1# Copyright 2018 syzkaller project authors. All rights reserved. 2# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. 3 4include <uapi/linux/fcntl.h> 5include <uapi/rdma/rdma_user_cm.h> 6include <uapi/rdma/ib_user_verbs.h> 7include <rdma/rdma_cm.h> 8include <rdma/ib_verbs.h> 9include <rdma/ib.h> 10 11resource fd_rdma_cm[fd] 12resource rdma_cm_id[int32]: -1 13resource rdma_cm_mcast_id[int32]: -1 14type rdma_cm_uid int64[0:4] 15 16openat$rdma_cm(fd const[AT_FDCWD], file ptr[in, string["/dev/infiniband/rdma_cm"]], flags const[O_RDWR], mode const[0]) fd_rdma_cm 17 18write$RDMA_USER_CM_CMD_CREATE_ID(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CREATE_ID, rdma_ucm_create_id]], len bytesize[data]) 19write$RDMA_USER_CM_CMD_DESTROY_ID(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_DESTROY_ID, rdma_ucm_destroy_id]], len bytesize[data]) 20write$RDMA_USER_CM_CMD_BIND_IP(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_BIND_IP, rdma_ucm_bind_ip]], len bytesize[data]) 21write$RDMA_USER_CM_CMD_RESOLVE_IP(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_RESOLVE_IP, rdma_ucm_resolve_ip]], len bytesize[data]) 22write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_RESOLVE_ROUTE, rdma_ucm_resolve_route]], len bytesize[data]) 23write$RDMA_USER_CM_CMD_QUERY_ROUTE(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_QUERY_ROUTE, rdma_ucm_query]], len bytesize[data]) 24write$RDMA_USER_CM_CMD_CONNECT(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_CONNECT, rdma_ucm_connect]], len bytesize[data]) 25write$RDMA_USER_CM_CMD_LISTEN(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_LISTEN, rdma_ucm_listen]], len bytesize[data]) 26write$RDMA_USER_CM_CMD_ACCEPT(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_ACCEPT, rdma_ucm_accept]], len bytesize[data]) 27write$RDMA_USER_CM_CMD_REJECT(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_REJECT, rdma_ucm_reject]], len bytesize[data]) 28write$RDMA_USER_CM_CMD_DISCONNECT(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_DISCONNECT, rdma_ucm_disconnect]], len bytesize[data]) 29write$RDMA_USER_CM_CMD_INIT_QP_ATTR(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_INIT_QP_ATTR, rdma_ucm_init_qp_attr]], len bytesize[data]) 30write$RDMA_USER_CM_CMD_GET_EVENT(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_GET_EVENT, rdma_ucm_get_event]], len bytesize[data]) 31write$RDMA_USER_CM_CMD_SET_OPTION(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_SET_OPTION, rdma_ucm_set_option]], len bytesize[data]) 32write$RDMA_USER_CM_CMD_NOTIFY(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_NOTIFY, rdma_ucm_notify]], len bytesize[data]) 33write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_JOIN_IP_MCAST, rdma_ucm_join_ip_mcast]], len bytesize[data]) 34write$RDMA_USER_CM_CMD_LEAVE_MCAST(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_LEAVE_MCAST, rdma_ucm_leave_mcast]], len bytesize[data]) 35write$RDMA_USER_CM_CMD_MIGRATE_ID(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_MIGRATE_ID, rdma_ucm_migrate_id]], len bytesize[data]) 36write$RDMA_USER_CM_CMD_QUERY(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_QUERY, rdma_ucm_query]], len bytesize[data]) 