1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright(c) 2022 Intel Corporation. All rights reserved. */
3 #include <linux/libnvdimm.h>
4 #include <asm/unaligned.h>
5 #include <linux/module.h>
6 #include <linux/async.h>
7 #include <linux/slab.h>
8 #include <linux/memregion.h>
9 #include "cxlmem.h"
10 #include "cxl.h"
11
cxl_pmem_get_security_flags(struct nvdimm * nvdimm,enum nvdimm_passphrase_type ptype)12 static unsigned long cxl_pmem_get_security_flags(struct nvdimm *nvdimm,
13 enum nvdimm_passphrase_type ptype)
14 {
15 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
16 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
17 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
18 unsigned long security_flags = 0;
19 struct cxl_get_security_output {
20 __le32 flags;
21 } out;
22 struct cxl_mbox_cmd mbox_cmd;
23 u32 sec_out;
24 int rc;
25
26 mbox_cmd = (struct cxl_mbox_cmd) {
27 .opcode = CXL_MBOX_OP_GET_SECURITY_STATE,
28 .size_out = sizeof(out),
29 .payload_out = &out,
30 };
31
32 rc = cxl_internal_send_cmd(mds, &mbox_cmd);
33 if (rc < 0)
34 return 0;
35
36 sec_out = le32_to_cpu(out.flags);
37 /* cache security state */
38 mds->security.state = sec_out;
39
40 if (ptype == NVDIMM_MASTER) {
41 if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PASS_SET)
42 set_bit(NVDIMM_SECURITY_UNLOCKED, &security_flags);
43 else
44 set_bit(NVDIMM_SECURITY_DISABLED, &security_flags);
45 if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PLIMIT)
46 set_bit(NVDIMM_SECURITY_FROZEN, &security_flags);
47 return security_flags;
48 }
49
50 if (sec_out & CXL_PMEM_SEC_STATE_USER_PASS_SET) {
51 if (sec_out & CXL_PMEM_SEC_STATE_FROZEN ||
52 sec_out & CXL_PMEM_SEC_STATE_USER_PLIMIT)
53 set_bit(NVDIMM_SECURITY_FROZEN, &security_flags);
54
55 if (sec_out & CXL_PMEM_SEC_STATE_LOCKED)
56 set_bit(NVDIMM_SECURITY_LOCKED, &security_flags);
57 else
58 set_bit(NVDIMM_SECURITY_UNLOCKED, &security_flags);
59 } else {
60 set_bit(NVDIMM_SECURITY_DISABLED, &security_flags);
61 }
62
63 return security_flags;
64 }
65
cxl_pmem_security_change_key(struct nvdimm * nvdimm,const struct nvdimm_key_data * old_data,const struct nvdimm_key_data * new_data,enum nvdimm_passphrase_type ptype)66 static int cxl_pmem_security_change_key(struct nvdimm *nvdimm,
67 const struct nvdimm_key_data *old_data,
68 const struct nvdimm_key_data *new_data,
69 enum nvdimm_passphrase_type ptype)
70 {
71 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
72 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
73 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
74 struct cxl_mbox_cmd mbox_cmd;
75 struct cxl_set_pass set_pass;
76
77 set_pass = (struct cxl_set_pass) {
78 .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
79 CXL_PMEM_SEC_PASS_USER,
80 };
81 memcpy(set_pass.old_pass, old_data->data, NVDIMM_PASSPHRASE_LEN);
82 memcpy(set_pass.new_pass, new_data->data, NVDIMM_PASSPHRASE_LEN);
83
84 mbox_cmd = (struct cxl_mbox_cmd) {
85 .opcode = CXL_MBOX_OP_SET_PASSPHRASE,
86 .size_in = sizeof(set_pass),
87 .payload_in = &set_pass,
88 };
89
90 return cxl_internal_send_cmd(mds, &mbox_cmd);
91 }
92
__cxl_pmem_security_disable(struct nvdimm * nvdimm,const struct nvdimm_key_data * key_data,enum nvdimm_passphrase_type ptype)93 static int __cxl_pmem_security_disable(struct nvdimm *nvdimm,
94 const struct nvdimm_key_data *key_data,
95 enum nvdimm_passphrase_type ptype)
96 {
97 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
98 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
99 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
100 struct cxl_disable_pass dis_pass;
101 struct cxl_mbox_cmd mbox_cmd;
102
103 dis_pass = (struct cxl_disable_pass) {
