1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright © 2016 Intel Corporation 4 * 5 * Authors: 6 * Scott Bauer <scott.bauer@intel.com> 7 * Rafael Antognolli <rafael.antognolli@intel.com> 8 */ 9 10 #define pr_fmt(fmt) KBUILD_MODNAME ":OPAL: " fmt 11 12 #include <linux/delay.h> 13 #include <linux/device.h> 14 #include <linux/kernel.h> 15 #include <linux/list.h> 16 #include <linux/blkdev.h> 17 #include <linux/slab.h> 18 #include <linux/uaccess.h> 19 #include <uapi/linux/sed-opal.h> 20 #include <linux/sed-opal.h> 21 #include <linux/sed-opal-key.h> 22 #include <linux/string.h> 23 #include <linux/kdev_t.h> 24 #include <linux/key.h> 25 #include <linux/key-type.h> 26 #include <keys/user-type.h> 27 28 #include "opal_proto.h" 29 30 #define IO_BUFFER_LENGTH 2048 31 #define MAX_TOKS 64 32 33 /* Number of bytes needed by cmd_finalize. */ 34 #define CMD_FINALIZE_BYTES_NEEDED 7 35 36 static struct key *sed_opal_keyring; 37 38 struct opal_step { 39 int (*fn)(struct opal_dev *dev, void *data); 40 void *data; 41 }; 42 typedef int (cont_fn)(struct opal_dev *dev); 43 44 enum opal_atom_width { 45 OPAL_WIDTH_TINY, 46 OPAL_WIDTH_SHORT, 47 OPAL_WIDTH_MEDIUM, 48 OPAL_WIDTH_LONG, 49 OPAL_WIDTH_TOKEN 50 }; 51 52 /* 53 * On the parsed response, we don't store again the toks that are already 54 * stored in the response buffer. Instead, for each token, we just store a 55 * pointer to the position in the buffer where the token starts, and the size 56 * of the token in bytes. 57 */ 58 struct opal_resp_tok { 59 const u8 *pos; 60 size_t len; 61 enum opal_response_token type; 62 enum opal_atom_width width; 63 union { 64 u64 u; 65 s64 s; 66 } stored; 67 }; 68 69 /* 70 * From the response header it's not possible to know how many tokens there are 71 * on the payload. So we hardcode that the maximum will be MAX_TOKS, and later 72 * if we start dealing with messages that have more than that, we can increase 73 * this number. This is done to avoid having to make two passes through the 74 * response, the first one counting how many tokens we have and the second one 75 * actually storing the positions. 76 */ 77 struct parsed_resp { 78 int num; 79 struct opal_resp_tok toks[MAX_TOKS]; 80 }; 81 82 struct opal_dev { 83 u32 flags; 84 85 void *data; 86 sec_send_recv *send_recv; 87 88 struct mutex dev_lock; 89 u16 comid; 90 u32 hsn; 91 u32 tsn; 92 u64 align; /* alignment granularity */ 93 u64 lowest_lba; 94 u32 logical_block_size; 95 u8 align_required; /* ALIGN: 0 or 1 */ 96 97 size_t pos; 98 u8 *cmd; 99 u8 *resp; 100 101 struct parsed_resp parsed; 102 size_t prev_d_len; 103 void *prev_data; 104 105 struct list_head unlk_lst; 106 }; 107 108 109 static const u8 opaluid[][OPAL_UID_LENGTH] = { 110 /* users */ 111 [OPAL_SMUID_UID] = 112 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff }, 113 [OPAL_THISSP_UID] = 114 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 115 [OPAL_ADMINSP_UID] = 116 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x01 }, 117 [OPAL_LOCKINGSP_UID] = 118 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x02 }, 119 [OPAL_ENTERPRISE_LOCKINGSP_UID] = 120 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x01, 0x00, 0x01 }, 121 [OPAL_ANYBODY_UID] = 122 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x01 }, 123 [OPAL_SID_UID] = 124 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x06 }, 125 [OPAL_ADMIN1_UID] = 126 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0x01 }, 127 [OPAL_USER1_UID] = 128 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x03, 0x00, 0x01 }, 129 [OPAL_USER2_UID] = 130 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x03, 0x00, 0x02 }, 131 [OPAL_PSID_UID] = 132 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0xff, 0x01 }, 133 [OPAL_ENTERPRISE_BANDMASTER0_UID] = 134 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x80, 0x01 }, 135 [OPAL_ENTERPRISE_ERASEMASTER_UID] = 136 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x84, 0x01 }, 137 138 /* tables */ 139 [OPAL_TABLE_TABLE] = 140 { 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01 }, 141 [OPAL_LOCKINGRANGE_GLOBAL] = 142 { 0x00, 0x00, 0x08, 0x02, 0x00, 0x00, 0x00, 0x01 }, 143 [OPAL_LOCKINGRANGE_ACE_START_TO_KEY] = 144 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xD0, 0x01 }, 145 [OPAL_LOCKINGRANGE_ACE_RDLOCKED] = 146 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xE0, 0x01 }, 147 [OPAL_LOCKINGRANGE_ACE_WRLOCKED] = 148 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xE8, 0x01 }, 149 [OPAL_MBRCONTROL] = 150 { 0x00, 0x00, 0x08, 0x03, 0x00, 0x00, 0x00, 0x01 }, 151 [OPAL_MBR] = 152 { 0x00, 0x00, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00 }, 153 [OPAL_AUTHORITY_TABLE] = 154 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00}, 155 [OPAL_C_PIN_TABLE] = 156 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00}, 157 [OPAL_LOCKING_INFO_TABLE] = 158 { 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x01 }, 159 [OPAL_ENTERPRISE_LOCKING_INFO_TABLE] = 160 { 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00 }, 161 [OPAL_DATASTORE] = 162 { 0x00, 0x00, 0x10, 0x01, 0x00, 0x00, 0x00, 0x00 }, 163 [OPAL_LOCKING_TABLE] = 164 { 0x00, 0x00, 0x08, 0x02, 0x00, 0x00, 0x00, 0x00 }, 165 166 /* C_PIN_TABLE object ID's */ 167 [OPAL_C_PIN_MSID] = 168 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x84, 0x02}, 169 [OPAL_C_PIN_SID] = 170 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x01}, 171 [OPAL_C_PIN_ADMIN1] = 172 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x01, 0x00, 0x01}, 173 174 /* half UID's (only first 4 bytes used) */ 175 [OPAL_HALF_UID_AUTHORITY_OBJ_REF] = 176 { 0x00, 0x00, 0x0C, 0x05, 0xff, 0xff, 0xff, 0xff }, 177 [OPAL_HALF_UID_BOOLEAN_ACE] = 178 { 0x00, 0x00, 0x04, 0x0E, 0xff, 0xff, 0xff, 0xff }, 179 180 /* special value for omitted optional parameter */ 181 [OPAL_UID_HEXFF] = 182 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, 183 }; 184 185 /* 186 * TCG Storage SSC Methods. 187 * Derived from: TCG_Storage_Architecture_Core_Spec_v2.01_r1.00 188 * Section: 6.3 Assigned UIDs 189 */ 190 static const u8 opalmethod[][OPAL_METHOD_LENGTH] = { 191 [OPAL_PROPERTIES] = 192 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01 }, 193 [OPAL_STARTSESSION] = 194 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02 }, 195 [OPAL_REVERT] = 196 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x02, 0x02 }, 197 [OPAL_ACTIVATE] = 198 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x02, 0x03 }, 199 [OPAL_EGET] = 200 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06 }, 201 [OPAL_ESET] = 202 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x07 }, 203 [OPAL_NEXT] = 204 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x08 }, 205 [OPAL_EAUTHENTICATE] = 206 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0c }, 207 [OPAL_GETACL] = 208 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0d }, 209 [OPAL_GENKEY] = 210 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x10 }, 211 [OPAL_REVERTSP] = 212 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x11 }, 213 [OPAL_GET] = 214 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x16 }, 215 [OPAL_SET] = 216 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x17 }, 217 [OPAL_AUTHENTICATE] = 218 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x1c }, 219 [OPAL_RANDOM] = 220 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x06, 0x01 }, 221 [OPAL_ERASE] = 222 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x08, 0x03 }, 223 [OPAL_REACTIVATE] = 224 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x08, 0x01 }, 225 }; 226 227 static int end_opal_session_error(struct opal_dev *dev); 228 static int opal_discovery0_step(struct opal_dev *dev); 229 230 struct opal_suspend_data { 231 struct