[PATCH RFC 13/15] cxl/pmem: Add "Passphrase Secure Erase" security command support

[Dave Jiang]

Create callback function to support the nvdimm_security_ops() ->erase()
callback. Translate the operation to send "Passphrase Secure Erase"
security command for CXL memory device.

When the mem device is secure erased, arch_invalidate_nvdimm_cache() is
called in order to invalidate all CPU caches before attempting to access
the mem device again.

See CXL 2.0 spec section 8.2.9.5.6.6 for reference.

Signed-off-by: Dave Jiang <dave.ji...@intel.com>
---
 drivers/cxl/cxlmem.h   |    8 ++++++++
 drivers/cxl/security.c |   29 +++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
index ae8ccd484491..4bcb02f625b4 100644
--- a/drivers/cxl/cxlmem.h
+++ b/drivers/cxl/cxlmem.h
@@ -255,6 +255,7 @@ enum cxl_opcode {
        CXL_MBOX_OP_DISABLE_PASSPHRASE  = 0x4502,
        CXL_MBOX_OP_UNLOCK              = 0x4503,
        CXL_MBOX_OP_FREEZE_SECURITY     = 0x4504,
+       CXL_MBOX_OP_PASSPHRASE_ERASE    = 0x4505,
        CXL_MBOX_OP_MAX                 = 0x10000
 };
 
@@ -369,6 +370,13 @@ struct cxl_disable_pass {
        u8 pass[NVDIMM_PASSPHRASE_LEN];
 } __packed;
 
+/* passphrase erase payload */
+struct cxl_pass_erase {
+       u8 type;
+       u8 reserved[31];
+       u8 pass[NVDIMM_PASSPHRASE_LEN];
+} __packed;
+
 enum {
        CXL_PMEM_SEC_PASS_MASTER = 0,
        CXL_PMEM_SEC_PASS_USER,
diff --git a/drivers/cxl/security.c b/drivers/cxl/security.c
index d15520f280f0..4add7f62e758 100644
--- a/drivers/cxl/security.c
+++ b/drivers/cxl/security.c
@@ -134,12 +134,41 @@ static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
        return 0;
 }
 
+static int cxl_pmem_security_passphrase_erase(struct nvdimm *nvdimm,
+                                             const struct nvdimm_key_data *key,
+                                             enum nvdimm_passphrase_type ptype)
+{
+       struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
+       struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
+       struct cxl_dev_state *cxlds = cxlmd->cxlds;
+       struct cxl_pass_erase *erase;
+       int rc;
+
+       erase = kzalloc(sizeof(*erase), GFP_KERNEL);
+       if (!erase)
+               return -ENOMEM;
+
+       erase->type = ptype == NVDIMM_MASTER ?
+               CXL_PMEM_SEC_PASS_MASTER : CXL_PMEM_SEC_PASS_USER;
+       memcpy(erase->pass, key->data, NVDIMM_PASSPHRASE_LEN);
+       rc =  cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_PASSPHRASE_ERASE,
+                               erase, sizeof(*erase), NULL, 0);
+       kfree(erase);
+       if (rc < 0)
+               return rc;
+
+       /* DIMM erased, invalidate all CPU caches before we read it */
+       arch_invalidate_nvdimm_cache();
+       return 0;
+}
+
 static const struct nvdimm_security_ops __cxl_security_ops = {
        .get_flags = cxl_pmem_get_security_flags,
        .change_key = cxl_pmem_security_change_key,
        .disable = cxl_pmem_security_disable,
        .freeze = cxl_pmem_security_freeze,
        .unlock = cxl_pmem_security_unlock,
+       .erase = cxl_pmem_security_passphrase_erase,
 };
 
 const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;