104 .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
105 CXL_PMEM_SEC_PASS_USER,
106 };
107 memcpy(dis_pass.pass, key_data->data, NVDIMM_PASSPHRASE_LEN);
108
109 mbox_cmd = (struct cxl_mbox_cmd) {
110 .opcode = CXL_MBOX_OP_DISABLE_PASSPHRASE,
111 .size_in = sizeof(dis_pass),
112 .payload_in = &dis_pass,
113 };
114
115 return cxl_internal_send_cmd(mds, &mbox_cmd);
116 }
117
cxl_pmem_security_disable(struct nvdimm * nvdimm,const struct nvdimm_key_data * key_data)118 static int cxl_pmem_security_disable(struct nvdimm *nvdimm,
119 const struct nvdimm_key_data *key_data)
120 {
121 return __cxl_pmem_security_disable(nvdimm, key_data, NVDIMM_USER);
122 }
123
cxl_pmem_security_disable_master(struct nvdimm * nvdimm,const struct nvdimm_key_data * key_data)124 static int cxl_pmem_security_disable_master(struct nvdimm *nvdimm,
125 const struct nvdimm_key_data *key_data)
126 {
127 return __cxl_pmem_security_disable(nvdimm, key_data, NVDIMM_MASTER);
128 }
129
cxl_pmem_security_freeze(struct nvdimm * nvdimm)130 static int cxl_pmem_security_freeze(struct nvdimm *nvdimm)
131 {
132 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
133 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
134 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
135 struct cxl_mbox_cmd mbox_cmd = {
136 .opcode = CXL_MBOX_OP_FREEZE_SECURITY,
137 };
138
139 return cxl_internal_send_cmd(mds, &mbox_cmd);
140 }
141
cxl_pmem_security_unlock(struct nvdimm * nvdimm,const struct nvdimm_key_data * key_data)142 static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
143 const struct nvdimm_key_data *key_data)
144 {
145 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
146 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
147 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
148 u8 pass[NVDIMM_PASSPHRASE_LEN];
149 struct cxl_mbox_cmd mbox_cmd;
150 int rc;
151
152 memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN);
153 mbox_cmd = (struct cxl_mbox_cmd) {
154 .opcode = CXL_MBOX_OP_UNLOCK,
155 .size_in = NVDIMM_PASSPHRASE_LEN,
156 .payload_in = pass,
157 };
158
159 rc = cxl_internal_send_cmd(mds, &mbox_cmd);
160 if (rc < 0)
161 return rc;
162
163 return 0;
164 }
165
cxl_pmem_security_passphrase_erase(struct nvdimm * nvdimm,const struct nvdimm_key_data * key,enum nvdimm_passphrase_type ptype)166 static int cxl_pmem_security_passphrase_erase(struct nvdimm *nvdimm,
167 const struct nvdimm_key_data *key,
168 enum nvdimm_passphrase_type ptype)
169 {
170 struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
171 struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
172 struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
173 struct cxl_mbox_cmd mbox_cmd;
174 struct cxl_pass_erase erase;
175 int rc;
176
177 erase = (struct cxl_pass_erase) {
178 .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
179 CXL_PMEM_SEC_PASS_USER,
180 };
181 memcpy(erase.pass, key->data, NVDIMM_PASSPHRASE_LEN);
182 mbox_cmd = (struct cxl_mbox_cmd) {
183 .opcode = CXL_MBOX_OP_PASSPHRASE_SECURE_ERASE,
184 .size_in = sizeof(erase),
185 .payload_in = &erase,
186 };
187
188 rc = cxl_internal_send_cmd(mds, &mbox_cmd);
189 if (rc < 0)
190 return rc;
191
192 return 0;
193 }
194
195 static const struct nvdimm_security_ops __cxl_security_ops = {
196 .get_flags = cxl_pmem_get_security_flags,
197 .change_key = cxl_pmem_security_change_key,
198 .disable = cxl_pmem_security_disable,
199 .freeze = cxl_pmem_security_freeze,
200 .unlock = cxl_pmem_security_unlock,
201 .erase = cxl_pmem_security_passphrase_erase,
202 .disable_master = cxl_pmem_security_disable_master,
203 };
204
205 const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;
206