37write$RDMA_USER_CM_CMD_BIND(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_BIND, rdma_ucm_bind]], len bytesize[data]) 38write$RDMA_USER_CM_CMD_RESOLVE_ADDR(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_RESOLVE_ADDR, rdma_ucm_resolve_addr]], len bytesize[data]) 39write$RDMA_USER_CM_CMD_JOIN_MCAST(fd fd_rdma_cm, data ptr[in, rdma_ucm_cmd_t[RDMA_USER_CM_CMD_JOIN_MCAST, rdma_ucm_join_mcast]], len bytesize[data]) 40 41type rdma_ucm_cmd_t[CMD, MSG] { 42 cmd const[CMD, int32] 43 in bytesize[msg, int16] 44# TODO: this seems to be only checked for less, so we can get away with a large const. 45# TODO: A properer support would require support for bytesize[MSG.response] syntax. 46 out const[64000, int16] 47 msg MSG 48} 49 50rdma_ucm_create_id { 51 uid rdma_cm_uid 52 response ptr64[out, rdma_ucm_create_id_resp] 53 ps flags[rdma_port_space, int16] 54 qp_type flags[ib_qp_type, int8] 55 reserved array[const[0, int8], 5] 56} 57 58rdma_ucm_create_id_resp { 59 id rdma_cm_id 60} 61 62rdma_ucm_destroy_id { 63 response ptr64[out, rdma_ucm_destroy_id_resp] 64 id rdma_cm_id 65 reserved const[0, int32] 66} 67 68rdma_ucm_destroy_id_resp { 69 events_reported int32 70} 71 72rdma_ucm_bind_ip { 73 response const[0, int64] 74 addr sockaddr_in6 75 id rdma_cm_id 76} 77 78rdma_ucm_bind { 79 id rdma_cm_id 80 addr_size flags[sockaddr_rdma_cm_lens, int16] 81 reserved const[0, int16] 82 addr sockaddr_rdma_cm 83} 84 85rdma_ucm_resolve_ip { 86 src_addr sockaddr_in6 87 dst_addr sockaddr_in6 88 id rdma_cm_id 89 timeout_ms int32 90} 91 92rdma_ucm_resolve_addr { 93 id rdma_cm_id 94 timeout_ms int32 95 src_size const[0, int16] 96 dst_size const[0, int16] 97 reserved const[0, int32] 98 src_addr sockaddr_rdma_cm 99 dst_addr sockaddr_rdma_cm 100} 101 102rdma_ucm_resolve_route { 103 id rdma_cm_id 104 timeout_ms int32 105} 106 107rdma_ucm_query { 108 response ptr64[out, array[int8, 512]] 109 id rdma_cm_id 110 option flags[rdma_ucm_query_options, int32] 111} 112 113rdma_ucm_query_options = RDMA_USER_CM_QUERY_ADDR, RDMA_USER_CM_QUERY_PATH, RDMA_USER_CM_QUERY_GID 114 115rdma_ucm_connect { 116 conn_param rdma_ucm_conn_param 117 id rdma_cm_id 118 reserved const[0, int32] 119} 120 121rdma_ucm_listen { 122 id rdma_cm_id 123 backlog int32 124} 125 126rdma_ucm_accept { 127 uid rdma_cm_uid 128 conn_param rdma_ucm_conn_param 129 id rdma_cm_id 130 reserved const[0, int32] 131} 132 133rdma_ucm_reject { 134 id rdma_cm_id 135 private_data_len int8[0:RDMA_MAX_PRIVATE_DATA] 136 reserved array[int8, 3] 137 private_data array[int8, RDMA_MAX_PRIVATE_DATA] 138} 139 140rdma_ucm_disconnect { 141 id rdma_cm_id 142} 143 144rdma_ucm_init_qp_attr { 145 response ptr64[out, array[int8, IB_UVERBS_QP_ATTR_SIZE]] 146 id rdma_cm_id 147 qp_state int32 148} 149 150define IB_UVERBS_QP_ATTR_SIZE sizeof(struct ib_uverbs_qp_attr) 151 152rdma_ucm_notify { 153 id rdma_cm_id 154 event flags[ib_event_type, int32] 155} 156 157rdma_ucm_join_ip_mcast { 158 response ptr64[out, rdma_ucm_create_mcast_id_resp] 159 uid rdma_cm_uid 160 addr sockaddr_in6 161 id rdma_cm_id 162} 163 164rdma_ucm_create_mcast_id_resp { 165 id rdma_cm_mcast_id 166} 167 168rdma_ucm_join_mcast { 169 response ptr64[out, rdma_ucm_create_mcast_id_resp] 170 uid rdma_cm_uid 171 id rdma_cm_id 172 addr_size flags[sockaddr_rdma_cm_lens, int16] 