opal_lock_unlock unlk; 232 u8 lr; 233 struct list_head node; 234 }; 235 236 /* 237 * Derived from: 238 * TCG_Storage_Architecture_Core_Spec_v2.01_r1.00 239 * Section: 5.1.5 Method Status Codes 240 */ 241 static const char * const opal_errors[] = { 242 "Success", 243 "Not Authorized", 244 "Unknown Error", 245 "SP Busy", 246 "SP Failed", 247 "SP Disabled", 248 "SP Frozen", 249 "No Sessions Available", 250 "Uniqueness Conflict", 251 "Insufficient Space", 252 "Insufficient Rows", 253 "Invalid Function", 254 "Invalid Parameter", 255 "Invalid Reference", 256 "Unknown Error", 257 "TPER Malfunction", 258 "Transaction Failure", 259 "Response Overflow", 260 "Authority Locked Out", 261 }; 262 263 static const char *opal_error_to_human(int error) 264 { 265 if (error == 0x3f) 266 return "Failed"; 267 268 if (error >= ARRAY_SIZE(opal_errors) || error < 0) 269 return "Unknown Error"; 270 271 return opal_errors[error]; 272 } 273 274 static void print_buffer(const u8 *ptr, u32 length) 275 { 276 #ifdef DEBUG 277 print_hex_dump_bytes("OPAL: ", DUMP_PREFIX_OFFSET, ptr, length); 278 pr_debug("\n"); 279 #endif 280 } 281 282 /* 283 * Allocate/update a SED Opal key and add it to the SED Opal keyring. 284 */ 285 static int update_sed_opal_key(const char *desc, u_char *key_data, int keylen) 286 { 287 key_ref_t kr; 288 289 if (!sed_opal_keyring) 290 return -ENOKEY; 291 292 kr = key_create_or_update(make_key_ref(sed_opal_keyring, true), "user", 293 desc, (const void *)key_data, keylen, 294 KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_WRITE, 295 KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_BUILT_IN | 296 KEY_ALLOC_BYPASS_RESTRICTION); 297 if (IS_ERR(kr)) { 298 pr_err("Error adding SED key (%ld)\n", PTR_ERR(kr)); 299 return PTR_ERR(kr); 300 } 301 302 return 0; 303 } 304 305 /* 306 * Read a SED Opal key from the SED Opal keyring. 307 */ 308 static int read_sed_opal_key(const char *key_name, u_char *buffer, int buflen) 309 { 310 int ret; 311 key_ref_t kref; 312 struct key *key; 313 314 if (!sed_opal_keyring) 315 return -ENOKEY; 316 317 kref = keyring_search(make_key_ref(sed_opal_keyring, true), 318 &key_type_user, key_name, true); 319 320 if (IS_ERR(kref)) 321 return PTR_ERR(kref); 322 323 key = key_ref_to_ptr(kref); 324 down_read(&key->sem); 325 ret = key_validate(key); 326 if (ret == 0) { 327 if (buflen > key->datalen) 328 buflen = key->datalen; 329 330 ret = key->type->read(key, (char *)buffer, buflen); 331 } 332 up_read(&key->sem); 333 334 key_ref_put(kref); 335 336 return ret; 337 } 338 339 static int opal_get_key(struct opal_dev *dev, struct opal_key *key) 340 { 341 int ret = 0; 342 343 switch (key->key_type) { 344 case OPAL_INCLUDED: 345 /* the key is ready to use */ 346 break; 347 case OPAL_KEYRING: 348 /* the key is in the keyring */ 349 ret = read_sed_opal_key(OPAL_AUTH_KEY, key->key, OPAL_KEY_MAX); 350 if (ret > 0) { 351 if (ret > U8_MAX) { 352 ret = -ENOSPC; 353 goto error; 354 } 355 key->key_len = ret; 356 key->key_type = OPAL_INCLUDED; 357 } 358 break; 359 default: 360 ret = -EINVAL; 361 break; 362 } 363 if (ret < 0) 364 goto error; 365 366 /* must have a PEK by now or it's an error */ 367 if (key->key_type != OPAL_INCLUDED || key->key_len == 0) { 368 ret = -EINVAL; 369 goto error; 370 } 371 return 0; 372 error: 373 pr_debug("Error getting password: %d\n", ret); 374 return ret; 375 } 376 377 static bool check_tper(const void *data) 378 { 379 const struct d0_tper_features *tper = data; 380 u8 flags = tper->supported_features; 381 382 if (!(flags & TPER_SYNC_SUPPORTED)) { 383 pr_debug("TPer sync not supported. flags = %d\n", 384 tper->supported_features); 385 return false; 386 } 387 388 return true; 389 } 390 391 static bool check_lcksuppt(const void *data) 392 { 393 const struct d0_locking_features *lfeat = data; 394 u8 sup_feat = lfeat->supported_features; 395 396 return !!(sup_feat & LOCKING_SUPPORTED_MASK); 397 } 398 399 static bool check_lckenabled(const void *data) 400 { 401 const struct d0_locking_features *lfeat = data; 402 u8 sup_feat = lfeat->supported_features; 403 404 return !!(sup_feat & LOCKING_ENABLED_MASK); 405 } 406 407 static bool check_locked(const void *data) 408 { 409 const struct d0_locking_features *lfeat = data; 410 u8 sup_feat = lfeat->supported_features; 411 412 return !!(sup_feat & LOCKED_MASK); 413 } 414 415 static bool check_mbrenabled(const void *data) 416 { 417 const struct d0_locking_features *lfeat = data; 418 u8 sup_feat = lfeat->supported_features; 419 420 return !!(sup_feat & MBR_ENABLED_MASK); 421 } 422 423 static bool check_mbrdone(const void *data) 424 { 425 const struct d0_locking_features *lfeat = data; 426 u8 sup_feat = lfeat->supported_features; 427 428 return !!(sup_feat & MBR_DONE_MASK); 429 } 430 431 static bool check_sum(const void *data) 432 { 433 const struct d0_single_user_mode *sum = data; 434 u32 nlo = be32_to_cpu(sum->num_locking_objects); 435 436 if (nlo == 0) { 437 pr_debug("Need at least one locking object.\n"); 438 return false; 439 } 440 441 pr_debug("Number of locking objects: %d\n", nlo); 442 443 return true; 444 } 445 446 static u16 get_comid_v100(const void *data) 447 { 448 const struct d0_opal_v100 *v100 = data; 449 450 return be16_to_cpu(v100->baseComID); 451 } 452 453 static u16 get_comid_v200(const void *data) 454 { 455 const struct d0_opal_v200 *v200 = data; 456 457 return be16_to_cpu(v200->baseComID); 458 } 459 460 static int opal_send_cmd(struct opal_dev *dev) 461 { 462 return dev->send_recv(dev->data, dev->comid, TCG_SECP_01, 463 dev->cmd, IO_BUFFER_LENGTH, 464 true); 465 } 466 467 static int opal_recv_cmd(struct opal_dev *dev) 468 { 469 return dev->send_recv(dev->data, dev->comid, TCG_SECP_01, 470 dev->resp, IO_BUFFER_LENGTH, 471 false); 472 } 473 474 static int opal_recv_check(struct opal_dev *dev) 475 { 476 size_t buflen = IO_BUFFER_LENGTH; 477 void *buffer = dev->resp; 478 struct opal_header *hdr = buffer; 479 int ret; 480 481 do { 482 pr_debug("Sent OPAL command: outstanding=%d, minTransfer=%d\n", 483 hdr->cp.outstandingData, 484 hdr->cp.minTransfer); 485 486 if (hdr->cp.outstandingData == 0 || 487 hdr->cp.minTransfer != 0) 488 return 0; 489 490 memset(buffer, 0, buflen); 491 ret = opal_recv_cmd(dev); 492 } while (!ret); 493 494 return ret; 495 } 496 497 static int opal_send_recv(struct opal_dev *dev, cont_fn *cont) 498 { 499 int ret; 500 501 ret = opal_send_cmd(dev); 502 if (ret) 503 return ret; 504 ret = opal_recv_cmd(dev); 505 if (ret) 506 return ret; 507 ret = opal_recv_check(dev); 508 if (ret) 509 return ret; 510 return cont(dev); 511 } 512 513 static void check_geometry(struct opal_dev *dev, const void *data) 514 { 515 const struct d0_geometry_features *geo = data; 516 517 dev->align = be64_to_cpu(geo->alignment_granularity); 518 dev->lowest_lba = be64_to_cpu(geo->lowest_aligned_lba); 519 dev->logical_block_size = be32_to_cpu(geo->logical_block_size); 520 dev->align_required = geo->reserved01 & 1; 521 } 522 523 static int execute_step(struct opal_dev *dev, 524 const struct opal_step *step, size_t stepIndex) 525 { 526 int error = step->fn(dev, step->data); 527 528 if (error) { 529 pr_debug("Step %zu (%pS) failed with error %d: %s\n", 530 stepIndex, step->fn, error, 531 opal_error_to_human(error)); 532 } 533 534 return error; 535 } 536 537 static int execute_steps(struct opal_dev *dev, 538 const struct opal_step *steps, size_t n_steps) 539 { 540 size_t state = 0; 541 int error; 542 543 /* first do a discovery0 */ 544 error = opal_discovery0_step(dev); 545 if (error) 546 return error; 547 548 for (state = 0; state < n_steps; state++) { 549 error = execute_step(dev, &steps[state], state); 550 if (error) 551 goto out_error; 552 } 553 554 return 0; 555 556 out_error: 557 /* 558 * For each OPAL command the first step in steps starts some sort of 559 * session. If an error occurred in the initial discovery0 or if an 560 * error occurred in the first step (and thus stopping the loop with 561 * state == 0) then there was an error before or during the attempt to 562 * start a session. Therefore we shouldn't attempt to terminate a 563 * session, as one has not yet been created. 