drivers/infiniband/core/uverbs_ioctl.c

   1 /*
   2  * Copyright (c) 2017, Mellanox Technologies inc.  All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  */
  32
  33 #include <rdma/rdma_user_ioctl.h>
  34 #include <rdma/uverbs_ioctl.h>
  35 #include "rdma_core.h"
  36 #include "uverbs.h"
  37
  38 struct bundle_alloc_head {
  39         struct bundle_alloc_head *next;
  40         u8 data[];
  41 };
  42
  43 struct bundle_priv {
  44         /* Must be first */
  45         struct bundle_alloc_head alloc_head;
  46         struct bundle_alloc_head *allocated_mem;
  47         size_t internal_avail;
  48         size_t internal_used;
  49
  50         struct radix_tree_root *radix;
  51         const struct uverbs_api_ioctl_method *method_elm;
  52         void __rcu **radix_slots;
  53         unsigned long radix_slots_len;
  54         u32 method_key;
  55
  56         struct ib_uverbs_attr __user *user_attrs;
  57         struct ib_uverbs_attr *uattrs;
  58
  59         DECLARE_BITMAP(uobj_finalize, UVERBS_API_ATTR_BKEY_LEN);
  60         DECLARE_BITMAP(spec_finalize, UVERBS_API_ATTR_BKEY_LEN);
  61
  62         /*
  63          * Must be last. bundle ends in a flex array which overlaps
  64          * internal_buffer.
  65          */
  66         struct uverbs_attr_bundle bundle;
  67         u64 internal_buffer[32];
  68 };
  69
  70 /*
  71  * Each method has an absolute minimum amount of memory it needs to allocate,
  72  * precompute that amount and determine if the onstack memory can be used or
  73  * if allocation is need.
  74  */
  75 void uapi_compute_bundle_size(struct uverbs_api_ioctl_method *method_elm,
  76                               unsigned int num_attrs)
  77 {
  78         struct bundle_priv *pbundle;
  79         size_t bundle_size =
  80                 offsetof(struct bundle_priv, internal_buffer) +
  81                 sizeof(*pbundle->bundle.attrs) * method_elm->key_bitmap_len +
  82                 sizeof(*pbundle->uattrs) * num_attrs;
  83
  84         method_elm->use_stack = bundle_size <= sizeof(*pbundle);
  85         method_elm->bundle_size =
  86                 ALIGN(bundle_size + 256, sizeof(*pbundle->internal_buffer));
  87
  88         /* Do not want order-2 allocations for this. */
  89         WARN_ON_ONCE(method_elm->bundle_size > PAGE_SIZE);
  90 }
  91
  92 /**
  93  * uverbs_alloc() - Quickly allocate memory for use with a bundle
  94  * @bundle: The bundle
  95  * @size: Number of bytes to allocate
  96  * @flags: Allocator flags
  97  *
  98  * The bundle allocator is intended for allocations that are connected with
  99  * processing the system call related to the bundle. The allocated memory is
 100  * always freed once the system call completes, and cannot be freed any other
 101  * way.
 102  *
 103  * This tries to use a small pool of pre-allocated memory for performance.
