Re: [PATCH] sd: add support for TCG OPAL self encrypting disks

[Tejun Heo]

On Mon, Jun 19, 2017 at 02:26:46PM +0200, Christoph Hellwig wrote:
> Just wire up the generic TCG OPAL infrastructure to the SCSI disk driver
> and the Security In/Out commands.
> 
> Note that I don't know of any actual SCSI disks that do support TCG OPAL,
> but this is required to support ATA disks through libata.
> 
> Signed-off-by: Christoph Hellwig 

Applied to libata/for-4.13 w/ Martin's ack added.

Thanks.

-- 
tejun

Re: [PATCH] sd: add support for TCG OPAL self encrypting disks

[Martin K. Petersen]

Tejun,

>> Looks good to me. I'll queue it up for 4.13 as soon as Linus has pulled
>> in the ata bits.
>
> I can route it through libata tree w/ your ack if that's more convenient.

I don't think it will cause any headaches. I'm just a bit cautious since
I already have a ton of conflicts in linux-next for this merge window.

Acked-by: Martin K. Petersen 

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] sd: add support for TCG OPAL self encrypting disks

[Tejun Heo]

On Mon, Jun 26, 2017 at 12:43:27PM -0400, Martin K. Petersen wrote:
> 
> Christoph,
> 
> > ping?
> 
> Looks good to me. I'll queue it up for 4.13 as soon as Linus has pulled
> in the ata bits.

I can route it through libata tree w/ your ack if that's more convenient.

Thanks.

-- 
tejun

Re: [PATCH] sd: add support for TCG OPAL self encrypting disks

[Martin K. Petersen]

Christoph,

> ping?

Looks good to me. I'll queue it up for 4.13 as soon as Linus has pulled
in the ata bits.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] sd: add support for TCG OPAL self encrypting disks

[Christoph Hellwig]

ping?