564 */ 565 if (state > 0) 566 end_opal_session_error(dev); 567 568 return error; 569 } 570 571 static int opal_discovery0_end(struct opal_dev *dev, void *data) 572 { 573 struct opal_discovery *discv_out = data; /* may be NULL */ 574 u8 __user *buf_out; 575 u64 len_out; 576 bool found_com_id = false, supported = true, single_user = false; 577 const struct d0_header *hdr = (struct d0_header *)dev->resp; 578 const u8 *epos = dev->resp, *cpos = dev->resp; 579 u16 comid = 0; 580 u32 hlen = be32_to_cpu(hdr->length); 581 582 print_buffer(dev->resp, hlen); 583 dev->flags &= OPAL_FL_SUPPORTED; 584 585 if (hlen > IO_BUFFER_LENGTH - sizeof(*hdr)) { 586 pr_debug("Discovery length overflows buffer (%zu+%u)/%u\n", 587 sizeof(*hdr), hlen, IO_BUFFER_LENGTH); 588 return -EFAULT; 589 } 590 591 if (discv_out) { 592 buf_out = (u8 __user *)(uintptr_t)discv_out->data; 593 len_out = min_t(u64, discv_out->size, hlen); 594 if (buf_out && copy_to_user(buf_out, dev->resp, len_out)) 595 return -EFAULT; 596 597 discv_out->size = hlen; /* actual size of data */ 598 } 599 600 epos += hlen; /* end of buffer */ 601 cpos += sizeof(*hdr); /* current position on buffer */ 602 603 while (cpos < epos && supported) { 604 const struct d0_features *body = 605 (const struct d0_features *)cpos; 606 607 switch (be16_to_cpu(body->code)) { 608 case FC_TPER: 609 supported = check_tper(body->features); 610 break; 611 case FC_SINGLEUSER: 612 single_user = check_sum(body->features); 613 if (single_user) 614 dev->flags |= OPAL_FL_SUM_SUPPORTED; 615 break; 616 case FC_GEOMETRY: 617 check_geometry(dev, body); 618 break; 619 case FC_LOCKING: 620 if (check_lcksuppt(body->features)) 621 dev->flags |= OPAL_FL_LOCKING_SUPPORTED; 622 if (check_lckenabled(body->features)) 623 dev->flags |= OPAL_FL_LOCKING_ENABLED; 624 if (check_locked(body->features)) 625 dev->flags |= OPAL_FL_LOCKED; 626 if (check_mbrenabled(body->features)) 627 dev->flags |= OPAL_FL_MBR_ENABLED; 628 if (check_mbrdone(body->features)) 629 dev->flags |= OPAL_FL_MBR_DONE; 630 break; 631 case FC_ENTERPRISE: 632 case FC_DATASTORE: 633 /* some ignored properties */ 634 pr_debug("Found OPAL feature description: %d\n", 635 be16_to_cpu(body->code)); 636 break; 637 case FC_OPALV100: 638 comid = get_comid_v100(body->features); 639 found_com_id = true; 640 break; 641 case FC_OPALV200: 642 comid = get_comid_v200(body->features); 643 found_com_id = true; 644 break; 645 case 0xbfff ... 0xffff: 646 /* vendor specific, just ignore */ 647 break; 648 default: 649 pr_debug("OPAL Unknown feature: %d\n", 650 be16_to_cpu(body->code)); 651 652 } 653 cpos += body->length + 4; 654 } 655 656 if (!supported) { 657 pr_debug("This device is not Opal enabled. Not Supported!\n"); 658 return -EOPNOTSUPP; 659 } 660 661 if (!single_user) 662 pr_debug("Device doesn't support single user mode\n"); 663 664 665 if (!found_com_id) { 666 pr_debug("Could not find OPAL comid for device. Returning early\n"); 667 return -EOPNOTSUPP; 668 } 669 670 dev->comid = comid; 671 672 return 0; 673 } 674 675 static int opal_discovery0(struct opal_dev *dev, void *data) 676 { 677 int ret; 678 679 memset(dev->resp, 0, IO_BUFFER_LENGTH); 680 dev->comid = OPAL_DISCOVERY_COMID; 681 ret = opal_recv_cmd(dev); 682 if (ret) 683 return ret; 684 685 return opal_discovery0_end(dev, data); 686 } 687 688 static int opal_discovery0_step(struct opal_dev *dev) 689 { 690 const struct opal_step discovery0_step = { 691 opal_discovery0, NULL 692 }; 693 694 return execute_step(dev, &discovery0_step, 0); 695 } 696 697 static size_t remaining_size(struct opal_dev *cmd) 698 { 699 return IO_BUFFER_LENGTH - cmd->pos; 700 } 701 702 static bool can_add(int *err, struct opal_dev *cmd, size_t len) 703 { 704 if (*err) 705 return false; 706 707 if (remaining_size(cmd) < len) { 708 pr_debug("Error adding %zu bytes: end of buffer.\n", len); 709 *err = -ERANGE; 710 return false; 711 } 712 713 return true; 714 } 715 716 static void add_token_u8(int *err, struct opal_dev *cmd, u8 tok) 717 { 718 if (!can_add(err, cmd, 1)) 719 return; 720 721 cmd->cmd[cmd->pos++] = tok; 722 } 723 724 static void add_short_atom_header(struct opal_dev *cmd, bool bytestring, 725 bool has_sign, int len) 726 { 727 u8 atom; 728 int err = 0; 729 730 atom = SHORT_ATOM_ID; 731 atom |= bytestring ? SHORT_ATOM_BYTESTRING : 0; 732 atom |= has_sign ? SHORT_ATOM_SIGNED : 0; 733 atom |= len & SHORT_ATOM_LEN_MASK; 734 735 add_token_u8(&err, cmd, atom); 736 } 737 738 static void add_medium_atom_header(struct opal_dev *cmd, bool bytestring, 739 bool has_sign, int len) 740 { 741 u8 header0; 742 743 header0 = MEDIUM_ATOM_ID; 744 header0 |= bytestring ? MEDIUM_ATOM_BYTESTRING : 0; 745 header0 |= has_sign ? MEDIUM_ATOM_SIGNED : 0; 746 header0 |= (len >> 8) & MEDIUM_ATOM_LEN_MASK; 747 748 cmd->cmd[cmd->pos++] = header0; 749 cmd->cmd[cmd->pos++] = len; 750 } 751 752 static void add_token_u64(int *err, struct opal_dev *cmd, u64 number) 753 { 754 size_t len; 755 int msb; 756 757 if (!(number & ~TINY_ATOM_DATA_MASK)) { 758 add_token_u8(err, cmd, number); 759 return; 760 } 761 762 msb = fls64(number); 763 len = DIV_ROUND_UP(msb, 8); 764 765 if (!can_add(err, cmd, len + 1)) { 766 pr_debug("Error adding u64: end of buffer.\n"); 767 return; 768 } 769 add_short_atom_header(cmd, false, false, len); 770 while (len--) 771 add_token_u8(err, cmd, number >> (len * 8)); 772 } 773 774 static u8 *add_bytestring_header(int *err, struct opal_dev *cmd, size_t len) 775 { 776 size_t header_len = 1; 777 bool is_short_atom = true; 778 779 if (len & ~SHORT_ATOM_LEN_MASK) { 780 header_len = 2; 781 is_short_atom = false; 782 } 783 784 if (!can_add(err, cmd, header_len + len)) { 785 pr_debug("Error adding bytestring: end of buffer.\n"); 786 return NULL; 787 } 788 789 if (is_short_atom) 790 add_short_atom_header(cmd, true, false, len); 791 else 792 add_medium_atom_header(cmd, true, false, len); 793 794 return &cmd->cmd[cmd->pos]; 795 } 796 797 static void add_token_bytestring(int *err, struct opal_dev *cmd, 798 const u8 *bytestring, size_t len) 799 { 800 u8 *start; 801 802 start = add_bytestring_header(err, cmd, len); 803 if (!start) 804 return; 805 memcpy(start, bytestring, len); 806 cmd->pos += len; 807 } 808 809 static int build_locking_range(u8 *buffer, size_t length, u8 lr) 810 { 811 if (length > OPAL_UID_LENGTH) { 812 pr_debug("Can't build locking range. Length OOB\n"); 813 return -ERANGE; 814 } 815 816 memcpy(buffer, opaluid[OPAL_LOCKINGRANGE_GLOBAL], OPAL_UID_LENGTH); 817 818 if (lr == 0) 819 return 0; 820 821 buffer[5] = LOCKING_RANGE_NON_GLOBAL; 822 buffer[7] = lr; 823 824 return 0; 825 } 826 827 static int build_locking_user(u8 *buffer, size_t length, u8 lr) 828 { 829 if (length > OPAL_UID_LENGTH) { 830 pr_debug("Can't build locking range user. Length OOB\n"); 831 return -ERANGE; 832 } 833 834 memcpy(buffer, opaluid[OPAL_USER1_UID], OPAL_UID_LENGTH); 835 836 buffer[7] = lr + 1; 837 838 return 0; 839 } 840 841 static void set_comid(struct opal_dev *cmd, u16 comid) 842 { 843 struct opal_header *hdr = (struct opal_header *)cmd->cmd; 844 845 hdr->cp.extendedComID[0] = comid >> 8; 846 hdr->cp.extendedComID[1] = comid; 847 hdr->cp.extendedComID[2] = 0; 848 hdr->cp.extendedComID[3] = 0; 849 } 850 851 static int cmd_finalize(struct opal_dev *cmd, u32 hsn, u32 tsn) 852 { 853 struct opal_header *hdr; 854 int err = 0; 855 856 /* 857 * Close the parameter list opened from cmd_start. 858 * The number of bytes added must be equal to 859 * CMD_FINALIZE_BYTES_NEEDED. 