 104  */
 105 __malloc void *_uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size,
 106                              gfp_t flags)
 107 {
 108         struct bundle_priv *pbundle =
 109                 container_of(bundle, struct bundle_priv, bundle);
 110         size_t new_used;
 111         void *res;
 112
 113         if (check_add_overflow(size, pbundle->internal_used, &new_used))
 114                 return ERR_PTR(-EOVERFLOW);
 115
 116         if (new_used > pbundle->internal_avail) {
 117                 struct bundle_alloc_head *buf;
 118
 119                 buf = kvmalloc(struct_size(buf, data, size), flags);
 120                 if (!buf)
 121                         return ERR_PTR(-ENOMEM);
 122                 buf->next = pbundle->allocated_mem;
 123                 pbundle->allocated_mem = buf;
 124                 return buf->data;
 125         }
 126
 127         res = (void *)pbundle->internal_buffer + pbundle->internal_used;
 128         pbundle->internal_used =
 129                 ALIGN(new_used, sizeof(*pbundle->internal_buffer));
 130         if (flags & __GFP_ZERO)
 131                 memset(res, 0, size);
 132         return res;
 133 }
 134 EXPORT_SYMBOL(_uverbs_alloc);
 135
 136 static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr,
 137                                    u16 len)
 138 {
 139         if (uattr->len > sizeof(((struct ib_uverbs_attr *)0)->data))
 140                 return ib_is_buffer_cleared(u64_to_user_ptr(uattr->data) + len,
 141                                             uattr->len - len);
 142
 143         return !memchr_inv((const void *)&uattr->data + len,
 144                            0, uattr->len - len);
 145 }
 146
 147 static int uverbs_process_idrs_array(struct bundle_priv *pbundle,
 148                                      const struct uverbs_api_attr *attr_uapi,
 149                                      struct uverbs_objs_arr_attr *attr,
 150                                      struct ib_uverbs_attr *uattr,
 151                                      u32 attr_bkey)
 152 {
 153         const struct uverbs_attr_spec *spec = &attr_uapi->spec;
 154         size_t array_len;
 155         u32 *idr_vals;
 156         int ret = 0;
 157         size_t i;
 158
 159         if (uattr->attr_data.reserved)
 160                 return -EINVAL;
 161
 162         if (uattr->len % sizeof(u32))
 163                 return -EINVAL;
 164
 165         array_len = uattr->len / sizeof(u32);
 166         if (array_len < spec->u2.objs_arr.min_len ||
 167             array_len > spec->u2.objs_arr.max_len)
 168                 return -EINVAL;
 169
 170         attr->uobjects =
 171                 uverbs_alloc(&pbundle->bundle,
 172                              array_size(array_len, sizeof(*attr->uobjects)));
 173         if (IS_ERR(attr->uobjects))
 174                 return PTR_ERR(attr->uobjects);
 175
 176         /*
 177          * Since idr is 4B and *uobjects is >= 4B, we can use attr->uobjects
 178          * to store idrs array and avoid additional memory allocation. The
 179          * idrs array is offset to the end of the uobjects array so we will be
 180          * able to read idr and replace with a pointer.
 181          */
 182         idr_vals = (u32 *)(attr->uobjects + array_len) - array_len;
 183
 184         if (uattr->len > sizeof(uattr->data)) {
 185                 ret = copy_from_user(idr_vals, u64_to_user_ptr(uattr->data),
 186                                      uattr->len);
 187                 if (ret)
 188                         return -EFAULT;
 189         } else {
 190                 memcpy(idr_vals, &uattr->data, uattr->len);
 191         }
 192
 193         for (i = 0; i != array_len; i++) {
 194                 attr->uobjects[i] = uverbs_get_uobject_from_file(
 195                         spec->u2.objs_arr.obj_type, pbundle->bundle.ufile,
 196                         spec->u2.objs_arr.access, idr_vals[i]);
 197                 if (IS_ERR(attr->uobjects[i])) {
 198                         ret = PTR_ERR(attr->uobjects[i]);
 199                         break;
 200                 }
 201         }
 202
 203         attr->len = i;
 204         __set_bit(attr_bkey, pbundle->spec_finalize);
 205         return ret;
 206 }
 207
 208 static int uverbs_free_idrs_array(const struct uverbs_api_attr *attr_uapi,
 209                                   struct uverbs_objs_arr_attr *attr,
 210                                   bool commit)
 211 {
 212         const struct uverbs_attr_spec *spec = &attr_uapi->spec;
 213         int current_ret;
 214         int ret = 0;
 215         size_t i;
 216
 217         for (i = 0; i != attr->len; i++) {
 218                 current_ret = uverbs_finalize_object(
 219                         attr->uobjects[i], spec->u2.objs_arr.access, commit);
 220                 if (!ret)
 221                         ret = current_ret;
 222         }
 223
 224         return ret;
 225 }
 226
 227 static int uverbs_process_attr(struct bundle_priv *pbundle,
 228                                const struct uverbs_api_attr *attr_uapi,
 229                                struct ib_uverbs_attr *uattr, u32 attr_bkey)
 230 {
 231         const struct uverbs_attr_spec *spec = &attr_uapi->spec;
 232         struct uverbs_attr *e = &pbundle->bundle.attrs[attr_bkey];
 233         const struct uverbs_attr_spec *val_spec = spec;
 234         struct uverbs_obj_attr *o_attr;
 235
 236         switch (spec->type) {
 237         case UVERBS_ATTR_TYPE_ENUM_IN:
 238                 if (uattr->attr_data.enum_data.elem_id >= spec->u.enum_def.num_elems)
 239                         return -EOPNOTSUPP;
 240
 241                 if (uattr->attr_data.enum_data.reserved)
 242                         return -EINVAL;
 243
 244                 val_spec = &spec->u2.enum_def.ids[uattr->attr_data.enum_data.elem_id];
 245
 246                 /* Currently we only support PTR_IN based enums */
 247                 if (val_spec->type != UVERBS_ATTR_TYPE_PTR_IN)
 248                         return -EOPNOTSUPP;
 249
 250                 e->ptr_attr.enum_id = uattr->attr_data.enum_data.elem_id;
 251         /* fall through */
 252         case UVERBS_ATTR_TYPE_PTR_IN:
 253                 /* Ensure that any data provided by userspace beyond the known
 254                  * struct is zero. Userspace that knows how to use some future
 255                  * longer struct will fail here if used with an old kernel and
 256                  * non-zero content, making ABI compat/discovery simpler.