On Mon, Jun 19, 2017 at 02:26:46PM +0200, Christoph Hellwig wrote:
> Just wire up the generic TCG OPAL infrastructure to the SCSI disk driver
> and the Security In/Out commands.
> 
> Note that I don't know of any actual SCSI disks that do support TCG OPAL,
> but this is required to support ATA disks through libata.
> 
> Signed-off-by: Christoph Hellwig 
> ---
>  drivers/ata/libata-scsi.c  |  3 +++
>  drivers/scsi/sd.c  | 53 
> +-
>  drivers/scsi/sd.h  |  2 ++
>  include/scsi/scsi_device.h |  1 +
>  4 files changed, 58 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
> index 0f788ad6f2f6..3e5ca2e894a4 100644
> --- a/drivers/ata/libata-scsi.c
> +++ b/drivers/ata/libata-scsi.c
> @@ -1321,6 +1321,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
>  
>   blk_queue_flush_queueable(q, false);
>  
> + if (dev->flags & ATA_DFLAG_TRUSTED)
> + sdev->security_supported = 1;
> +
>   dev->sdev = sdev;
>   return 0;
>  }
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index f9d1432d7cc5..5d32fd7d3a3e 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -50,6 +50,7 @@
>  #include 
>  #include 
>  #include 
> +#include 
>  #include 
>  #include 
>  #include 
> @@ -643,6 +644,26 @@ static void scsi_disk_put(struct scsi_disk *sdkp)
>   mutex_unlock(_ref_mutex);
>  }
>  
> +#ifdef CONFIG_BLK_SED_OPAL
> +static int sd_sec_submit(void *data, u16 spsp, u8 secp, void *buffer,
> + size_t len, bool send)
> +{
> + struct scsi_device *sdev = data;
> + u8 cdb[12] = { 0, };
> + int ret;
> +
> + cdb[0] = send ? SECURITY_PROTOCOL_OUT : SECURITY_PROTOCOL_IN;
> + cdb[1] = secp;
> + put_unaligned_be16(spsp, [2]);
> + put_unaligned_be32(len, [6]);
> +
> + ret = scsi_execute_req(sdev, cdb,
> + send ? DMA_TO_DEVICE : DMA_FROM_DEVICE,
> + buffer, len, NULL, SD_TIMEOUT, SD_MAX_RETRIES, NULL);
> + return ret <= 0 ? ret : -EIO;
> +}
> +#endif /* CONFIG_BLK_SED_OPAL */
> +
>  static unsigned char sd_setup_protect_cmnd(struct scsi_cmnd *scmd,
>  unsigned int dix, unsigned int dif)
>  {
> @@ -1439,6 +1460,9 @@ static int sd_ioctl(struct block_device *bdev, fmode_t 
> mode,
>   if (error)
>   goto out;
>  
> + if (is_sed_ioctl(cmd))
> + return sed_ioctl(sdkp->opal_dev, cmd, p);
> +
>   /*
>* Send SCSI addressing ioctls directly to mid level, send other
>* ioctls to block level and then onto mid level if they can't be
> @@ -2994,6 +3018,20 @@ static void sd_read_write_same(struct scsi_disk *sdkp, 
> unsigned char *buffer)
>   sdkp->ws10 = 1;
>  }
>  
> +static void sd_read_security(struct scsi_disk *sdkp, unsigned char *buffer)
> +{
> + struct scsi_device *sdev = sdkp->device;
> +
> + if (!sdev->security_supported)
> + return;
> +
> + if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE,
> + SECURITY_PROTOCOL_IN) == 1 &&
> + scsi_report_opcode(sdev, buffer, SD_BUF_SIZE,
> + SECURITY_PROTOCOL_OUT) == 1)
> + sdkp->security = 1;
> +}
> +
>  /**
>   *   sd_revalidate_disk - called the first time a new disk is seen,
>   *   performs disk spin up, read_capacity, etc.
> @@ -3047,6 +3085,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
>   sd_read_cache_type(sdkp, buffer);
>   sd_read_app_tag_own(sdkp, buffer);
>   sd_read_write_same(sdkp, buffer);
> + sd_read_security(sdkp, buffer);
>   }
>  
>   sdkp->first_scan = 0;
> @@ -3207,6 +3246,12 @@ static void sd_probe_async(void *data, async_cookie_t 
> cookie)
>  
>   sd_revalidate_disk(gd);
>  
> + if (sdkp->security) {
> + sdkp->opal_dev = init_opal_dev(sdp, _sec_submit);
> + if (sdkp->opal_dev)
> + sd_printk(KERN_NOTICE, sdkp, "supports TCG Opal\n");
> + }
> +
>   sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
> sdp->removable ? "removable " : "");
>   scsi_autopm_put_device(sdp);
> @@ -3356,6 +3401,8 @@ static int sd_remove(struct device *dev)
>  
>   sd_zbc_remove(sdkp);
>  
> + free_opal_dev(sdkp->opal_dev);
> +
>   blk_register_region(devt, SD_MINORS, NULL,
>   sd_default_probe, NULL, NULL);
>  
> @@ -3497,6 +3544,7 @@ static int sd_suspend_runtime(struct device *dev)
>  static int sd_resume(struct device *dev)
>  {
>   struct scsi_disk *sdkp = dev_get_drvdata(dev);
> + int ret;
>  
>   if (!sdkp)  /* E.g.: runtime resume at the start of sd_probe() */
>   return 0;
> @@ -3505,7 +3553,10 @@ static int sd_resume(struct device *dev)
>   return 0;
>  
>   sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
> - return 

[PATCH] sd: add support for TCG OPAL self encrypting disks

[Christoph Hellwig]

Just wire up the generic TCG OPAL infrastructure to the SCSI disk driver
and the Security In/Out commands.

Note that I don't know of any actual SCSI disks that do support TCG OPAL,
but this is required to support ATA disks through libata.

Signed-off-by: Christoph Hellwig 
---
 drivers/ata/libata-scsi.c  |  3 +++
 drivers/scsi/sd.c  | 53 +-
 drivers/scsi/sd.h  |  2 ++
 include/scsi/scsi_device.h |  1 +
 4 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 0f788ad6f2f6..3e5ca2e894a4 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1321,6 +1321,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
 
blk_queue_flush_queueable(q, false);
 
+   if (dev->flags & ATA_DFLAG_TRUSTED)
+   sdev->security_supported = 1;
+
dev->sdev = sdev;
return 0;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f9d1432d7cc5..5d32fd7d3a3e 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -50,6 +50,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -643,6 +644,26 @@ static void scsi_disk_put(struct scsi_disk *sdkp)
mutex_unlock(_ref_mutex);
 }
 