860 */ 861 add_token_u8(&err, cmd, OPAL_ENDLIST); 862 863 add_token_u8(&err, cmd, OPAL_ENDOFDATA); 864 add_token_u8(&err, cmd, OPAL_STARTLIST); 865 add_token_u8(&err, cmd, 0); 866 add_token_u8(&err, cmd, 0); 867 add_token_u8(&err, cmd, 0); 868 add_token_u8(&err, cmd, OPAL_ENDLIST); 869 870 if (err) { 871 pr_debug("Error finalizing command.\n"); 872 return -EFAULT; 873 } 874 875 hdr = (struct opal_header *) cmd->cmd; 876 877 hdr->pkt.tsn = cpu_to_be32(tsn); 878 hdr->pkt.hsn = cpu_to_be32(hsn); 879 880 hdr->subpkt.length = cpu_to_be32(cmd->pos - sizeof(*hdr)); 881 while (cmd->pos % 4) { 882 if (cmd->pos >= IO_BUFFER_LENGTH) { 883 pr_debug("Error: Buffer overrun\n"); 884 return -ERANGE; 885 } 886 cmd->cmd[cmd->pos++] = 0; 887 } 888 hdr->pkt.length = cpu_to_be32(cmd->pos - sizeof(hdr->cp) - 889 sizeof(hdr->pkt)); 890 hdr->cp.length = cpu_to_be32(cmd->pos - sizeof(hdr->cp)); 891 892 return 0; 893 } 894 895 static const struct opal_resp_tok *response_get_token( 896 const struct parsed_resp *resp, 897 int n) 898 { 899 const struct opal_resp_tok *tok; 900 901 if (!resp) { 902 pr_debug("Response is NULL\n"); 903 return ERR_PTR(-EINVAL); 904 } 905 906 if (n >= resp->num) { 907 pr_debug("Token number doesn't exist: %d, resp: %d\n", 908 n, resp->num); 909 return ERR_PTR(-EINVAL); 910 } 911 912 tok = &resp->toks[n]; 913 if (tok->len == 0) { 914 pr_debug("Token length must be non-zero\n"); 915 return ERR_PTR(-EINVAL); 916 } 917 918 return tok; 919 } 920 921 static ssize_t response_parse_tiny(struct opal_resp_tok *tok, 922 const u8 *pos) 923 { 924 tok->pos = pos; 925 tok->len = 1; 926 tok->width = OPAL_WIDTH_TINY; 927 928 if (pos[0] & TINY_ATOM_SIGNED) { 929 tok->type = OPAL_DTA_TOKENID_SINT; 930 } else { 931 tok->type = OPAL_DTA_TOKENID_UINT; 932 tok->stored.u = pos[0] & 0x3f; 933 } 934 935 return tok->len; 936 } 937 938 static ssize_t response_parse_short(struct opal_resp_tok *tok, 939 const u8 *pos) 940 { 941 tok->pos = pos; 942 tok->len = (pos[0] & SHORT_ATOM_LEN_MASK) + 1; 943 tok->width = OPAL_WIDTH_SHORT; 944 945 if (pos[0] & SHORT_ATOM_BYTESTRING) { 946 tok->type = OPAL_DTA_TOKENID_BYTESTRING; 947 } else if (pos[0] & SHORT_ATOM_SIGNED) { 948 tok->type = OPAL_DTA_TOKENID_SINT; 949 } else { 950 u64 u_integer = 0; 951 ssize_t i, b = 0; 952 953 tok->type = OPAL_DTA_TOKENID_UINT; 954 if (tok->len > 9) { 955 pr_debug("uint64 with more than 8 bytes\n"); 956 return -EINVAL; 957 } 958 for (i = tok->len - 1; i > 0; i--) { 959 u_integer |= ((u64)pos[i] << (8 * b)); 960 b++; 961 } 962 tok->stored.u = u_integer; 963 } 964 965 return tok->len; 966 } 967 968 static ssize_t response_parse_medium(struct opal_resp_tok *tok, 969 const u8 *pos) 970 { 971 tok->pos = pos; 972 tok->len = (((pos[0] & MEDIUM_ATOM_LEN_MASK) << 8) | pos[1]) + 2; 973 tok->width = OPAL_WIDTH_MEDIUM; 974 975 if (pos[0] & MEDIUM_ATOM_BYTESTRING) 976 tok->type = OPAL_DTA_TOKENID_BYTESTRING; 977 else if (pos[0] & MEDIUM_ATOM_SIGNED) 978 tok->type = OPAL_DTA_TOKENID_SINT; 979 else 980 tok->type = OPAL_DTA_TOKENID_UINT; 981 982 return tok->len; 983 } 984 985 static ssize_t response_parse_long(struct opal_resp_tok *tok, 986 const u8 *pos) 987 { 988 tok->pos = pos; 989 tok->len = ((pos[1] << 16) | (pos[2] << 8) | pos[3]) + 4; 990 tok->width = OPAL_WIDTH_LONG; 991 992 if (pos[0] & LONG_ATOM_BYTESTRING) 993 tok->type = OPAL_DTA_TOKENID_BYTESTRING; 994 else if (pos[0] & LONG_ATOM_SIGNED) 995 tok->type = OPAL_DTA_TOKENID_SINT; 996 else 997 tok->type = OPAL_DTA_TOKENID_UINT; 998 999 return tok->len; 1000 } 1001 1002 static ssize_t response_parse_token(struct opal_resp_tok *tok, 1003 const u8 *pos) 1004 { 1005 tok->pos = pos; 1006 tok->len = 1; 1007 tok->type = OPAL_DTA_TOKENID_TOKEN; 1008 tok->width = OPAL_WIDTH_TOKEN; 1009 1010 return tok->len; 1011 } 1012 1013 static int response_parse(const u8 *buf, size_t length, 1014 struct parsed_resp *resp) 1015 { 1016 const struct opal_header *hdr; 1017 struct opal_resp_tok *iter; 1018 int num_entries = 0; 1019 int total; 1020 ssize_t token_length; 1021 const u8 *pos; 1022 u32 clen, plen, slen; 1023 1024 if (!buf) 1025 return -EFAULT; 1026 1027 if (!resp) 1028 return -EFAULT; 1029 1030 hdr = (struct opal_header *)buf; 1031 pos = buf; 1032 pos += sizeof(*hdr); 1033 1034 clen = be32_to_cpu(hdr->cp.length); 1035 plen = be32_to_cpu(hdr->pkt.length); 1036 slen = be32_to_cpu(hdr->subpkt.length); 1037 pr_debug("Response size: cp: %u, pkt: %u, subpkt: %u\n", 1038 clen, plen, slen); 1039 1040 if (clen == 0 || plen == 0 || slen == 0 || 1041 slen > IO_BUFFER_LENGTH - sizeof(*hdr)) { 1042 pr_debug("Bad header length. cp: %u, pkt: %u, subpkt: %u\n", 1043 clen, plen, slen); 1044 print_buffer(pos, sizeof(*hdr)); 1045 return -EINVAL; 1046 } 1047 1048 if (pos > buf + length) 1049 return -EFAULT; 1050 1051 iter = resp->toks; 1052 total = slen; 1053 print_buffer(pos, total); 1054 while (total > 0) { 1055 if (pos[0] <= TINY_ATOM_BYTE) /* tiny atom */ 1056 token_length = response_parse_tiny(iter, pos); 1057 else if (pos[0] <= SHORT_ATOM_BYTE) /* short atom */ 1058 token_length = response_parse_short(iter, pos); 1059 else if (pos[0] <= MEDIUM_ATOM_BYTE) /* medium atom */ 1060 token_length = response_parse_medium(iter, pos); 1061 else if (pos[0] <= LONG_ATOM_BYTE) /* long atom */ 1062 token_length = response_parse_long(iter, pos); 1063 else if (pos[0] == EMPTY_ATOM_BYTE) /* empty atom */ 1064 token_length = 1; 1065 else /* TOKEN */ 1066 token_length = response_parse_token(iter, pos); 1067 1068 if (token_length < 0) 1069 return token_length; 1070 1071 if (pos[0] != EMPTY_ATOM_BYTE) 1072 num_entries++; 1073 1074 pos += token_length; 1075 total -= token_length; 1076 iter++; 1077 } 1078 1079 resp->num = num_entries; 1080 1081 return 0; 1082 } 1083 1084 static size_t response_get_string(const struct parsed_resp *resp, int n, 1085 const char **store) 1086 { 1087 u8 skip; 1088 const struct opal_resp_tok *tok; 1089 1090 *store = NULL; 1091 tok = response_get_token(resp, n); 1092 if (IS_ERR(tok)) 1093 return 0; 1094 1095 if (tok->type != OPAL_DTA_TOKENID_BYTESTRING) { 1096 pr_debug("Token is not a byte string!\n"); 1097 return 0; 1098 } 1099 1100 switch (tok->width) { 1101 case OPAL_WIDTH_TINY: 1102 case OPAL_WIDTH_SHORT: 1103 skip = 1; 1104 break; 1105 case OPAL_WIDTH_MEDIUM: 1106 skip = 2; 1107 break; 1108 case OPAL_WIDTH_LONG: 1109 skip = 4; 1110 break; 1111 default: 1112 pr_debug("Token has invalid width!\n"); 1113 return 0; 1114 } 1115 1116 *store = tok->pos + skip; 1117 1118 return tok->len - skip; 1119 } 1120 1121 static u64 response_get_u64(const struct parsed_resp *resp, int n) 1122 { 1123 const struct opal_resp_tok *tok; 1124 1125 tok = response_get_token(resp, n); 1126 if (IS_ERR(tok)) 1127 return 0; 1128 1129 if (tok->type != OPAL_DTA_TOKENID_UINT) { 1130 pr_debug("Token is not unsigned int: %d\n", tok->type); 1131 return 0; 1132 } 1133 1134 if (tok->width != OPAL_WIDTH_TINY && tok->width != OPAL_WIDTH_SHORT) { 1135 pr_debug("Atom is not short or tiny: %d\n", tok->width); 1136 return 0; 1137 } 1138 1139 return tok->stored.u; 1140 } 1141 1142 static bool response_token_matches(const struct opal_resp_tok *token, u8 match) 1143 { 1144 if (IS_ERR(token) || 1145 token->type != OPAL_DTA_TOKENID_TOKEN || 1146 token->pos[0] != match) 1147 return false; 1148 return true; 1149 } 1150 1151 static u8 response_status(const struct parsed_resp *resp) 1152 { 1153 const struct opal_resp_tok *tok; 1154 1155 tok = response_get_token(resp, 0); 1156 if (response_token_matches(tok, OPAL_ENDOFSESSION)) 1157 return 0; 1158 1159 if (resp->num < 5) 1160 return DTAERROR_NO_METHOD_STATUS; 1161 1162 tok = response_get_token(resp, resp->num - 5); 1163 if (!response_token_matches(tok, OPAL_STARTLIST)) 1164 return DTAERROR_NO_METHOD_STATUS; 1165 1166 tok = response_get_token(resp, resp->num - 1); 1167 if (!response_token_matches(tok, OPAL_ENDLIST)) 1168 return DTAERROR_NO_METHOD_STATUS; 1169 1170 return response_get_u64(resp, resp->num - 4); 1171 } 1172 1173 /* Parses and checks for errors */ 1174 static int parse_and_check_status(struct opal_dev *dev) 1175 { 1176 int error; 1177 1178 print_buffer(dev->cmd, dev->pos); 1179 1180 error = response_parse(dev->resp, IO_BUFFER_LENGTH, &dev->parsed); 1181 if (error) { 1182 pr_debug("Couldn't parse response.