Create callback function to support the nvdimm_security_ops() ->unlock()
callback. Translate the operation to send "Unlock" security command for CXL
mem device.
When the mem device is unlocked, cpu_cache_invalidate_memregion() is called
in order to invalidate all CPU caches before attempting to access the mem
device.
See CXL rev3.0 spec section 8.2.9.8.6.4 for reference.
Reviewed-by: Davidlohr Bueso <d...@stgolabs.net>
Reviewed-by: Jonathan Cameron <jonathan.came...@huawei.com>
Signed-off-by: Dave Jiang <dave.ji...@intel.com>
---
drivers/cxl/core/mbox.c | 1 +
drivers/cxl/cxlmem.h | 1 +
drivers/cxl/security.c | 27 +++++++++++++++++++++++++++
include/uapi/linux/cxl_mem.h | 1 +
4 files changed, 30 insertions(+)
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 6b8f118b2604..243b01e2de85 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -69,6 +69,7 @@ static struct cxl_mem_command
cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = {
CXL_CMD(SET_PASSPHRASE, 0x60, 0, 0),
CXL_CMD(DISABLE_PASSPHRASE, 0x40, 0, 0),
CXL_CMD(FREEZE_SECURITY, 0, 0, 0),
+ CXL_CMD(UNLOCK, 0x20, 0, 0),
};
/*
diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
index 9007158969fe..4e6897e8eb7d 100644
--- a/drivers/cxl/cxlmem.h
+++ b/drivers/cxl/cxlmem.h
@@ -276,6 +276,7 @@ enum cxl_opcode {
CXL_MBOX_OP_GET_SECURITY_STATE = 0x4500,
CXL_MBOX_OP_SET_PASSPHRASE = 0x4501,
CXL_MBOX_OP_DISABLE_PASSPHRASE = 0x4502,
+ CXL_MBOX_OP_UNLOCK = 0x4503,
CXL_MBOX_OP_FREEZE_SECURITY = 0x4504,
CXL_MBOX_OP_MAX = 0x10000
};
diff --git a/drivers/cxl/security.c b/drivers/cxl/security.c
index d991cbee3531..cf20d58ac1b3 100644
--- a/drivers/cxl/security.c
+++ b/drivers/cxl/security.c
@@ -5,6 +5,7 @@
#include <linux/module.h>
#include <linux/async.h>
#include <linux/slab.h>
+#include <linux/memregion.h>
#include "cxlmem.h"
#include "cxl.h"
@@ -104,11 +105,37 @@ static int cxl_pmem_security_freeze(struct nvdimm *nvdimm)
return cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_FREEZE_SECURITY, NULL, 0,
NULL, 0);
}
+static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
+ const struct nvdimm_key_data *key_data)
+{
+ struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
+ struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
+ struct cxl_dev_state *cxlds = cxlmd->cxlds;
+ u8 pass[NVDIMM_PASSPHRASE_LEN];
+ int rc;
+
+ if (!cpu_cache_has_invalidate_memregion())
+ return -EINVAL;
+
+ memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN);
+ rc = cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_UNLOCK,
+ pass, NVDIMM_PASSPHRASE_LEN, NULL, 0);
+ if (rc < 0)
+ return rc;
+
+ /* DIMM unlocked, invalidate all CPU caches before we read it */
+ cpu_cache_invalidate_memregion(IORES_DESC_PERSISTENT_MEMORY);
+ return 0;
+}
+
static const struct nvdimm_security_ops __cxl_security_ops = {
.get_flags = cxl_pmem_get_security_flags,
.change_key = cxl_pmem_security_change_key,
.disable = cxl_pmem_security_disable,
.freeze = cxl_pmem_security_freeze,
+ .unlock = cxl_pmem_security_unlock,
};
const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;
+
+MODULE_IMPORT_NS(DEVMEM);
diff --git a/include/uapi/linux/cxl_mem.h b/include/uapi/linux/cxl_mem.h
index 7c0adcd68f4c..95dca8d4584f 100644
--- a/include/uapi/linux/cxl_mem.h
+++ b/include/uapi/linux/cxl_mem.h
@@ -45,6 +45,7 @@
___C(SET_PASSPHRASE, "Set Passphrase"), \
___C(DISABLE_PASSPHRASE, "Disable Passphrase"), \
___C(FREEZE_SECURITY, "Freeze Security"), \
+ ___C(UNLOCK, "Unlock"), \
___C(MAX, "invalid / last command")
#define ___C(a, b) CXL_MEM_COMMAND_ID_##a