 257                  */
 258                 if (uattr->len > val_spec->u.ptr.len &&
 259                     val_spec->zero_trailing &&
 260                     !uverbs_is_attr_cleared(uattr, val_spec->u.ptr.len))
 261                         return -EOPNOTSUPP;
 262
 263         /* fall through */
 264         case UVERBS_ATTR_TYPE_PTR_OUT:
 265                 if (uattr->len < val_spec->u.ptr.min_len ||
 266                     (!val_spec->zero_trailing &&
 267                      uattr->len > val_spec->u.ptr.len))
 268                         return -EINVAL;
 269
 270                 if (spec->type != UVERBS_ATTR_TYPE_ENUM_IN &&
 271                     uattr->attr_data.reserved)
 272                         return -EINVAL;
 273
 274                 e->ptr_attr.uattr_idx = uattr - pbundle->uattrs;
 275                 e->ptr_attr.len = uattr->len;
 276
 277                 if (val_spec->alloc_and_copy && !uverbs_attr_ptr_is_inline(e)) {
 278                         void *p;
 279
 280                         p = uverbs_alloc(&pbundle->bundle, uattr->len);
 281                         if (IS_ERR(p))
 282                                 return PTR_ERR(p);
 283
 284                         e->ptr_attr.ptr = p;
 285
 286                         if (copy_from_user(p, u64_to_user_ptr(uattr->data),
 287                                            uattr->len))
 288                                 return -EFAULT;
 289                 } else {
 290                         e->ptr_attr.data = uattr->data;
 291                 }
 292                 break;
 293
 294         case UVERBS_ATTR_TYPE_IDR:
 295         case UVERBS_ATTR_TYPE_FD:
 296                 if (uattr->attr_data.reserved)
 297                         return -EINVAL;
 298
 299                 if (uattr->len != 0)
 300                         return -EINVAL;
 301
 302                 o_attr = &e->obj_attr;
 303                 o_attr->attr_elm = attr_uapi;
 304
 305                 /*
 306                  * The type of uattr->data is u64 for UVERBS_ATTR_TYPE_IDR and
 307                  * s64 for UVERBS_ATTR_TYPE_FD. We can cast the u64 to s64
 308                  * here without caring about truncation as we know that the
 309                  * IDR implementation today rejects negative IDs
 310                  */
 311                 o_attr->uobject = uverbs_get_uobject_from_file(
 312                                         spec->u.obj.obj_type,
 313                                         pbundle->bundle.ufile,
 314                                         spec->u.obj.access,
 315                                         uattr->data_s64);
 316                 if (IS_ERR(o_attr->uobject))
 317                         return PTR_ERR(o_attr->uobject);
 318                 __set_bit(attr_bkey, pbundle->uobj_finalize);
 319
 320                 if (spec->u.obj.access == UVERBS_ACCESS_NEW) {
 321                         unsigned int uattr_idx = uattr - pbundle->uattrs;
 322                         s64 id = o_attr->uobject->id;
 323
 324                         /* Copy the allocated id to the user-space */
 325                         if (put_user(id, &pbundle->user_attrs[uattr_idx].data))
 326                                 return -EFAULT;
 327                 }
 328
 329                 break;
 330
 331         case UVERBS_ATTR_TYPE_IDRS_ARRAY:
 332                 return uverbs_process_idrs_array(pbundle, attr_uapi,
 333                                                  &e->objs_arr_attr, uattr,
 334                                                  attr_bkey);
 335         default:
 336                 return -EOPNOTSUPP;
 337         }
 338
 339         return 0;
 340 }
 341
 342 /*
 343  * We search the radix tree with the method prefix and now we want to fast
 344  * search the suffix bits to get a particular attribute pointer. It is not
 345  * totally clear to me if this breaks the radix tree encasulation or not, but
 346  * it uses the iter data to determine if the method iter points at the same
 347  * chunk that will store the attribute, if so it just derefs it directly. By
 348  * construction in most kernel configs the method and attrs will all fit in a
 349  * single radix chunk, so in most cases this will have no search. Other cases
 350  * this falls back to a full search.
