cxl/pmem: Add "Unlock" security command support

Create callback function to support the nvdimm_security_ops() ->unlock() callback. Translate the operation to send "Unlock" security command for CXL mem device. When the mem device is unlocked, cpu_cache_invalidate_memregion() is called in order to invalidate all CPU caches before attempting to access the mem device. See CXL rev3.0 spec section 8.2.9.8.6.4 for reference.

Dave Jiang committed 3 years ago

Commit 2bb692f1 parent 410926e4 files · +30 −0Browse files

Unified · Split

4 files

drivers/cxl/core/mbox.c +1 −0
drivers/cxl/cxlmem.h +1 −0
drivers/cxl/security.c +27 −0
include/uapi/linux/cxl_mem.h +1 −0

drivers/cxl/core/mbox.c+1−0

@@ -69,6 +69,7 @@ static struct cxl_mem_command cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = { · 68 unmodified lines
69	CXL_CMD(SET_PASSPHRASE, 0x60, 0, 0),	69	CXL_CMD(SET_PASSPHRASE, 0x60, 0, 0),
70	CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),	70	CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),
71	CXL_CMD(FREEZE_SECURITY, 0, 0, 0),	71	CXL_CMD(FREEZE_SECURITY, 0, 0, 0),
		72	CXL_CMD(UNLOCK, 0x20, 0, 0),
72	};	73	};
73		74
74	/*	75	/*

drivers/cxl/cxlmem.h+1−0

@@ -276,6 +276,7 @@ enum cxl_opcode { · 275 unmodified lines
276	CXL_MBOX_OP_GET_SECURITY_STATE = 0x4500,	276	CXL_MBOX_OP_GET_SECURITY_STATE = 0x4500,
277	CXL_MBOX_OP_SET_PASSPHRASE = 0x4501,	277	CXL_MBOX_OP_SET_PASSPHRASE = 0x4501,
278	CXL_MBOX_OP_DISABLE_PASSPHRASE = 0x4502,	278	CXL_MBOX_OP_DISABLE_PASSPHRASE = 0x4502,
		279	CXL_MBOX_OP_UNLOCK = 0x4503,
279	CXL_MBOX_OP_FREEZE_SECURITY = 0x4504,	280	CXL_MBOX_OP_FREEZE_SECURITY = 0x4504,
280	CXL_MBOX_OP_MAX = 0x10000	281	CXL_MBOX_OP_MAX = 0x10000
281	};	282	};

drivers/cxl/security.c+27−0

@@ -5,6 +5,7 @@ · 4 unmodified lines
5	#include <linux/module.h>	5	#include <linux/module.h>
6	#include <linux/async.h>	6	#include <linux/async.h>
7	#include <linux/slab.h>	7	#include <linux/slab.h>
		8	#include <linux/memregion.h>
8	#include "cxlmem.h"	9	#include "cxlmem.h"
9	#include "cxl.h"	10	#include "cxl.h"
10		11
@@ -96,11 +97,37 @@ static int cxl_pmem_security_freeze(struct nvdimm *nvdimm) · 85 unmodified lines
96	return cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_FREEZE_SECURITY, NULL, 0, NULL, 0);	97	return cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_FREEZE_SECURITY, NULL, 0, NULL, 0);
97	}	98	}
98		99
		100	static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
		101	const struct nvdimm_key_data *key_data)
		102	{
		103	struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
		104	struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
		105	struct cxl_dev_state *cxlds = cxlmd->cxlds;
		106	u8 pass[NVDIMM_PASSPHRASE_LEN];
		107	int rc;
		108
		109	if (!cpu_cache_has_invalidate_memregion())
		110	return -EINVAL;
		111
		112	memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN);
		113	rc = cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_UNLOCK,
		114	pass, NVDIMM_PASSPHRASE_LEN, NULL, 0);
		115	if (rc < 0)
		116	return rc;
		117
		118	/* DIMM unlocked, invalidate all CPU caches before we read it */
		119	cpu_cache_invalidate_memregion(IORES_DESC_PERSISTENT_MEMORY);
		120	return 0;
		121	}
		122
99	static const struct nvdimm_security_ops __cxl_security_ops = {	123	static const struct nvdimm_security_ops __cxl_security_ops = {
100	.get_flags = cxl_pmem_get_security_flags,	124	.get_flags = cxl_pmem_get_security_flags,
101	.change_key = cxl_pmem_security_change_key,	125	.change_key = cxl_pmem_security_change_key,
102	.disable = cxl_pmem_security_disable,	126	.disable = cxl_pmem_security_disable,
103	.freeze = cxl_pmem_security_freeze,	127	.freeze = cxl_pmem_security_freeze,
		128	.unlock = cxl_pmem_security_unlock,
104	};	129	};
105		130
106	const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;	131	const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;
		132
		133	MODULE_IMPORT_NS(DEVMEM);

include/uapi/linux/cxl_mem.h+1−0

@@ -45,6 +45,7 @@ · 44 unmodified lines
45	___C(SET_PASSPHRASE, "Set Passphrase"), \	45	___C(SET_PASSPHRASE, "Set Passphrase"), \
46	___C(DISABLE_PASSPHRASE, "Disable Passphrase"), \	46	___C(DISABLE_PASSPHRASE, "Disable Passphrase"), \
47	___C(FREEZE_SECURITY, "Freeze Security"), \	47	___C(FREEZE_SECURITY, "Freeze Security"), \
		48	___C(UNLOCK, "Unlock"), \
48	___C(MAX, "invalid / last command")	49	___C(MAX, "invalid / last command")
49		50
50	#define ___C(a, b) CXL_MEM_COMMAND_ID_##a	51	#define ___C(a, b) CXL_MEM_COMMAND_ID_##a

cxl/pmem: Add "Unlock" security command support

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code