one(struct ib_device *device) diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h index 19d499d..ce826e4 100644 --- a/drivers/infiniband/core/core_priv.h +++ b/drivers/infiniband/core/core_priv.h @@ -153,4 +153,7 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, int ib_nl_handle_ip_res_resp(struct sk_buff *skb, struct netlink_callback *cb); +int ib_get_cached_subnet_prefix(struct ib_device *device, + u8 port_num, + u64 *sn_pfx); #endif /* _CORE_PRIV_H */ diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 5ad43a4..db178fd 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1761,6 +1761,7 @@ struct ib_cache { struct ib_pkey_cache **pkey_cache; struct ib_gid_table **gid_cache; u8 *lmc_cache; + u64 *subnet_prefix_cache; }; struct ib_dma_mapping_ops { -- 2.7.4