 351  */
 352 static void __rcu **uapi_get_attr_for_method(struct bundle_priv *pbundle,
 353                                              u32 attr_key)
 354 {
 355         void __rcu **slot;
 356
 357         if (likely(attr_key < pbundle->radix_slots_len)) {
 358                 void *entry;
 359
 360                 slot = pbundle->radix_slots + attr_key;
 361                 entry = rcu_dereference_raw(*slot);
 362                 if (likely(!radix_tree_is_internal_node(entry) && entry))
 363                         return slot;
 364         }
 365
 366         return radix_tree_lookup_slot(pbundle->radix,
 367                                       pbundle->method_key | attr_key);
 368 }
 369
 370 static int uverbs_set_attr(struct bundle_priv *pbundle,
 371                            struct ib_uverbs_attr *uattr)
 372 {
 373         u32 attr_key = uapi_key_attr(uattr->attr_id);
 374         u32 attr_bkey = uapi_bkey_attr(attr_key);
 375         const struct uverbs_api_attr *attr;
 376         void __rcu **slot;
 377         int ret;
 378
 379         slot = uapi_get_attr_for_method(pbundle, attr_key);
 380         if (!slot) {
 381                 /*
 382                  * Kernel does not support the attribute but user-space says it
 383                  * is mandatory
 384                  */
 385                 if (uattr->flags & UVERBS_ATTR_F_MANDATORY)
 386                         return -EPROTONOSUPPORT;
 387                 return 0;
 388         }
 389         attr = rcu_dereference_protected(*slot, true);
 390
 391         /* Reject duplicate attributes from user-space */
 392         if (test_bit(attr_bkey, pbundle->bundle.attr_present))
 393                 return -EINVAL;
 394
 395         ret = uverbs_process_attr(pbundle, attr, uattr, attr_bkey);
 396         if (ret)
 397                 return ret;
 398
 399         __set_bit(attr_bkey, pbundle->bundle.attr_present);
 400
 401         return 0;
 402 }
 403
 404 static int ib_uverbs_run_method(struct bundle_priv *pbundle,
 405                                 unsigned int num_attrs)
 406 {
 407         int (*handler)(struct ib_uverbs_file *ufile,
 408                        struct uverbs_attr_bundle *ctx);
 409         size_t uattrs_size = array_size(sizeof(*pbundle->uattrs), num_attrs);
 410         unsigned int destroy_bkey = pbundle->method_elm->destroy_bkey;
 411         unsigned int i;
 412         int ret;
 413
 414         /* See uverbs_disassociate_api() */
 415         handler = srcu_dereference(
 416                 pbundle->method_elm->handler,
 417                 &pbundle->bundle.ufile->device->disassociate_srcu);
 418         if (!handler)
 419                 return -EIO;
 420
 421         pbundle->uattrs = uverbs_alloc(&pbundle->bundle, uattrs_size);
 422         if (IS_ERR(pbundle->uattrs))
 423                 return PTR_ERR(pbundle->uattrs);
 424         if (copy_from_user(pbundle->uattrs, pbundle->user_attrs, uattrs_size))
 425                 return -EFAULT;
 426
 427         for (i = 0; i != num_attrs; i++) {
 428                 ret = uverbs_set_attr(pbundle, &pbundle->uattrs[i]);
 429                 if (unlikely(ret))
 430                         return ret;
 431         }
 432
 433         /* User space did not provide all the mandatory attributes */
 434         if (unlikely(!bitmap_subset(pbundle->method_elm->attr_mandatory,
 435                                     pbundle->bundle.attr_present,
 436                                     pbundle->method_elm->key_bitmap_len)))
 437                 return -EINVAL;
 438
 439         if (destroy_bkey != UVERBS_API_ATTR_BKEY_LEN) {
 440                 struct uverbs_obj_attr *destroy_attr =
 441                         &pbundle->bundle.attrs[destroy_bkey].obj_attr;
 442
 443                 ret = uobj_destroy(destroy_attr->uobject);
 444                 if (ret)
 445                         return ret;
 446                 __clear_bit(destroy_bkey, pbundle->uobj_finalize);
 447
 448                 ret = handler(pbundle->bundle.ufile, &pbundle->bundle);
 449                 uobj_put_destroy(destroy_attr->uobject);
 450         } else {
 451                 ret = handler(pbundle->bundle.ufile, &pbundle->bundle);
 452         }
 453
 454         /*
 455          * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
 456          * not invoke the method because the request is not supported.  No
 457          * other cases should return this code.