173 join_flags flags[rdma_ucm_join_mcast_flags, int16] 174 addr sockaddr_rdma_cm 175} 176 177rdma_ucm_join_mcast_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER, RDMA_MC_JOIN_FLAG_SENDONLY_FULLMEMBER 178 179rdma_ucm_leave_mcast { 180 response ptr64[out, rdma_ucm_destroy_id_resp] 181 id rdma_cm_mcast_id 182 reserved const[0, int32] 183} 184 185rdma_ucm_get_event { 186 response ptr64[out, rdma_ucm_event_resp] 187} 188 189rdma_ucm_event_resp { 190 uid rdma_cm_uid 191 id rdma_cm_uid 192} [size[RDMA_UCM_EVENT_RESP_SIZE]] 193 194define RDMA_UCM_EVENT_RESP_SIZE sizeof(struct rdma_ucm_event_resp) 195 196rdma_ucm_set_option [ 197 id_tos rdma_ucm_set_option_t[RDMA_OPTION_ID, RDMA_OPTION_ID_TOS, int8] 198 id_resuseaddr rdma_ucm_set_option_t[RDMA_OPTION_ID, RDMA_OPTION_ID_REUSEADDR, bool32] 199 id_afonly rdma_ucm_set_option_t[RDMA_OPTION_ID, RDMA_OPTION_ID_AFONLY, bool32] 200 ib_path rdma_ucm_set_option_t[RDMA_OPTION_IB, RDMA_OPTION_IB_PATH, array[ib_path_rec_data]] 201] 202 203type rdma_ucm_set_option_t[LEVEL, OPTION, DATA] { 204 optval ptr64[in, DATA] 205 id rdma_cm_id 206 level const[LEVEL, int32] 207 optname const[OPTION, int32] 208 optlen bytesize[optval, int32] 209} 210 211ib_path_rec_data { 212 flags flags[ib_path_flags, int32] 213 reserved const[0, int32] 214 path_rec array[int32, 16] 215} 216 217ib_path_flags = IB_PATH_GMP, IB_PATH_PRIMARY, IB_PATH_ALTERNATE, IB_PATH_OUTBOUND, IB_PATH_INBOUND, IB_PATH_INBOUND_REVERSE 218 219rdma_ucm_migrate_id { 220 response ptr64[out, rdma_ucm_migrate_resp] 221 id rdma_cm_id 222 fd fd_rdma_cm 223} 224 225rdma_ucm_migrate_resp { 226 events_reported int32 227} 228 229rdma_ucm_conn_param { 230 qp_num int32 231 qkey int32 232 private_data array[int8, RDMA_MAX_PRIVATE_DATA] 233 private_data_len int8[0:RDMA_MAX_PRIVATE_DATA] 234 srq int8 235 responder_resources int8 236 initiator_depth int8 237 flow_control int8 238 retry_count int8 239 rnr_retry_count int8 240 valid bool8 241} 242 243define IB_UVERBS_AH_ATTR_SIZE sizeof(struct ib_uverbs_ah_attr) 244 245sockaddr_rdma_cm [ 246 in sockaddr_in 247 in6 sockaddr_in6 248 ib sockaddr_ib 249] [size[SOCKADDR_STORAGE_SIZE]] 250 251sockaddr_rdma_cm_lens = 16, 28, 48 252 253sockaddr_ib { 254 sib_family const[AF_IB, int16] 255 sib_pkey int16be 256 sib_flowinfo int32be 257 sib_addr ib_addr 258 sib_sid int64be 259 sib_sid_mask int64be 260 sib_scope_id int64 261} 262 263# TODO: not completely clear what's in ib_addr.data. 264ib_addr { 265 data array[int8, 16] 266} [align_8] 267 268rdma_port_space = RDMA_PS_IPOIB, RDMA_PS_IB, RDMA_PS_TCP, RDMA_PS_UDP 269ib_qp_type = IB_QPT_SMI, IB_QPT_GSI, IB_QPT_RC, IB_QPT_UC, IB_QPT_UD, IB_QPT_RAW_IPV6, IB_QPT_RAW_ETHERTYPE, IB_QPT_RAW_PACKET, IB_QPT_XRC_INI, IB_QPT_XRC_TGT, IB_QPT_MAX, IB_QPT_RESERVED1, IB_QPT_RESERVED10 270ib_event_type = IB_EVENT_CQ_ERR, IB_EVENT_QP_FATAL, IB_EVENT_QP_REQ_ERR, IB_EVENT_QP_ACCESS_ERR, IB_EVENT_COMM_EST, IB_EVENT_SQ_DRAINED, IB_EVENT_PATH_MIG, IB_EVENT_PATH_MIG_ERR, IB_EVENT_DEVICE_FATAL, IB_EVENT_PORT_ACTIVE, IB_EVENT_PORT_ERR, IB_EVENT_LID_CHANGE, IB_EVENT_PKEY_CHANGE, IB_EVENT_SM_CHANGE, IB_EVENT_SRQ_ERR, IB_EVENT_SRQ_LIMIT_REACHED, IB_EVENT_QP_LAST_WQE_REACHED, IB_EVENT_CLIENT_REREGISTER, IB_EVENT_GID_CHANGE, IB_EVENT_WQ_FATAL 271