+#ifdef CONFIG_BLK_SED_OPAL
+static int sd_sec_submit(void *data, u16 spsp, u8 secp, void *buffer,
+   size_t len, bool send)
+{
+   struct scsi_device *sdev = data;
+   u8 cdb[12] = { 0, };
+   int ret;
+
+   cdb[0] = send ? SECURITY_PROTOCOL_OUT : SECURITY_PROTOCOL_IN;
+   cdb[1] = secp;
+   put_unaligned_be16(spsp, [2]);
+   put_unaligned_be32(len, [6]);
+
+   ret = scsi_execute_req(sdev, cdb,
+   send ? DMA_TO_DEVICE : DMA_FROM_DEVICE,
+   buffer, len, NULL, SD_TIMEOUT, SD_MAX_RETRIES, NULL);
+   return ret <= 0 ? ret : -EIO;
+}
+#endif /* CONFIG_BLK_SED_OPAL */
+
 static unsigned char sd_setup_protect_cmnd(struct scsi_cmnd *scmd,
   unsigned int dix, unsigned int dif)
 {
@@ -1439,6 +1460,9 @@ static int sd_ioctl(struct block_device *bdev, fmode_t 
mode,
if (error)
goto out;
 
+   if (is_sed_ioctl(cmd))
+   return sed_ioctl(sdkp->opal_dev, cmd, p);
+
/*
 * Send SCSI addressing ioctls directly to mid level, send other
 * ioctls to block level and then onto mid level if they can't be
@@ -2994,6 +3018,20 @@ static void sd_read_write_same(struct scsi_disk *sdkp, 
unsigned char *buffer)
sdkp->ws10 = 1;
 }
 
+static void sd_read_security(struct scsi_disk *sdkp, unsigned char *buffer)
+{
+   struct scsi_device *sdev = sdkp->device;
+
+   if (!sdev->security_supported)
+   return;
+
+   if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE,
+   SECURITY_PROTOCOL_IN) == 1 &&
+   scsi_report_opcode(sdev, buffer, SD_BUF_SIZE,
+   SECURITY_PROTOCOL_OUT) == 1)
+   sdkp->security = 1;
+}
+
 /**
  * sd_revalidate_disk - called the first time a new disk is seen,
  * performs disk spin up, read_capacity, etc.
@@ -3047,6 +3085,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
sd_read_cache_type(sdkp, buffer);
sd_read_app_tag_own(sdkp, buffer);
sd_read_write_same(sdkp, buffer);
+   sd_read_security(sdkp, buffer);
}
 
sdkp->first_scan = 0;
@@ -3207,6 +3246,12 @@ static void sd_probe_async(void *data, async_cookie_t 
cookie)
 
sd_revalidate_disk(gd);
 
+   if (sdkp->security) {
+   sdkp->opal_dev = init_opal_dev(sdp, _sec_submit);
+   if (sdkp->opal_dev)
+   sd_printk(KERN_NOTICE, sdkp, "supports TCG Opal\n");
+   }
+
sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
  sdp->removable ? "removable " : "");
scsi_autopm_put_device(sdp);
@@ -3356,6 +3401,8 @@ static int sd_remove(struct device *dev)
 
sd_zbc_remove(sdkp);
 
+   free_opal_dev(sdkp->opal_dev);
+
blk_register_region(devt, SD_MINORS, NULL,
sd_default_probe, NULL, NULL);
 
@@ -3497,6 +3544,7 @@ static int sd_suspend_runtime(struct device *dev)
 static int sd_resume(struct device *dev)
 {
struct scsi_disk *sdkp = dev_get_drvdata(dev);
+   int ret;
 
if (!sdkp)  /* E.g.: runtime resume at the start of sd_probe() */
return 0;
@@ -3505,7 +3553,10 @@ static int sd_resume(struct device *dev)
return 0;
 
sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
-   return sd_start_stop_device(sdkp, 1);
+   ret = sd_start_stop_device(sdkp, 1);
+   if (!ret)
+   opal_unlock_from_suspend(sdkp->opal_dev);
+   return ret;
 }
 
 /**
diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
index