1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* Copyright(c) 2022 Intel Corporation. All rights reserved. */ |
3 | #include <linux/libnvdimm.h> |
4 | #include <asm/unaligned.h> |
5 | #include <linux/module.h> |
6 | #include <linux/async.h> |
7 | #include <linux/slab.h> |
8 | #include <linux/memregion.h> |
9 | #include "cxlmem.h" |
10 | #include "cxl.h" |
11 | |
12 | static unsigned long cxl_pmem_get_security_flags(struct nvdimm *nvdimm, |
13 | enum nvdimm_passphrase_type ptype) |
14 | { |
15 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
16 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
17 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
18 | unsigned long security_flags = 0; |
19 | struct cxl_get_security_output { |
20 | __le32 flags; |
21 | } out; |
22 | struct cxl_mbox_cmd mbox_cmd; |
23 | u32 sec_out; |
24 | int rc; |
25 | |
26 | mbox_cmd = (struct cxl_mbox_cmd) { |
27 | .opcode = CXL_MBOX_OP_GET_SECURITY_STATE, |
28 | .size_out = sizeof(out), |
29 | .payload_out = &out, |
30 | }; |
31 | |
32 | rc = cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
33 | if (rc < 0) |
34 | return 0; |
35 | |
36 | sec_out = le32_to_cpu(out.flags); |
37 | /* cache security state */ |
38 | mds->security.state = sec_out; |
39 | |
40 | if (ptype == NVDIMM_MASTER) { |
41 | if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PASS_SET) |
42 | set_bit(nr: NVDIMM_SECURITY_UNLOCKED, addr: &security_flags); |
43 | else |
44 | set_bit(nr: NVDIMM_SECURITY_DISABLED, addr: &security_flags); |
45 | if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PLIMIT) |
46 | set_bit(nr: NVDIMM_SECURITY_FROZEN, addr: &security_flags); |
47 | return security_flags; |
48 | } |
49 | |
50 | if (sec_out & CXL_PMEM_SEC_STATE_USER_PASS_SET) { |
51 | if (sec_out & CXL_PMEM_SEC_STATE_FROZEN || |
52 | sec_out & CXL_PMEM_SEC_STATE_USER_PLIMIT) |
53 | set_bit(nr: NVDIMM_SECURITY_FROZEN, addr: &security_flags); |
54 | |
55 | if (sec_out & CXL_PMEM_SEC_STATE_LOCKED) |
56 | set_bit(nr: NVDIMM_SECURITY_LOCKED, addr: &security_flags); |
57 | else |
58 | set_bit(nr: NVDIMM_SECURITY_UNLOCKED, addr: &security_flags); |
59 | } else { |
60 | set_bit(nr: NVDIMM_SECURITY_DISABLED, addr: &security_flags); |
61 | } |
62 | |
63 | return security_flags; |
64 | } |
65 | |
66 | static int cxl_pmem_security_change_key(struct nvdimm *nvdimm, |
67 | const struct nvdimm_key_data *old_data, |
68 | const struct nvdimm_key_data *new_data, |
69 | enum nvdimm_passphrase_type ptype) |
70 | { |
71 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
72 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
73 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
74 | struct cxl_mbox_cmd mbox_cmd; |
75 | struct cxl_set_pass set_pass; |
76 | |
77 | set_pass = (struct cxl_set_pass) { |
78 | .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER : |
79 | CXL_PMEM_SEC_PASS_USER, |
80 | }; |
81 | memcpy(set_pass.old_pass, old_data->data, NVDIMM_PASSPHRASE_LEN); |
82 | memcpy(set_pass.new_pass, new_data->data, NVDIMM_PASSPHRASE_LEN); |
83 | |
84 | mbox_cmd = (struct cxl_mbox_cmd) { |
85 | .opcode = CXL_MBOX_OP_SET_PASSPHRASE, |
86 | .size_in = sizeof(set_pass), |
87 | .payload_in = &set_pass, |
88 | }; |
89 | |
90 | return cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
91 | } |
92 | |
93 | static int __cxl_pmem_security_disable(struct nvdimm *nvdimm, |
94 | const struct nvdimm_key_data *key_data, |
95 | enum nvdimm_passphrase_type ptype) |
96 | { |
97 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
98 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
99 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
100 | struct cxl_disable_pass dis_pass; |
101 | struct cxl_mbox_cmd mbox_cmd; |
102 | |
