Commit 2bb692f7 authored by Dave Jiang's avatar Dave Jiang Committed by Dan Williams
Browse files

cxl/pmem: Add "Unlock" security command support 



Create callback function to support the nvdimm_security_ops() ->unlock()
callback. Translate the operation to send "Unlock" security command for CXL
mem device.

When the mem device is unlocked, cpu_cache_invalidate_memregion() is called
in order to invalidate all CPU caches before attempting to access the mem
device.

See CXL rev3.0 spec section 8.2.9.8.6.4 for reference.

Reviewed-by: default avatarDavidlohr Bueso <dave@stgolabs.net>
Reviewed-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/166983614167.2734609.15124543712487741176.stgit@djiang5-desk3.ch.intel.com


Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent 410926e9

drivers/cxl/core/mbox.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -69,6 +69,7 @@ static struct cxl_mem_command cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = { 
	CXL_CMD(SET_PASSPHRASE, 0x60, 0, 0),

	CXL_CMD(SET_PASSPHRASE, 0x60, 0, 0),

	CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),

	CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),

	CXL_CMD(FREEZE_SECURITY, 0, 0, 0),

	CXL_CMD(FREEZE_SECURITY, 0, 0, 0),

	CXL_CMD(UNLOCK, 0x20, 0, 0),

};

};





/*

/*

drivers/cxl/cxlmem.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -276,6 +276,7 @@ enum cxl_opcode { 
	CXL_MBOX_OP_GET_SECURITY_STATE	= 0x4500,

	CXL_MBOX_OP_GET_SECURITY_STATE	= 0x4500,

	CXL_MBOX_OP_SET_PASSPHRASE	= 0x4501,

	CXL_MBOX_OP_SET_PASSPHRASE	= 0x4501,

	CXL_MBOX_OP_DISABLE_PASSPHRASE	= 0x4502,

	CXL_MBOX_OP_DISABLE_PASSPHRASE	= 0x4502,

	CXL_MBOX_OP_UNLOCK		= 0x4503,

	CXL_MBOX_OP_FREEZE_SECURITY	= 0x4504,

	CXL_MBOX_OP_FREEZE_SECURITY	= 0x4504,

	CXL_MBOX_OP_MAX			= 0x10000

	CXL_MBOX_OP_MAX			= 0x10000

};

};

drivers/cxl/security.c

+27 −0
Original line number Original line Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <linux/module.h>

#include <linux/module.h>

#include <linux/async.h>

#include <linux/async.h>

#include <linux/slab.h>

#include <linux/slab.h>

#include <linux/memregion.h>

#include "cxlmem.h"

#include "cxlmem.h"

#include "cxl.h"

#include "cxl.h"
@@ -96,11 +97,37 @@ static int cxl_pmem_security_freeze(struct nvdimm *nvdimm) 
	return cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_FREEZE_SECURITY, NULL, 0, NULL, 0);

	return cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_FREEZE_SECURITY, NULL, 0, NULL, 0);

}

}





static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,

				    const struct nvdimm_key_data *key_data)

{

	struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);

	struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;

	struct cxl_dev_state *cxlds = cxlmd->cxlds;

	u8 pass[NVDIMM_PASSPHRASE_LEN];

	int rc;



	if (!cpu_cache_has_invalidate_memregion())

		return -EINVAL;



	memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN);

	rc = cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_UNLOCK,

			       pass, NVDIMM_PASSPHRASE_LEN, NULL, 0);

	if (rc < 0)

		return rc;



	/* DIMM unlocked, invalidate all CPU caches before we read it */

	cpu_cache_invalidate_memregion(IORES_DESC_PERSISTENT_MEMORY);

	return 0;

}



static const struct nvdimm_security_ops __cxl_security_ops = {

static const struct nvdimm_security_ops __cxl_security_ops = {

	.get_flags = cxl_pmem_get_security_flags,

	.get_flags = cxl_pmem_get_security_flags,

	.change_key = cxl_pmem_security_change_key,

	.change_key = cxl_pmem_security_change_key,

	.disable = cxl_pmem_security_disable,

	.disable = cxl_pmem_security_disable,

	.freeze = cxl_pmem_security_freeze,

	.freeze = cxl_pmem_security_freeze,

	.unlock = cxl_pmem_security_unlock,

};

};





const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;

const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;



MODULE_IMPORT_NS(DEVMEM);

include/uapi/linux/cxl_mem.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -45,6 +45,7 @@ 
	___C(SET_PASSPHRASE, "Set Passphrase"),				  \

	___C(SET_PASSPHRASE, "Set Passphrase"),				  \

	___C(DISABLE_PASSPHRASE, "Disable Passphrase"),			  \

	___C(DISABLE_PASSPHRASE, "Disable Passphrase"),			  \

	___C(FREEZE_SECURITY, "Freeze Security"),			  \

	___C(FREEZE_SECURITY, "Freeze Security"),			  \

	___C(UNLOCK, "Unlock"),						  \

	___C(MAX, "invalid / last command")

	___C(MAX, "invalid / last command")





#define ___C(a, b) CXL_MEM_COMMAND_ID_##a

#define ___C(a, b) CXL_MEM_COMMAND_ID_##a