 458          */
 459         if (WARN_ON_ONCE(ret == -EPROTONOSUPPORT))
 460                 return -EINVAL;
 461
 462         return ret;
 463 }
 464
 465 static int bundle_destroy(struct bundle_priv *pbundle, bool commit)
 466 {
 467         unsigned int key_bitmap_len = pbundle->method_elm->key_bitmap_len;
 468         struct bundle_alloc_head *memblock;
 469         unsigned int i;
 470         int ret = 0;
 471
 472         /* fast path for simple uobjects */
 473         i = -1;
 474         while ((i = find_next_bit(pbundle->uobj_finalize, key_bitmap_len,
 475                                   i + 1)) < key_bitmap_len) {
 476                 struct uverbs_attr *attr = &pbundle->bundle.attrs[i];
 477                 int current_ret;
 478
 479                 current_ret = uverbs_finalize_object(
 480                         attr->obj_attr.uobject,
 481                         attr->obj_attr.attr_elm->spec.u.obj.access, commit);
 482                 if (!ret)
 483                         ret = current_ret;
 484         }
 485
 486         i = -1;
 487         while ((i = find_next_bit(pbundle->spec_finalize, key_bitmap_len,
 488                                   i + 1)) < key_bitmap_len) {
 489                 struct uverbs_attr *attr = &pbundle->bundle.attrs[i];
 490                 const struct uverbs_api_attr *attr_uapi;
 491                 void __rcu **slot;
 492                 int current_ret;
 493
 494                 slot = uapi_get_attr_for_method(
 495                         pbundle,
 496                         pbundle->method_key | uapi_bkey_to_key_attr(i));
 497                 if (WARN_ON(!slot))
 498                         continue;
 499
 500                 attr_uapi = rcu_dereference_protected(*slot, true);
 501
 502                 if (attr_uapi->spec.type == UVERBS_ATTR_TYPE_IDRS_ARRAY) {
 503                         current_ret = uverbs_free_idrs_array(
 504                                 attr_uapi, &attr->objs_arr_attr, commit);
 505                         if (!ret)
 506                                 ret = current_ret;
 507                 }
 508         }
 509
 510         for (memblock = pbundle->allocated_mem; memblock;) {
 511                 struct bundle_alloc_head *tmp = memblock;
 512
 513                 memblock = memblock->next;
 514                 kvfree(tmp);
 515         }
 516
 517         return ret;
 518 }
 519
 520 static int ib_uverbs_cmd_verbs(struct ib_uverbs_file *ufile,
 521                                struct ib_uverbs_ioctl_hdr *hdr,
 522                                struct ib_uverbs_attr __user *user_attrs)
 523 {
 524         const struct uverbs_api_ioctl_method *method_elm;
 525         struct uverbs_api *uapi = ufile->device->uapi;
 526         struct radix_tree_iter attrs_iter;
 527         struct bundle_priv *pbundle;
 528         struct bundle_priv onstack;
 529         void __rcu **slot;
 530         int destroy_ret;
 531         int ret;
 532
 533         if (unlikely(hdr->driver_id != uapi->driver_id))
 534                 return -EINVAL;
 535
 536         slot = radix_tree_iter_lookup(
 537                 &uapi->radix, &attrs_iter,
 538                 uapi_key_obj(hdr->object_id) |
 539                         uapi_key_ioctl_method(hdr->method_id));
 540         if (unlikely(!slot))
 541                 return -EPROTONOSUPPORT;
 542         method_elm = rcu_dereference_protected(*slot, true);
 543
 544         if (!method_elm->use_stack) {
 545                 pbundle = kmalloc(method_elm->bundle_size, GFP_KERNEL);