\n"); 1183 return error; 1184 } 1185 1186 return response_status(&dev->parsed); 1187 } 1188 1189 static void clear_opal_cmd(struct opal_dev *dev) 1190 { 1191 dev->pos = sizeof(struct opal_header); 1192 memset(dev->cmd, 0, IO_BUFFER_LENGTH); 1193 } 1194 1195 static int cmd_start(struct opal_dev *dev, const u8 *uid, const u8 *method) 1196 { 1197 int err = 0; 1198 1199 clear_opal_cmd(dev); 1200 set_comid(dev, dev->comid); 1201 1202 add_token_u8(&err, dev, OPAL_CALL); 1203 add_token_bytestring(&err, dev, uid, OPAL_UID_LENGTH); 1204 add_token_bytestring(&err, dev, method, OPAL_METHOD_LENGTH); 1205 1206 /* 1207 * Every method call is followed by its parameters enclosed within 1208 * OPAL_STARTLIST and OPAL_ENDLIST tokens. We automatically open the 1209 * parameter list here and close it later in cmd_finalize. 1210 */ 1211 add_token_u8(&err, dev, OPAL_STARTLIST); 1212 1213 return err; 1214 } 1215 1216 static int start_opal_session_cont(struct opal_dev *dev) 1217 { 1218 u32 hsn, tsn; 1219 int error; 1220 1221 error = parse_and_check_status(dev); 1222 if (error) 1223 return error; 1224 1225 hsn = response_get_u64(&dev->parsed, 4); 1226 tsn = response_get_u64(&dev->parsed, 5); 1227 1228 if (hsn != GENERIC_HOST_SESSION_NUM || tsn < FIRST_TPER_SESSION_NUM) { 1229 pr_debug("Couldn't authenticate session\n"); 1230 return -EPERM; 1231 } 1232 1233 dev->hsn = hsn; 1234 dev->tsn = tsn; 1235 1236 return 0; 1237 } 1238 1239 static void add_suspend_info(struct opal_dev *dev, 1240 struct opal_suspend_data *sus) 1241 { 1242 struct opal_suspend_data *iter; 1243 1244 list_for_each_entry(iter, &dev->unlk_lst, node) { 1245 if (iter->lr == sus->lr) { 1246 list_del(&iter->node); 1247 kfree(iter); 1248 break; 1249 } 1250 } 1251 list_add_tail(&sus->node, &dev->unlk_lst); 1252 } 1253 1254 static int end_session_cont(struct opal_dev *dev) 1255 { 1256 dev->hsn = 0; 1257 dev->tsn = 0; 1258 1259 return parse_and_check_status(dev); 1260 } 1261 1262 static int finalize_and_send(struct opal_dev *dev, cont_fn cont) 1263 { 1264 int ret; 1265 1266 ret = cmd_finalize(dev, dev->hsn, dev->tsn); 1267 if (ret) { 1268 pr_debug("Error finalizing command buffer: %d\n", ret); 1269 return ret; 1270 } 1271 1272 print_buffer(dev->cmd, dev->pos); 1273 1274 return opal_send_recv(dev, cont); 1275 } 1276 1277 static int generic_get_columns(struct opal_dev *dev, const u8 *table, 1278 u64 start_column, u64 end_column) 1279 { 1280 int err; 1281 1282 err = cmd_start(dev, table, opalmethod[OPAL_GET]); 1283 1284 add_token_u8(&err, dev, OPAL_STARTLIST); 1285 1286 add_token_u8(&err, dev, OPAL_STARTNAME); 1287 add_token_u8(&err, dev, OPAL_STARTCOLUMN); 1288 add_token_u64(&err, dev, start_column); 1289 add_token_u8(&err, dev, OPAL_ENDNAME); 1290 1291 add_token_u8(&err, dev, OPAL_STARTNAME); 1292 add_token_u8(&err, dev, OPAL_ENDCOLUMN); 1293 add_token_u64(&err, dev, end_column); 1294 add_token_u8(&err, dev, OPAL_ENDNAME); 1295 1296 add_token_u8(&err, dev, OPAL_ENDLIST); 1297 1298 if (err) 1299 return err; 1300 1301 return finalize_and_send(dev, parse_and_check_status); 1302 } 1303 1304 /* 1305 * request @column from table @table on device @dev. On success, the column 1306 * data will be available in dev->resp->tok[4] 1307 */ 1308 static int generic_get_column(struct opal_dev *dev, const u8 *table, 1309 u64 column) 1310 { 1311 return generic_get_columns(dev, table, column, column); 1312 } 1313 1314 /* 1315 * see TCG SAS 5.3.2.3 for a description of the available columns 1316 * 1317 * the result is provided in dev->resp->tok[4] 1318 */ 1319 static int generic_get_table_info(struct opal_dev *dev, const u8 *table_uid, 1320 u64 column) 1321 { 1322 u8 uid[OPAL_UID_LENGTH]; 1323 const unsigned int half = OPAL_UID_LENGTH_HALF; 1324 1325 /* sed-opal UIDs can be split in two halves: 1326 * first: actual table index 1327 * second: relative index in the table 1328 * so we have to get the first half of the OPAL_TABLE_TABLE and use the 1329 * first part of the target table as relative index into that table 1330 */ 1331 memcpy(uid, opaluid[OPAL_TABLE_TABLE], half); 1332 memcpy(uid + half, table_uid, half); 1333 1334 return generic_get_column(dev, uid, column); 1335 } 1336 1337 static int gen_key(struct opal_dev *dev, void *data) 1338 { 1339 u8 uid[OPAL_UID_LENGTH]; 1340 int err; 1341 1342 memcpy(uid, dev->prev_data, min(sizeof(uid), dev->prev_d_len)); 1343 kfree(dev->prev_data); 1344 dev->prev_data = NULL; 1345 1346 err = cmd_start(dev, uid, opalmethod[OPAL_GENKEY]); 1347 1348 if (err) { 1349 pr_debug("Error building gen key command\n"); 1350 return err; 1351 1352 } 1353 1354 return finalize_and_send(dev, parse_and_check_status); 1355 } 1356 1357 static int get_active_key_cont(struct opal_dev *dev) 1358 { 1359 const char *activekey; 1360 size_t keylen; 1361 int error; 1362 1363 error = parse_and_check_status(dev); 1364 if (error) 1365 return error; 1366 1367 keylen = response_get_string(&dev->parsed, 4, &activekey); 1368 if (!activekey) { 1369 pr_debug("%s: Couldn't extract the Activekey from the response\n", 1370 __func__); 1371 return OPAL_INVAL_PARAM; 1372 } 1373 1374 dev->prev_data = kmemdup(activekey, keylen, GFP_KERNEL); 1375 1376 if (!dev->prev_data) 1377 return -ENOMEM; 1378 1379 dev->prev_d_len = keylen; 1380 1381 return 0; 1382 } 1383 1384 static int get_active_key(struct opal_dev *dev, void *data) 1385 { 1386 u8 uid[OPAL_UID_LENGTH]; 1387 int err; 1388 u8 *lr = data; 1389 1390 err = build_locking_range(uid, sizeof(uid), *lr); 1391 if (err) 1392 return err; 1393 1394 err = generic_get_column(dev, uid, OPAL_ACTIVEKEY); 1395 if (err) 1396 return err; 1397 1398 return get_active_key_cont(dev); 1399 } 1400 1401 static int generic_table_write_data(struct opal_dev *dev, const u64 data, 1402 u64 offset, u64 size, const u8 *uid) 1403 { 1404 const u8 __user *src = (u8 __user *)(uintptr_t)data; 1405 u8 *dst; 1406 u64 len; 1407 size_t off = 0; 1408 int err; 1409 1410 /* do we fit in the available space? */ 1411 err = generic_get_table_info(dev, uid, OPAL_TABLE_ROWS); 1412 if (err) { 1413 pr_debug("Couldn't get the table size\n"); 1414 return err; 1415 } 1416 1417 len = response_get_u64(&dev->parsed, 4); 1418 if (size > len || offset > len - size) { 1419 pr_debug("Does not fit in the table (%llu vs. %llu)\n", 1420 offset + size, len); 1421 return -ENOSPC; 1422 } 1423 1424 /* do the actual transmission(s) */ 1425 while (off < size) { 1426 err = cmd_start(dev, uid, opalmethod[OPAL_SET]); 1427 add_token_u8(&err, dev, OPAL_STARTNAME); 1428 add_token_u8(&err, dev, OPAL_WHERE); 1429 add_token_u64(&err, dev, offset + off); 1430 add_token_u8(&err, dev, OPAL_ENDNAME); 1431 1432 add_token_u8(&err, dev, OPAL_STARTNAME); 1433 add_token_u8(&err, dev, OPAL_VALUES); 1434 1435 /* 1436 * The bytestring header is either 1 or 2 bytes, so assume 2. 1437 * There also needs to be enough space to accommodate the 1438 * trailing OPAL_ENDNAME (1 byte) and tokens added by 1439 * cmd_finalize. 