1. Patchew
  2. linux
  3. [PATCH 0/3] Firmware LSM hook
  4. View patch

[PATCH 2/3] RDMA/mlx5: Invoke fw_validate_cmd LSM hook for DEVX commands

Leon Romanovsky posted 3 patches 1 month ago
There is a newer version of this series
[PATCH 2/3] RDMA/mlx5: Invoke fw_validate_cmd LSM hook for DEVX commands
Posted by Leon Romanovsky 1 month ago 
From: Chiara Meiohas <cmeiohas@nvidia.com>

DEVX is an RDMA uverbs extension that allows userspace to submit
firmware command buffers. The driver inspects the command and then
passes the buffer through for firmware execution.

Call security_fw_validate_cmd() before dispatching firmware commands
through DEVX.

This allows security modules to implement custom policies and
enforce per-command security policy on user-triggered firmware
commands. For example, a BPF LSM program could restrict specific
firmware operations to privileged users.

Signed-off-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx5/devx.c | 52 ++++++++++++++++++++++++++++++---------
 1 file changed, 40 insertions(+), 12 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 0066b2738ac89..48a2c4b4ad4eb 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -18,6 +18,7 @@
 #include "devx.h"
 #include "qp.h"
 #include <linux/xarray.h>
+#include <linux/security.h>
 
 #define UVERBS_MODULE_NAME mlx5_ib
 #include <rdma/uverbs_named_ioctl.h>
@@ -1111,6 +1112,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
 	struct mlx5_ib_dev *dev;
 	void *cmd_in = uverbs_attr_get_alloced_ptr(
 		attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
+	int cmd_in_len = uverbs_attr_get_len(attrs,
+					MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
 	int cmd_out_len = uverbs_attr_get_len(attrs,
 					MLX5_IB_ATTR_DEVX_OTHER_CMD_OUT);
 	void *cmd_out;
@@ -1135,9 +1138,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
 		return PTR_ERR(cmd_out);
 
 	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
-	err = mlx5_cmd_do(dev->mdev, cmd_in,
-			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN),
-			  cmd_out, cmd_out_len);
+	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &dev->ib_dev.dev,
+				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
+	if (err)
+		return err;
+
+	err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out, cmd_out_len);
 	if (err && err != -EREMOTEIO)
 		return err;
 
@@ -1570,6 +1576,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 		devx_set_umem_valid(cmd_in);
 	}
 
+	err = security_fw_validate_cmd(cmd_in, cmd_in_len,
+				       &dev->ib_dev.dev,
+				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
+	if (err)
+		goto obj_free;
+
 	if (opcode == MLX5_CMD_OP_CREATE_DCT) {
 		obj->flags |= DEVX_OBJ_FLAGS_DCT;
 		err = mlx5_core_create_dct(dev, &obj->core_dct, cmd_in,
@@ -1582,8 +1594,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 				     cmd_in, cmd_in_len, cmd_out,
 				     cmd_out_len);
 	} else {
-		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len,
-				  cmd_out, cmd_out_len);
+		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out,
+				  cmd_out_len);
 	}
 
 	if (err == -EREMOTEIO)
@@ -1646,6 +1658,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
 	struct uverbs_attr_bundle *attrs)
 {
 	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
+	int cmd_in_len = uverbs_attr_get_len(attrs,
+					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
 	int cmd_out_len = uverbs_attr_get_len(attrs,
 					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_OUT);
 	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
@@ -1676,9 +1690,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
 
 	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
 	devx_set_umem_valid(cmd_in);
+	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
+				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
+	if (err)
+		return err;
 
-	err = mlx5_cmd_do(mdev->mdev, cmd_in,
-			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN),
+	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
 			  cmd_out, cmd_out_len);
 	if (err && err != -EREMOTEIO)
 		return err;
@@ -1693,6 +1710,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
 	struct uverbs_attr_bundle *attrs)
 {
 	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
+	int cmd_in_len = uverbs_attr_get_len(attrs,
+					     MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
 	int cmd_out_len = uverbs_attr_get_len(attrs,
 					      MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_OUT);
 	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
@@ -1722,8 +1741,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
 		return PTR_ERR(cmd_out);
 
 	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
-	err = mlx5_cmd_do(mdev->mdev, cmd_in,
-			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN),
+	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
+				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
+	if (err)
+		return err;
+
+	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
 			  cmd_out, cmd_out_len);
 	if (err && err != -EREMOTEIO)
 		return err;
@@ -1832,6 +1855,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
 {
 	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs,
 				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
+	int cmd_in_len = uverbs_attr_get_len(attrs,
+				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
 	struct ib_uobject *uobj = uverbs_attr_get_uobject(
 				attrs,
 				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_HANDLE);
@@ -1894,9 +1919,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
 	async_data->ev_file = ev_file;
 