 546                 if (!pbundle)
 547                         return -ENOMEM;
 548                 pbundle->internal_avail =
 549                         method_elm->bundle_size -
 550                         offsetof(struct bundle_priv, internal_buffer);
 551                 pbundle->alloc_head.next = NULL;
 552                 pbundle->allocated_mem = &pbundle->alloc_head;
 553         } else {
 554                 pbundle = &onstack;
 555                 pbundle->internal_avail = sizeof(pbundle->internal_buffer);
 556                 pbundle->allocated_mem = NULL;
 557         }
 558
 559         /* Space for the pbundle->bundle.attrs flex array */
 560         pbundle->method_elm = method_elm;
 561         pbundle->method_key = attrs_iter.index;
 562         pbundle->bundle.ufile = ufile;
 563         pbundle->radix = &uapi->radix;
 564         pbundle->radix_slots = slot;
 565         pbundle->radix_slots_len = radix_tree_chunk_size(&attrs_iter);
 566         pbundle->user_attrs = user_attrs;
 567
 568         pbundle->internal_used = ALIGN(pbundle->method_elm->key_bitmap_len *
 569                                                sizeof(*pbundle->bundle.attrs),
 570                                        sizeof(*pbundle->internal_buffer));
 571         memset(pbundle->bundle.attr_present, 0,
 572                sizeof(pbundle->bundle.attr_present));
 573         memset(pbundle->uobj_finalize, 0, sizeof(pbundle->uobj_finalize));
 574         memset(pbundle->spec_finalize, 0, sizeof(pbundle->spec_finalize));
 575
 576         ret = ib_uverbs_run_method(pbundle, hdr->num_attrs);
 577         destroy_ret = bundle_destroy(pbundle, ret == 0);
 578         if (unlikely(destroy_ret && !ret))
 579                 return destroy_ret;
 580
 581         return ret;
 582 }
 583
 584 long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 585 {
 586         struct ib_uverbs_file *file = filp->private_data;
 587         struct ib_uverbs_ioctl_hdr __user *user_hdr =
 588                 (struct ib_uverbs_ioctl_hdr __user *)arg;
 589         struct ib_uverbs_ioctl_hdr hdr;
 590         int srcu_key;
 591         int err;
 592
 593         if (unlikely(cmd != RDMA_VERBS_IOCTL))
 594                 return -ENOIOCTLCMD;
 595
 596         err = copy_from_user(&hdr, user_hdr, sizeof(hdr));
 597         if (err)
 598                 return -EFAULT;
 599
 600         if (hdr.length > PAGE_SIZE ||
 601             hdr.length != struct_size(&hdr, attrs, hdr.num_attrs))
 602                 return -EINVAL;
 603
 604         if (hdr.reserved1 || hdr.reserved2)
 605                 return -EPROTONOSUPPORT;
 606
 607         srcu_key = srcu_read_lock(&file->device->disassociate_srcu);
 608         err = ib_uverbs_cmd_verbs(file, &hdr, user_hdr->attrs);
 609         srcu_read_unlock(&file->device->disassociate_srcu, srcu_key);
 610         return err;
 611 }
 612
 613 int uverbs_get_flags64(u64 *to, const struct uverbs_attr_bundle *attrs_bundle,
 614                        size_t idx, u64 allowed_bits)
 615 {
 616         const struct uverbs_attr *attr;
 617         u64 flags;
 618
 619         attr = uverbs_attr_get(attrs_bundle, idx);
 620         /* Missing attribute means 0 flags */
 621         if (IS_ERR(attr)) {
 622                 *to = 0;
 623                 return 0;
 624         }
 625
 626         /*
 627          * New userspace code should use 8 bytes to pass flags, but we
 628          * transparently support old userspaces that were using 4 bytes as
 629          * well.