1440 */ 1441 len = min(remaining_size(dev) - (2+1+CMD_FINALIZE_BYTES_NEEDED), 1442 (size_t)(size - off)); 1443 pr_debug("Write bytes %zu+%llu/%llu\n", off, len, size); 1444 1445 dst = add_bytestring_header(&err, dev, len); 1446 if (!dst) 1447 break; 1448 1449 if (copy_from_user(dst, src + off, len)) { 1450 err = -EFAULT; 1451 break; 1452 } 1453 1454 dev->pos += len; 1455 1456 add_token_u8(&err, dev, OPAL_ENDNAME); 1457 if (err) 1458 break; 1459 1460 err = finalize_and_send(dev, parse_and_check_status); 1461 if (err) 1462 break; 1463 1464 off += len; 1465 } 1466 1467 return err; 1468 } 1469 1470 static int generic_lr_enable_disable(struct opal_dev *dev, 1471 u8 *uid, bool rle, bool wle, 1472 bool rl, bool wl) 1473 { 1474 int err; 1475 1476 err = cmd_start(dev, uid, opalmethod[OPAL_SET]); 1477 1478 add_token_u8(&err, dev, OPAL_STARTNAME); 1479 add_token_u8(&err, dev, OPAL_VALUES); 1480 add_token_u8(&err, dev, OPAL_STARTLIST); 1481 1482 add_token_u8(&err, dev, OPAL_STARTNAME); 1483 add_token_u8(&err, dev, OPAL_READLOCKENABLED); 1484 add_token_u8(&err, dev, rle); 1485 add_token_u8(&err, dev, OPAL_ENDNAME); 1486 1487 add_token_u8(&err, dev, OPAL_STARTNAME); 1488 add_token_u8(&err, dev, OPAL_WRITELOCKENABLED); 1489 add_token_u8(&err, dev, wle); 1490 add_token_u8(&err, dev, OPAL_ENDNAME); 1491 1492 add_token_u8(&err, dev, OPAL_STARTNAME); 1493 add_token_u8(&err, dev, OPAL_READLOCKED); 1494 add_token_u8(&err, dev, rl); 1495 add_token_u8(&err, dev, OPAL_ENDNAME); 1496 1497 add_token_u8(&err, dev, OPAL_STARTNAME); 1498 add_token_u8(&err, dev, OPAL_WRITELOCKED); 1499 add_token_u8(&err, dev, wl); 1500 add_token_u8(&err, dev, OPAL_ENDNAME); 1501 1502 add_token_u8(&err, dev, OPAL_ENDLIST); 1503 add_token_u8(&err, dev, OPAL_ENDNAME); 1504 1505 return err; 1506 } 1507 1508 static inline int enable_global_lr(struct opal_dev *dev, u8 *uid, 1509 struct opal_user_lr_setup *setup) 1510 { 1511 int err; 1512 1513 err = generic_lr_enable_disable(dev, uid, !!setup->RLE, !!setup->WLE, 1514 0, 0); 1515 if (err) 1516 pr_debug("Failed to create enable global lr command\n"); 1517 1518 return err; 1519 } 1520 1521 static int setup_enable_range(struct opal_dev *dev, void *data) 1522 { 1523 u8 uid[OPAL_UID_LENGTH]; 1524 struct opal_user_lr_setup *setup = data; 1525 u8 lr; 1526 int err; 1527 1528 lr = setup->session.opal_key.lr; 1529 err = build_locking_range(uid, sizeof(uid), lr); 1530 if (err) 1531 return err; 1532 1533 if (lr == 0) 1534 err = enable_global_lr(dev, uid, setup); 1535 else 1536 err = generic_lr_enable_disable(dev, uid, !!setup->RLE, !!setup->WLE, 0, 0); 1537 if (err) { 1538 pr_debug("Failed to create enable lr command.\n"); 1539 return err; 1540 } 1541 1542 return finalize_and_send(dev, parse_and_check_status); 1543 } 1544 1545 static int setup_locking_range_start_length(struct opal_dev *dev, void *data) 1546 { 1547 int err; 1548 u8 uid[OPAL_UID_LENGTH]; 1549 struct opal_user_lr_setup *setup = data; 1550 1551 err = build_locking_range(uid, sizeof(uid), setup->session.opal_key.lr); 1552 if (err) 1553 return err; 1554 1555 err = cmd_start(dev, uid, opalmethod[OPAL_SET]); 1556 1557 add_token_u8(&err, dev, OPAL_STARTNAME); 1558 add_token_u8(&err, dev, OPAL_VALUES); 1559 add_token_u8(&err, dev, OPAL_STARTLIST); 1560 1561 add_token_u8(&err, dev, OPAL_STARTNAME); 1562 add_token_u8(&err, dev, OPAL_RANGESTART); 1563 add_token_u64(&err, dev, setup->range_start); 1564 add_token_u8(&err, dev, OPAL_ENDNAME); 1565 1566 add_token_u8(&err, dev, OPAL_STARTNAME); 1567 add_token_u8(&err, dev, OPAL_RANGELENGTH); 1568 add_token_u64(&err, dev, setup->range_length); 1569 add_token_u8(&err, dev, OPAL_ENDNAME); 1570 1571 add_token_u8(&err, dev, OPAL_ENDLIST); 1572 add_token_u8(&err, dev, OPAL_ENDNAME); 1573 1574 if (err) { 1575 pr_debug("Error building Setup Locking RangeStartLength command.\n"); 1576 return err; 1577 } 1578 1579 return finalize_and_send(dev, parse_and_check_status); 1580 } 1581 1582 static int response_get_column(const struct parsed_resp *resp, 1583 int *iter, 1584 u64 column, 1585 u64 *value) 1586 { 1587 const struct opal_resp_tok *tok; 1588 int n = *iter; 1589 u64 val; 1590 1591 tok = response_get_token(resp, n); 1592 if (IS_ERR(tok)) 1593 return PTR_ERR(tok); 1594 1595 if (!response_token_matches(tok, OPAL_STARTNAME)) { 1596 pr_debug("Unexpected response token type %d.\n", n); 1597 return OPAL_INVAL_PARAM; 1598 } 1599 n++; 1600 1601 if (response_get_u64(resp, n) != column) { 1602 pr_debug("Token %d does not match expected column %llu.\n", 1603 n, column); 1604 return OPAL_INVAL_PARAM; 1605 } 1606 n++; 1607 1608 val = response_get_u64(resp, n); 1609 n++; 1610 1611 tok = response_get_token(resp, n); 1612 if (IS_ERR(tok)) 1613 return PTR_ERR(tok); 1614 1615 if (!response_token_matches(tok, OPAL_ENDNAME)) { 1616 pr_debug("Unexpected response token type %d.\n", n); 1617 return OPAL_INVAL_PARAM; 1618 } 1619 n++; 1620 1621 *value = val; 1622 *iter = n; 1623 1624 return 0; 1625 } 1626 1627 static int locking_range_status(struct opal_dev *dev, void *data) 1628 { 1629 u8 lr_buffer[OPAL_UID_LENGTH]; 1630 u64 resp; 1631 bool rlocked, wlocked; 1632 int err, tok_n = 2; 1633 struct opal_lr_status *lrst = data; 1634 1635 err = build_locking_range(lr_buffer, sizeof(lr_buffer), 1636 lrst->session.opal_key.lr); 1637 if (err) 1638 return err; 1639 1640 err = generic_get_columns(dev, lr_buffer, OPAL_RANGESTART, 1641 OPAL_WRITELOCKED); 1642 if (err) { 1643 pr_debug("Couldn't get lr %u table columns %d to %d.\n", 1644 lrst->session.opal_key.lr, OPAL_RANGESTART, 1645 OPAL_WRITELOCKED); 1646 return err; 1647 } 1648 1649 /* range start */ 1650 err = response_get_column(&dev->parsed, &tok_n, OPAL_RANGESTART, 1651 &lrst->range_start); 1652 if (err) 1653 return err; 1654 1655 /* range length */ 1656 err = response_get_column(&dev->parsed, &tok_n, OPAL_RANGELENGTH, 1657 &lrst->range_length); 1658 if (err) 1659 return err; 1660 1661 /* RLE */ 1662 err = response_get_column(&dev->parsed, &tok_n, OPAL_READLOCKENABLED, 1663 &resp); 1664 if (err) 1665 return err; 1666 1667 lrst->RLE = !!resp; 1668 1669 /* WLE */ 1670 err = response_get_column(&dev->parsed, &tok_n, OPAL_WRITELOCKENABLED, 1671 &resp); 1672 if (err) 1673 return err; 1674 1675 lrst->WLE = !!resp; 1676 1677 /* read locked */ 1678 err = response_get_column(&dev->parsed, &tok_n, OPAL_READLOCKED, &resp); 1679 if (err) 1680 return err; 1681 1682 rlocked = !!resp; 1683 1684 /* write locked */ 1685 err = response_get_column(&dev->parsed, &tok_n, OPAL_WRITELOCKED, &resp); 1686 if (err) 1687 return err; 1688 1689 wlocked = !!resp; 1690 1691 /* opal_lock_state can not map 'read locked' only state. */ 1692 lrst->l_state = OPAL_RW; 1693 if (rlocked && wlocked) 1694 lrst->l_state = OPAL_LK; 1695 else if (wlocked) 1696 lrst->l_state = OPAL_RO; 1697 else if (rlocked) { 1698 pr_debug("Can not report read locked only state.\n"); 1699 return -EINVAL; 1700 } 1701 1702 return 0; 1703 } 1704 1705 static int start_generic_opal_session(struct opal_dev *dev, 1706 enum opal_uid auth, 1707 enum opal_uid sp_type, 1708 const char *key, 1709 u8 key_len) 1710 { 1711 u32 hsn; 1712 int err; 1713 1714 if (key == NULL && auth != OPAL_ANYBODY_UID) 1715 return OPAL_INVAL_PARAM; 1716 1717 hsn = GENERIC_HOST_SESSION_NUM; 1718 err = cmd_start(dev, opaluid[OPAL_SMUID_UID], 1719 opalmethod[OPAL_STARTSESSION]); 1720 1721 add_token_u64(&err, dev, hsn); 1722 add_token_bytestring(&err, dev, opaluid[sp_type], OPAL_UID_LENGTH); 1723 add_token_u8(&err, dev, 1); 1724 1725 switch (auth) { 1726 case OPAL_ANYBODY_UID: 1727 break; 1728 case OPAL_ADMIN1_UID: 1729 case OPAL_SID_UID: 1730 case OPAL_PSID_UID: 1731 add_token_u8(&err, dev, OPAL_STARTNAME); 1732 add_token_u8(&err, dev, 0); /* HostChallenge */ 1733 add_token_bytestring(&err, dev, key, key_len); 1734 add_token_u8(&err, dev, OPAL_ENDNAME); 1735 add_token_u8(&err, dev, OPAL_STARTNAME); 1736 add_token_u8(&err, dev, 3); /* HostSignAuth */ 1737 add_token_bytestring(&err, dev, opaluid[auth], 1738 OPAL_UID_LENGTH); 1739 add_token_u8(&err, dev, OPAL_ENDNAME); 1740 break; 1741 default: 1742 pr_debug("Cannot start Admin SP session with auth %d\n", auth); 1743 return OPAL_INVAL_PARAM; 1744 } 1745 1746 if (err) { 1747 pr_debug("Error building start adminsp session command.