 	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
-	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in,
-		    uverbs_attr_get_len(attrs,
-				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN),
+	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
+				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
+	if (err)
+		goto free_async;
+
+	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in, cmd_in_len,
 		    async_data->hdr.out_data,
 		    async_data->cmd_out_len,
 		    devx_query_callback, &async_data->cb_work);

-- 
2.53.0
Re: [PATCH 2/3] RDMA/mlx5: Invoke fw_validate_cmd LSM hook for DEVX commands
Posted by Dave Jiang 1 month ago 

On 3/9/26 4:15 AM, Leon Romanovsky wrote:
> From: Chiara Meiohas <cmeiohas@nvidia.com>
> 
> DEVX is an RDMA uverbs extension that allows userspace to submit
> firmware command buffers. The driver inspects the command and then
> passes the buffer through for firmware execution.
> 
> Call security_fw_validate_cmd() before dispatching firmware commands
> through DEVX.
> 
> This allows security modules to implement custom policies and
> enforce per-command security policy on user-triggered firmware
> commands. For example, a BPF LSM program could restrict specific
> firmware operations to privileged users.
> 
> Signed-off-by: Chiara Meiohas <cmeiohas@nvidia.com>
> Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
> Signed-off-by: Edward Srouji <edwards@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/infiniband/hw/mlx5/devx.c | 52 ++++++++++++++++++++++++++++++---------
>  1 file changed, 40 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index 0066b2738ac89..48a2c4b4ad4eb 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -18,6 +18,7 @@
>  #include "devx.h"
>  #include "qp.h"
>  #include <linux/xarray.h>
> +#include <linux/security.h>
>  
>  #define UVERBS_MODULE_NAME mlx5_ib
>  #include <rdma/uverbs_named_ioctl.h>
> @@ -1111,6 +1112,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
>  	struct mlx5_ib_dev *dev;
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(
>  		attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					MLX5_IB_ATTR_DEVX_OTHER_CMD_OUT);
>  	void *cmd_out;
> @@ -1135,9 +1138,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
>  		return PTR_ERR(cmd_out);
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_do(dev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN),
> -			  cmd_out, cmd_out_len);
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &dev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
> +
> +	err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out, cmd_out_len);
>  	if (err && err != -EREMOTEIO)
>  		return err;
>  
> @@ -1570,6 +1576,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  		devx_set_umem_valid(cmd_in);
>  	}
>  
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len,
> +				       &dev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		goto obj_free;
> +
>  	if (opcode == MLX5_CMD_OP_CREATE_DCT) {
>  		obj->flags |= DEVX_OBJ_FLAGS_DCT;
>  		err = mlx5_core_create_dct(dev, &obj->core_dct, cmd_in,
> @@ -1582,8 +1594,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  				     cmd_in, cmd_in_len, cmd_out,
>  				     cmd_out_len);
>  	} else {
> -		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len,
> -				  cmd_out, cmd_out_len);
> +		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out,
> +				  cmd_out_len);
>  	}
>  
>  	if (err == -EREMOTEIO)
> @@ -1646,6 +1658,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
>  	struct uverbs_attr_bundle *attrs)
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_OUT);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
> @@ -1676,9 +1690,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
>  	devx_set_umem_valid(cmd_in);
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
>  
> -	err = mlx5_cmd_do(mdev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN),
> +	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
>  			  cmd_out, cmd_out_len);
>  	if (err && err != -EREMOTEIO)
>  		return err;
> @@ -1693,6 +1710,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
>  	struct uverbs_attr_bundle *attrs)
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					     MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					      MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_OUT);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
> @@ -1722,8 +1741,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
>  		return PTR_ERR(cmd_out);
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_do(mdev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN),
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
> +
> +	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
>  			  cmd_out, cmd_out_len);
>  	if (err && err != -EREMOTEIO)
>  		return err;
> @@ -1832,6 +1855,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs,
>  				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(
>  				attrs,
>  				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_HANDLE);
> @@ -1894,9 +1919,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
>  	async_data->ev_file = ev_file;
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in,
> -		    uverbs_attr_get_len(attrs,
> -				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN),
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		goto free_async;
> +
> +	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in, cmd_in_len,
>  		    async_data->hdr.out_data,
>  		    async_data->cmd_out_len,
>  		    devx_query_callback, &async_data->cb_work);
>
Re: [PATCH 2/3] RDMA/mlx5: Invoke fw_validate_cmd LSM hook for DEVX commands
Posted by Jonathan Cameron 1 month ago 
On Mon,  9 Mar 2026 13:15:19 +0200
Leon Romanovsky <leon@kernel.org> wrote:

> From: Chiara Meiohas <cmeiohas@nvidia.com>
> 
> DEVX is an RDMA uverbs extension that allows userspace to submit
> firmware command buffers. The driver inspects the command and then
> passes the buffer through for firmware execution.
> 
> Call security_fw_validate_cmd() before dispatching firmware commands
> through DEVX.
> 
> This allows security modules to implement custom policies and
> enforce per-command security policy on user-triggered firmware
> commands. For example, a BPF LSM program could restrict specific
> firmware operations to privileged users.
> 
> Signed-off-by: Chiara Meiohas <cmeiohas@nvidia.com>
> Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
> Signed-off-by: Edward Srouji <edwards@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
A few formatting inconsistencies.  Actual code is fine as far as I can tell.
So given I don't know the driver, take this as vague at best...

