github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-31 18:43:33 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

cxl/pmem: Add "Passphrase Secure Erase" security command support

Browse Source 
Create callback function to support the nvdimm_security_ops() ->erase()
callback. Translate the operation to send "Passphrase Secure Erase"
security command for CXL memory device.

When the mem device is secure erased, cpu_cache_invalidate_memregion() is
called in order to invalidate all CPU caches before attempting to access
the mem device again.

See CXL 3.0 spec section 8.2.9.8.6.6 for reference.

Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/166983615293.2734609.10358657600295932156.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Dave Jiang 2022-11-30 12:22:32 -07:00 committed by Dan Williams
parent 8e80b18664
commit 3b502e886d
4 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/cxl/core/mbox.c
View File

@ -70,6 +70,7 @@ static struct cxl_mem_command cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = {
CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),
CXL_CMD(FREEZE_SECURITY, 0, 0, 0),
CXL_CMD(UNLOCK, 0x20, 0, 0),
CXL_CMD(PASSPHRASE_SECURE_ERASE, 0x40, 0, 0),
};
/*

8
drivers/cxl/cxlmem.h
View File

@ -278,6 +278,7 @@ enum cxl_opcode {
CXL_MBOX_OP_DISABLE_PASSPHRASE = 0x4502,
CXL_MBOX_OP_UNLOCK = 0x4503,
CXL_MBOX_OP_FREEZE_SECURITY = 0x4504,
CXL_MBOX_OP_PASSPHRASE_SECURE_ERASE = 0x4505,
CXL_MBOX_OP_MAX = 0x10000
};
@ -400,6 +401,13 @@ struct cxl_disable_pass {
u8 pass[NVDIMM_PASSPHRASE_LEN];
} __packed;
/* passphrase secure erase payload */
struct cxl_pass_erase {
u8 type;
u8 reserved[31];
u8 pass[NVDIMM_PASSPHRASE_LEN];
} __packed;
enum {
CXL_PMEM_SEC_PASS_MASTER = 0,
CXL_PMEM_SEC_PASS_USER,

29
drivers/cxl/security.c
View File

@ -120,12 +120,41 @@ static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
return 0;
}
static int cxl_pmem_security_passphrase_erase(struct nvdimm *nvdimm,
const struct nvdimm_key_data *key,
enum nvdimm_passphrase_type ptype)
{
struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
struct cxl_dev_state *cxlds = cxlmd->cxlds;
struct cxl_pass_erase erase;
int rc;
if (!cpu_cache_has_invalidate_memregion())
return -EINVAL;
erase.type = ptype == NVDIMM_MASTER ?
CXL_PMEM_SEC_PASS_MASTER : CXL_PMEM_SEC_PASS_USER;
memcpy(erase.pass, key->data, NVDIMM_PASSPHRASE_LEN);
/* Flush all cache before we erase mem device */
cpu_cache_invalidate_memregion(IORES_DESC_PERSISTENT_MEMORY);
rc = cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_PASSPHRASE_SECURE_ERASE,
&erase, sizeof(erase), NULL, 0);
if (rc < 0)
return rc;
/* mem device erased, invalidate all CPU caches before data is read */
cpu_cache_invalidate_memregion(IORES_DESC_PERSISTENT_MEMORY);
return 0;
}
static const struct nvdimm_security_ops __cxl_security_ops = {
.get_flags = cxl_pmem_get_security_flags,
.change_key = cxl_pmem_security_change_key,
.disable = cxl_pmem_security_disable,
.freeze = cxl_pmem_security_freeze,
.unlock = cxl_pmem_security_unlock,
.erase = cxl_pmem_security_passphrase_erase,
};
const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;

1
include/uapi/linux/cxl_mem.h
View File

@ -46,6 +46,7 @@
___C(DISABLE_PASSPHRASE, "Disable Passphrase"), \
___C(FREEZE_SECURITY, "Freeze Security"), \
___C(UNLOCK, "Unlock"), \
___C(PASSPHRASE_SECURE_ERASE, "Passphrase Secure Erase"), \
___C(MAX, "invalid / last command")
#define ___C(a, b) CXL_MEM_COMMAND_ID_##a