\n"); 1748 return err; 1749 } 1750 1751 return finalize_and_send(dev, start_opal_session_cont); 1752 } 1753 1754 static int start_anybodyASP_opal_session(struct opal_dev *dev, void *data) 1755 { 1756 return start_generic_opal_session(dev, OPAL_ANYBODY_UID, 1757 OPAL_ADMINSP_UID, NULL, 0); 1758 } 1759 1760 static int start_anybodyLSP_opal_session(struct opal_dev *dev, void *data) 1761 { 1762 return start_generic_opal_session(dev, OPAL_ANYBODY_UID, 1763 OPAL_LOCKINGSP_UID, NULL, 0); 1764 } 1765 1766 static int start_SIDASP_opal_session(struct opal_dev *dev, void *data) 1767 { 1768 int ret; 1769 const u8 *key = dev->prev_data; 1770 1771 if (!key) { 1772 const struct opal_key *okey = data; 1773 1774 ret = start_generic_opal_session(dev, OPAL_SID_UID, 1775 OPAL_ADMINSP_UID, 1776 okey->key, 1777 okey->key_len); 1778 } else { 1779 ret = start_generic_opal_session(dev, OPAL_SID_UID, 1780 OPAL_ADMINSP_UID, 1781 key, dev->prev_d_len); 1782 kfree(key); 1783 dev->prev_data = NULL; 1784 } 1785 1786 return ret; 1787 } 1788 1789 static int start_admin1LSP_opal_session(struct opal_dev *dev, void *data) 1790 { 1791 struct opal_key *key = data; 1792 1793 return start_generic_opal_session(dev, OPAL_ADMIN1_UID, 1794 OPAL_LOCKINGSP_UID, 1795 key->key, key->key_len); 1796 } 1797 1798 static int start_PSID_opal_session(struct opal_dev *dev, void *data) 1799 { 1800 const struct opal_key *okey = data; 1801 1802 return start_generic_opal_session(dev, OPAL_PSID_UID, 1803 OPAL_ADMINSP_UID, 1804 okey->key, 1805 okey->key_len); 1806 } 1807 1808 static int start_auth_opal_session(struct opal_dev *dev, void *data) 1809 { 1810 struct opal_session_info *session = data; 1811 u8 lk_ul_user[OPAL_UID_LENGTH]; 1812 size_t keylen = session->opal_key.key_len; 1813 int err = 0; 1814 1815 u8 *key = session->opal_key.key; 1816 u32 hsn = GENERIC_HOST_SESSION_NUM; 1817 1818 if (session->sum) 1819 err = build_locking_user(lk_ul_user, sizeof(lk_ul_user), 1820 session->opal_key.lr); 1821 else if (session->who != OPAL_ADMIN1 && !session->sum) 1822 err = build_locking_user(lk_ul_user, sizeof(lk_ul_user), 1823 session->who - 1); 1824 else 1825 memcpy(lk_ul_user, opaluid[OPAL_ADMIN1_UID], OPAL_UID_LENGTH); 1826 1827 if (err) 1828 return err; 1829 1830 err = cmd_start(dev, opaluid[OPAL_SMUID_UID], 1831 opalmethod[OPAL_STARTSESSION]); 1832 1833 add_token_u64(&err, dev, hsn); 1834 add_token_bytestring(&err, dev, opaluid[OPAL_LOCKINGSP_UID], 1835 OPAL_UID_LENGTH); 1836 add_token_u8(&err, dev, 1); 1837 add_token_u8(&err, dev, OPAL_STARTNAME); 1838 add_token_u8(&err, dev, 0); 1839 add_token_bytestring(&err, dev, key, keylen); 1840 add_token_u8(&err, dev, OPAL_ENDNAME); 1841 add_token_u8(&err, dev, OPAL_STARTNAME); 1842 add_token_u8(&err, dev, 3); 1843 add_token_bytestring(&err, dev, lk_ul_user, OPAL_UID_LENGTH); 1844 add_token_u8(&err, dev, OPAL_ENDNAME); 1845 1846 if (err) { 1847 pr_debug("Error building STARTSESSION command.\n"); 1848 return err; 1849 } 1850 1851 return finalize_and_send(dev, start_opal_session_cont); 1852 } 1853 1854 static int revert_tper(struct opal_dev *dev, void *data) 1855 { 1856 int err; 1857 1858 err = cmd_start(dev, opaluid[OPAL_ADMINSP_UID], 1859 opalmethod[OPAL_REVERT]); 1860 if (err) { 1861 pr_debug("Error building REVERT TPER command.\n"); 1862 return err; 1863 } 1864 1865 return finalize_and_send(dev, parse_and_check_status); 1866 } 1867 1868 static int internal_activate_user(struct opal_dev *dev, void *data) 1869 { 1870 struct opal_session_info *session = data; 1871 u8 uid[OPAL_UID_LENGTH]; 1872 int err; 1873 1874 memcpy(uid, opaluid[OPAL_USER1_UID], OPAL_UID_LENGTH); 1875 uid[7] = session->who; 1876 1877 err = cmd_start(dev, uid, opalmethod[OPAL_SET]); 1878 add_token_u8(&err, dev, OPAL_STARTNAME); 1879 add_token_u8(&err, dev, OPAL_VALUES); 1880 add_token_u8(&err, dev, OPAL_STARTLIST); 1881 add_token_u8(&err, dev, OPAL_STARTNAME); 1882 add_token_u8(&err, dev, 5); /* Enabled */ 1883 add_token_u8(&err, dev, OPAL_TRUE); 1884 add_token_u8(&err, dev, OPAL_ENDNAME); 1885 add_token_u8(&err, dev, OPAL_ENDLIST); 1886 add_token_u8(&err, dev, OPAL_ENDNAME); 1887 1888 if (err) { 1889 pr_debug("Error building Activate UserN command.\n"); 1890 return err; 1891 } 1892 1893 return finalize_and_send(dev, parse_and_check_status); 1894 } 1895 1896 static int revert_lsp(struct opal_dev *dev, void *data) 1897 { 1898 struct opal_revert_lsp *rev = data; 1899 int err; 1900 1901 err = cmd_start(dev, opaluid[OPAL_THISSP_UID], 1902 opalmethod[OPAL_REVERTSP]); 1903 add_token_u8(&err, dev, OPAL_STARTNAME); 1904 add_token_u64(&err, dev, OPAL_KEEP_GLOBAL_RANGE_KEY); 1905 add_token_u8(&err, dev, (rev->options & OPAL_PRESERVE) ? 1906 OPAL_TRUE : OPAL_FALSE); 1907 add_token_u8(&err, dev, OPAL_ENDNAME); 1908 if (err) { 1909 pr_debug("Error building REVERT SP command.\n"); 1910 return err; 1911 } 1912 1913 return finalize_and_send(dev, parse_and_check_status); 1914 } 1915 1916 static int erase_locking_range(struct opal_dev *dev, void *data) 1917 { 1918 struct opal_session_info *session = data; 1919 u8 uid[OPAL_UID_LENGTH]; 1920 int err; 1921 1922 if (build_locking_range(uid, sizeof(uid), session->opal_key.lr) < 0) 1923 return -ERANGE; 1924 1925 err = cmd_start(dev, uid, opalmethod[OPAL_ERASE]); 1926 1927 if (err) { 1928 pr_debug("Error building Erase Locking Range Command.\n"); 1929 return err; 1930 } 1931 1932 return finalize_and_send(dev, parse_and_check_status); 1933 } 1934 1935 static int set_mbr_done(struct opal_dev *dev, void *data) 1936 { 1937 u8 *mbr_done_tf = data; 1938 int err; 1939 1940 err = cmd_start(dev, opaluid[OPAL_MBRCONTROL], 1941 opalmethod[OPAL_SET]); 1942 1943 add_token_u8(&err, dev, OPAL_STARTNAME); 1944 add_token_u8(&err, dev, OPAL_VALUES); 1945 add_token_u8(&err, dev, OPAL_STARTLIST); 1946 add_token_u8(&err, dev, OPAL_STARTNAME); 1947 add_token_u8(&err, dev, OPAL_MBRDONE); 1948 add_token_u8(&err, dev, *mbr_done_tf); /* Done T or F */ 1949 add_token_u8(&err, dev, OPAL_ENDNAME); 1950 add_token_u8(&err, dev, OPAL_ENDLIST); 1951 add_token_u8(&err, dev, OPAL_ENDNAME); 1952 1953 if (err) { 1954 pr_debug("Error Building set MBR Done command\n"); 1955 return err; 1956 } 1957 1958 return finalize_and_send(dev, parse_and_check_status); 1959 } 1960 1961 static int set_mbr_enable_disable(struct opal_dev *dev, void *data) 1962 { 1963 u8 *mbr_en_dis = data; 1964 int err; 1965 1966 err = cmd_start(dev, opaluid[OPAL_MBRCONTROL], 1967 opalmethod[OPAL_SET]); 1968 1969 add_token_u8(&err, dev, OPAL_STARTNAME); 1970 add_token_u8(&err, dev, OPAL_VALUES); 1971 add_token_u8(&err, dev, OPAL_STARTLIST); 1972 add_token_u8(&err, dev, OPAL_STARTNAME); 1973 add_token_u8(&err, dev, OPAL_MBRENABLE); 1974 add_token_u8(&err, dev, *mbr_en_dis); 1975 add_token_u8(&err, dev, OPAL_ENDNAME); 1976 add_token_u8(&err, dev, OPAL_ENDLIST); 1977 add_token_u8(&err, dev, OPAL_ENDNAME); 1978 1979 if (err) { 1980 pr_debug("Error Building set MBR done command\n"); 1981 return err; 1982 } 1983 1984 return finalize_and_send(dev, parse_and_check_status); 1985 } 1986 1987 static int write_shadow_mbr(struct opal_dev *dev, void *data) 1988 { 1989 struct opal_shadow_mbr *shadow = data; 1990 1991 return generic_table_write_data(dev, shadow->data, shadow->offset, 1992 shadow->size, opaluid[OPAL_MBR]); 1993 } 1994 1995 static int generic_pw_cmd(u8 *key, size_t key_len, u8 *cpin_uid, 1996 struct opal_dev *dev) 1997 { 1998 int err; 1999 2000 err = cmd_start(dev, cpin_uid, opalmethod[OPAL_SET]); 2001 2002 add_token_u8(&err, dev, OPAL_STARTNAME); 2003 add_token_u8(&err, dev, OPAL_VALUES); 2004 add_token_u8(&err, dev, OPAL_STARTLIST); 2005 add_token_u8(&err, dev, OPAL_STARTNAME); 2006 add_token_u8(&err, dev, OPAL_PIN); 2007 add_token_bytestring(&err, dev, key, key_len); 2008 add_token_u8(&err, dev, OPAL_ENDNAME); 2009 add_token_u8(&err, dev, OPAL_ENDLIST); 2010 add_token_u8(&err, dev, OPAL_ENDNAME); 2011 2012 return err; 2013 } 2014 2015 static int set_new_pw(struct opal_dev *dev, void *data) 2016 { 2017 u8 cpin_uid[OPAL_UID_LENGTH]; 2018 struct opal_session_info *usr = data; 2019 2020 memcpy(cpin_uid, opaluid[OPAL_C_PIN_ADMIN1], OPAL_UID_LENGTH); 2021 2022 if (usr->who != OPAL_ADMIN1) { 2023 cpin_uid[5] = 0x03; 2024 if (usr->sum) 2025 cpin_uid[7] = usr->opal_key.lr + 1; 2026 else 2027 cpin_uid[7] = usr->who; 2028 } 2029 2030 if (generic_pw_cmd(usr->opal_key.key, usr->opal_key.key_len, 2031 cpin_uid, dev)) { 2032 pr_debug("Error building set password command.