Assuming formatting stuff tidied up.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>


> ---
>  drivers/infiniband/hw/mlx5/devx.c | 52 ++++++++++++++++++++++++++++++---------
>  1 file changed, 40 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index 0066b2738ac89..48a2c4b4ad4eb 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -18,6 +18,7 @@
>  #include "devx.h"
>  #include "qp.h"
>  #include <linux/xarray.h>
> +#include <linux/security.h>
>  
>  #define UVERBS_MODULE_NAME mlx5_ib
>  #include <rdma/uverbs_named_ioctl.h>
> @@ -1111,6 +1112,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
>  	struct mlx5_ib_dev *dev;
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(
>  		attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					MLX5_IB_ATTR_DEVX_OTHER_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					MLX5_IB_ATTR_DEVX_OTHER_CMD_OUT);
>  	void *cmd_out;
> @@ -1135,9 +1138,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OTHER)(
>  		return PTR_ERR(cmd_out);
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_do(dev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OTHER_CMD_IN),
> -			  cmd_out, cmd_out_len);
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &dev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
> +
> +	err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out, cmd_out_len);

See below for inconsistency on how the changes have been done.

>  	if (err && err != -EREMOTEIO)
>  		return err;
>  
> @@ -1570,6 +1576,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  		devx_set_umem_valid(cmd_in);
>  	}
>  
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len,
> +				       &dev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		goto obj_free;
> +
>  	if (opcode == MLX5_CMD_OP_CREATE_DCT) {
>  		obj->flags |= DEVX_OBJ_FLAGS_DCT;
>  		err = mlx5_core_create_dct(dev, &obj->core_dct, cmd_in,
> @@ -1582,8 +1594,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  				     cmd_in, cmd_in_len, cmd_out,
>  				     cmd_out_len);
>  	} else {
> -		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len,
> -				  cmd_out, cmd_out_len);
> +		err = mlx5_cmd_do(dev->mdev, cmd_in, cmd_in_len, cmd_out,
> +				  cmd_out_len);

Unrelated bit of reformatting. Shouldn't be in this patch.,


>  	}
>  
>  	if (err == -EREMOTEIO)
> @@ -1646,6 +1658,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
>  	struct uverbs_attr_bundle *attrs)
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_OUT);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
> @@ -1676,9 +1690,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_MODIFY)(
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
>  	devx_set_umem_valid(cmd_in);
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
>  
> -	err = mlx5_cmd_do(mdev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN),
> +	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
>  			  cmd_out, cmd_out_len);

Similar to case above, this not fits on one line.

>  	if (err && err != -EREMOTEIO)
>  		return err;
> @@ -1693,6 +1710,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
>  	struct uverbs_attr_bundle *attrs)
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +					     MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN);
>  	int cmd_out_len = uverbs_attr_get_len(attrs,
>  					      MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_OUT);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(attrs,
> @@ -1722,8 +1741,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_QUERY)(
>  		return PTR_ERR(cmd_out);
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_do(mdev->mdev, cmd_in,
> -			  uverbs_attr_get_len(attrs, MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN),
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		return err;
> +
> +	err = mlx5_cmd_do(mdev->mdev, cmd_in, cmd_in_len,
>  			  cmd_out, cmd_out_len);

As above.

>  	if (err && err != -EREMOTEIO)
>  		return err;
> @@ -1832,6 +1855,8 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
>  {
>  	void *cmd_in = uverbs_attr_get_alloced_ptr(attrs,
>  				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
> +	int cmd_in_len = uverbs_attr_get_len(attrs,
> +				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN);
>  	struct ib_uobject *uobj = uverbs_attr_get_uobject(
>  				attrs,
>  				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_HANDLE);
> @@ -1894,9 +1919,12 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
>  	async_data->ev_file = ev_file;
>  
>  	MLX5_SET(general_obj_in_cmd_hdr, cmd_in, uid, uid);
> -	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in,
> -		    uverbs_attr_get_len(attrs,
> -				MLX5_IB_ATTR_DEVX_OBJ_QUERY_ASYNC_CMD_IN),
> +	err = security_fw_validate_cmd(cmd_in, cmd_in_len, &mdev->ib_dev.dev,
> +				       FW_CMD_CLASS_UVERBS, RDMA_DRIVER_MLX5);
> +	if (err)
> +		goto free_async;
> +
> +	err = mlx5_cmd_exec_cb(&ev_file->async_ctx, cmd_in, cmd_in_len,
>  		    async_data->hdr.out_data,
>  		    async_data->cmd_out_len,
>  		    devx_query_callback, &async_data->cb_work);
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.