103 | dis_pass = (struct cxl_disable_pass) { |
104 | .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER : |
105 | CXL_PMEM_SEC_PASS_USER, |
106 | }; |
107 | memcpy(dis_pass.pass, key_data->data, NVDIMM_PASSPHRASE_LEN); |
108 | |
109 | mbox_cmd = (struct cxl_mbox_cmd) { |
110 | .opcode = CXL_MBOX_OP_DISABLE_PASSPHRASE, |
111 | .size_in = sizeof(dis_pass), |
112 | .payload_in = &dis_pass, |
113 | }; |
114 | |
115 | return cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
116 | } |
117 | |
118 | static int cxl_pmem_security_disable(struct nvdimm *nvdimm, |
119 | const struct nvdimm_key_data *key_data) |
120 | { |
121 | return __cxl_pmem_security_disable(nvdimm, key_data, ptype: NVDIMM_USER); |
122 | } |
123 | |
124 | static int cxl_pmem_security_disable_master(struct nvdimm *nvdimm, |
125 | const struct nvdimm_key_data *key_data) |
126 | { |
127 | return __cxl_pmem_security_disable(nvdimm, key_data, ptype: NVDIMM_MASTER); |
128 | } |
129 | |
130 | static int cxl_pmem_security_freeze(struct nvdimm *nvdimm) |
131 | { |
132 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
133 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
134 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
135 | struct cxl_mbox_cmd mbox_cmd = { |
136 | .opcode = CXL_MBOX_OP_FREEZE_SECURITY, |
137 | }; |
138 | |
139 | return cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
140 | } |
141 | |
142 | static int cxl_pmem_security_unlock(struct nvdimm *nvdimm, |
143 | const struct nvdimm_key_data *key_data) |
144 | { |
145 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
146 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
147 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
148 | u8 pass[NVDIMM_PASSPHRASE_LEN]; |
149 | struct cxl_mbox_cmd mbox_cmd; |
150 | int rc; |
151 | |
152 | memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN); |
153 | mbox_cmd = (struct cxl_mbox_cmd) { |
154 | .opcode = CXL_MBOX_OP_UNLOCK, |
155 | .size_in = NVDIMM_PASSPHRASE_LEN, |
156 | .payload_in = pass, |
157 | }; |
158 | |
159 | rc = cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
160 | if (rc < 0) |
161 | return rc; |
162 | |
163 | return 0; |
164 | } |
165 | |
166 | static int cxl_pmem_security_passphrase_erase(struct nvdimm *nvdimm, |
167 | const struct nvdimm_key_data *key, |
168 | enum nvdimm_passphrase_type ptype) |
169 | { |
170 | struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); |
171 | struct cxl_memdev *cxlmd = cxl_nvd->cxlmd; |
172 | struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds: cxlmd->cxlds); |
173 | struct cxl_mbox_cmd mbox_cmd; |
174 | struct cxl_pass_erase erase; |
175 | int rc; |
176 | |
177 | erase = (struct cxl_pass_erase) { |
178 | .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER : |
179 | CXL_PMEM_SEC_PASS_USER, |
180 | }; |
181 | memcpy(erase.pass, key->data, NVDIMM_PASSPHRASE_LEN); |
182 | mbox_cmd = (struct cxl_mbox_cmd) { |
183 | .opcode = CXL_MBOX_OP_PASSPHRASE_SECURE_ERASE, |
184 | .size_in = sizeof(erase), |
185 | .payload_in = &erase, |
186 | }; |
187 | |
188 | rc = cxl_internal_send_cmd(mds, cmd: &mbox_cmd); |
189 | if (rc < 0) |
190 | return rc; |
191 | |
192 | return 0; |
193 | } |
194 | |
195 | static const struct nvdimm_security_ops __cxl_security_ops = { |
196 | .get_flags = cxl_pmem_get_security_flags, |
197 | .change_key = cxl_pmem_security_change_key, |
198 | .disable = cxl_pmem_security_disable, |
199 | .freeze = cxl_pmem_security_freeze, |
200 | .unlock = cxl_pmem_security_unlock, |
201 | .erase = cxl_pmem_security_passphrase_erase, |
202 | .disable_master = cxl_pmem_security_disable_master, |
203 | }; |
204 | |
205 | const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops; |
206 | |