 630          */
 631         if (attr->ptr_attr.len == 8)
 632                 flags = attr->ptr_attr.data;
 633         else if (attr->ptr_attr.len == 4)
 634                 flags = *(u32 *)&attr->ptr_attr.data;
 635         else
 636                 return -EINVAL;
 637
 638         if (flags & ~allowed_bits)
 639                 return -EINVAL;
 640
 641         *to = flags;
 642         return 0;
 643 }
 644 EXPORT_SYMBOL(uverbs_get_flags64);
 645
 646 int uverbs_get_flags32(u32 *to, const struct uverbs_attr_bundle *attrs_bundle,
 647                        size_t idx, u64 allowed_bits)
 648 {
 649         u64 flags;
 650         int ret;
 651
 652         ret = uverbs_get_flags64(&flags, attrs_bundle, idx, allowed_bits);
 653         if (ret)
 654                 return ret;
 655
 656         if (flags > U32_MAX)
 657                 return -EINVAL;
 658         *to = flags;
 659
 660         return 0;
 661 }
 662 EXPORT_SYMBOL(uverbs_get_flags32);
 663
 664 /*
 665  * This is for ease of conversion. The purpose is to convert all drivers to
 666  * use uverbs_attr_bundle instead of ib_udata.  Assume attr == 0 is input and
 667  * attr == 1 is output.
 668  */
 669 void create_udata(struct uverbs_attr_bundle *bundle, struct ib_udata *udata)
 670 {
 671         struct bundle_priv *pbundle =
 672                 container_of(bundle, struct bundle_priv, bundle);
 673         const struct uverbs_attr *uhw_in =
 674                 uverbs_attr_get(bundle, UVERBS_ATTR_UHW_IN);
 675         const struct uverbs_attr *uhw_out =
 676                 uverbs_attr_get(bundle, UVERBS_ATTR_UHW_OUT);
 677
 678         if (!IS_ERR(uhw_in)) {
 679                 udata->inlen = uhw_in->ptr_attr.len;
 680                 if (uverbs_attr_ptr_is_inline(uhw_in))
 681                         udata->inbuf =
 682                                 &pbundle->user_attrs[uhw_in->ptr_attr.uattr_idx]
 683                                          .data;
 684                 else
 685                         udata->inbuf = u64_to_user_ptr(uhw_in->ptr_attr.data);
 686         } else {
 687                 udata->inbuf = NULL;
 688                 udata->inlen = 0;
 689         }
 690
 691         if (!IS_ERR(uhw_out)) {
 692                 udata->outbuf = u64_to_user_ptr(uhw_out->ptr_attr.data);
 693                 udata->outlen = uhw_out->ptr_attr.len;
 694         } else {
 695                 udata->outbuf = NULL;
 696                 udata->outlen = 0;
 697         }
 698 }
 699
 700 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
 701                    const void *from, size_t size)
 702 {
 703         struct bundle_priv *pbundle =
 704                 container_of(bundle, struct bundle_priv, bundle);
 705         const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
 706         u16 flags;
 707         size_t min_size;
 708
 709         if (IS_ERR(attr))
 710                 return PTR_ERR(attr);
 711
 712         min_size = min_t(size_t, attr->ptr_attr.len, size);
 713         if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
 714                 return -EFAULT;
 715
 716         flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
 717                 UVERBS_ATTR_F_VALID_OUTPUT;
 718         if (put_user(flags,
 719                      &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
 720                 return -EFAULT;
 721
 722         return 0;
 723 }
 724 EXPORT_SYMBOL(uverbs_copy_to);
 725
 726 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
 727                       size_t idx, s64 lower_bound, u64 upper_bound,
 728                       s64  *def_val)
 729 {
 730         const struct uverbs_attr *attr;
 731
 732         attr = uverbs_attr_get(attrs_bundle, idx);
 733         if (IS_ERR(attr)) {
 734                 if ((PTR_ERR(attr) != -ENOENT) || !def_val)
 735                         return PTR_ERR(attr);
 736
 737                 *to = *def_val;
 738         } else {
 739                 *to = attr->ptr_attr.data;
 740         }
 741
 742         if (*to < lower_bound || (*to > 0 && (u64)*to > upper_bound))
 743                 return -EINVAL;
 744
 745         return 0;
 746 }
 747 EXPORT_SYMBOL(_uverbs_get_const);