\n"); 2033 return -ERANGE; 2034 } 2035 2036 return finalize_and_send(dev, parse_and_check_status); 2037 } 2038 2039 static int set_sid_cpin_pin(struct opal_dev *dev, void *data) 2040 { 2041 u8 cpin_uid[OPAL_UID_LENGTH]; 2042 struct opal_key *key = data; 2043 2044 memcpy(cpin_uid, opaluid[OPAL_C_PIN_SID], OPAL_UID_LENGTH); 2045 2046 if (generic_pw_cmd(key->key, key->key_len, cpin_uid, dev)) { 2047 pr_debug("Error building Set SID cpin\n"); 2048 return -ERANGE; 2049 } 2050 return finalize_and_send(dev, parse_and_check_status); 2051 } 2052 2053 static void add_authority_object_ref(int *err, 2054 struct opal_dev *dev, 2055 const u8 *uid, 2056 size_t uid_len) 2057 { 2058 add_token_u8(err, dev, OPAL_STARTNAME); 2059 add_token_bytestring(err, dev, 2060 opaluid[OPAL_HALF_UID_AUTHORITY_OBJ_REF], 2061 OPAL_UID_LENGTH/2); 2062 add_token_bytestring(err, dev, uid, uid_len); 2063 add_token_u8(err, dev, OPAL_ENDNAME); 2064 } 2065 2066 static void add_boolean_object_ref(int *err, 2067 struct opal_dev *dev, 2068 u8 boolean_op) 2069 { 2070 add_token_u8(err, dev, OPAL_STARTNAME); 2071 add_token_bytestring(err, dev, opaluid[OPAL_HALF_UID_BOOLEAN_ACE], 2072 OPAL_UID_LENGTH/2); 2073 add_token_u8(err, dev, boolean_op); 2074 add_token_u8(err, dev, OPAL_ENDNAME); 2075 } 2076 2077 static int set_lr_boolean_ace(struct opal_dev *dev, 2078 unsigned int opal_uid, 2079 u8 lr, 2080 const u8 *users, 2081 size_t users_len) 2082 { 2083 u8 lr_buffer[OPAL_UID_LENGTH]; 2084 u8 user_uid[OPAL_UID_LENGTH]; 2085 u8 u; 2086 int err; 2087 2088 memcpy(lr_buffer, opaluid[opal_uid], OPAL_UID_LENGTH); 2089 lr_buffer[7] = lr; 2090 2091 err = cmd_start(dev, lr_buffer, opalmethod[OPAL_SET]); 2092 2093 add_token_u8(&err, dev, OPAL_STARTNAME); 2094 add_token_u8(&err, dev, OPAL_VALUES); 2095 2096 add_token_u8(&err, dev, OPAL_STARTLIST); 2097 add_token_u8(&err, dev, OPAL_STARTNAME); 2098 add_token_u8(&err, dev, 3); 2099 2100 add_token_u8(&err, dev, OPAL_STARTLIST); 2101 2102 for (u = 0; u < users_len; u++) { 2103 if (users[u] == OPAL_ADMIN1) 2104 memcpy(user_uid, opaluid[OPAL_ADMIN1_UID], 2105 OPAL_UID_LENGTH); 2106 else { 2107 memcpy(user_uid, opaluid[OPAL_USER1_UID], 2108 OPAL_UID_LENGTH); 2109 user_uid[7] = users[u]; 2110 } 2111 2112 add_authority_object_ref(&err, dev, user_uid, sizeof(user_uid)); 2113 2114 /* 2115 * Add boolean operator in postfix only with 2116 * two or more authorities being added in ACE 2117 * expresion. 2118 * */ 2119 if (u > 0) 2120 add_boolean_object_ref(&err, dev, OPAL_BOOLEAN_OR); 2121 } 2122 2123 add_token_u8(&err, dev, OPAL_ENDLIST); 2124 add_token_u8(&err, dev, OPAL_ENDNAME); 2125 add_token_u8(&err, dev, OPAL_ENDLIST); 2126 add_token_u8(&err, dev, OPAL_ENDNAME); 2127 2128 return err; 2129 } 2130 2131 static int add_user_to_lr(struct opal_dev *dev, void *data) 2132 { 2133 int err; 2134 struct opal_lock_unlock *lkul = data; 2135 const u8 users[] = { 2136 lkul->session.who 2137 }; 2138 2139 err = set_lr_boolean_ace(dev, 2140 lkul->l_state == OPAL_RW ? 2141 OPAL_LOCKINGRANGE_ACE_WRLOCKED : 2142 OPAL_LOCKINGRANGE_ACE_RDLOCKED, 2143 lkul->session.opal_key.lr, users, 2144 ARRAY_SIZE(users)); 2145 if (err) { 2146 pr_debug("Error building add user to locking range command.\n"); 2147 return err; 2148 } 2149 2150 return finalize_and_send(dev, parse_and_check_status); 2151 } 2152 2153 static int add_user_to_lr_ace(struct opal_dev *dev, void *data) 2154 { 2155 int err; 2156 struct opal_lock_unlock *lkul = data; 2157 const u8 users[] = { 2158 OPAL_ADMIN1, 2159 lkul->session.who 2160 }; 2161 2162 err = set_lr_boolean_ace(dev, OPAL_LOCKINGRANGE_ACE_START_TO_KEY, 2163 lkul->session.opal_key.lr, users, 2164 ARRAY_SIZE(users)); 2165 2166 if (err) { 2167 pr_debug("Error building add user to locking ranges ACEs.\n"); 2168 return err; 2169 } 2170 2171 return finalize_and_send(dev, parse_and_check_status); 2172 } 2173 2174 static int lock_unlock_locking_range(struct opal_dev *dev, void *data) 2175 { 2176 u8 lr_buffer[OPAL_UID_LENGTH]; 2177 struct opal_lock_unlock *lkul = data; 2178 u8 read_locked = 1, write_locked = 1; 2179 int err; 2180 2181 if (build_locking_range(lr_buffer, sizeof(lr_buffer), 2182 lkul->session.opal_key.lr) < 0) 2183 return -ERANGE; 2184 2185 switch (lkul->l_state) { 2186 case OPAL_RO: 2187 read_locked = 0; 2188 write_locked = 1; 2189 break; 2190 case OPAL_RW: 2191 read_locked = 0; 2192 write_locked = 0; 2193 break; 2194 case OPAL_LK: 2195 /* vars are initialized to locked */ 2196 break; 2197 default: 2198 pr_debug("Tried to set an invalid locking state... returning to uland\n"); 2199 return OPAL_INVAL_PARAM; 2200 } 2201 2202 err = cmd_start(dev, lr_buffer, opalmethod[OPAL_SET]); 2203 2204 add_token_u8(&err, dev, OPAL_STARTNAME); 2205 add_token_u8(&err, dev, OPAL_VALUES); 2206 add_token_u8(&err, dev, OPAL_STARTLIST); 2207 2208 add_token_u8(&err, dev, OPAL_STARTNAME); 2209 add_token_u8(&err, dev, OPAL_READLOCKED); 2210 add_token_u8(&err, dev, read_locked); 2211 add_token_u8(&err, dev, OPAL_ENDNAME); 2212 2213 add_token_u8(&err, dev, OPAL_STARTNAME); 2214 add_token_u8(&err, dev, OPAL_WRITELOCKED); 2215 add_token_u8(&err, dev, write_locked); 2216 add_token_u8(&err, dev, OPAL_ENDNAME); 2217 2218 add_token_u8(&err, dev, OPAL_ENDLIST); 2219 add_token_u8(&err, dev, OPAL_ENDNAME); 2220 2221 if (err) { 2222 pr_debug("Error building SET command.\n"); 2223 return err; 2224 } 2225 2226 return finalize_and_send(dev, parse_and_check_status); 2227 } 2228 2229 2230 static int lock_unlock_locking_range_sum(struct opal_dev *dev, void *data) 2231 { 2232 u8 lr_buffer[OPAL_UID_LENGTH]; 2233 u8 read_locked = 1, write_locked = 1; 2234 struct opal_lock_unlock *lkul = data; 2235 int ret; 2236 2237 clear_opal_cmd(dev); 2238 set_comid(dev, dev->comid); 2239 2240 if (build_locking_range(lr_buffer, sizeof(lr_buffer), 2241 lkul->session.opal_key.lr) < 0) 2242 return -ERANGE; 2243 2244 switch (lkul->l_state) { 2245 case OPAL_RO: 2246 read_locked = 0; 2247 write_locked = 1; 2248 break; 2249 case OPAL_RW: 2250 read_locked = 0; 2251 write_locked = 0; 2252 break; 2253 case OPAL_LK: 2254 /* vars are initialized to locked */ 2255 break; 2256 default: 2257 pr_debug("Tried to set an invalid locking state.\n"); 2258 return OPAL_INVAL_PARAM; 2259 } 2260 ret = generic_lr_enable_disable(dev, lr_buffer, 1, 1, 2261 read_locked, write_locked); 2262 2263 if (ret < 0) { 2264 pr_debug("Error building SET command.\n"); 2265 return ret; 2266 } 2267 2268 return finalize_and_send(dev, parse_and_check_status); 2269 } 2270 2271 static int activate_lsp(struct opal_dev *dev, void *data) 2272 { 2273 struct opal_lr_act *opal_act = data; 2274 u8 user_lr[OPAL_UID_LENGTH]; 2275 int err, i; 2276 2277 err = cmd_start(dev, opaluid[OPAL_LOCKINGSP_UID], 2278 opalmethod[OPAL_ACTIVATE]); 2279 2280 if (opal_act->sum) { 2281 err = build_locking_range(user_lr, sizeof(user_lr), 2282 opal_act->lr[0]); 2283 if (err) 2284 return err; 2285 2286 add_token_u8(&err, dev, OPAL_STARTNAME); 2287 add_token_u64(&err, dev, OPAL_SUM_SET_LIST); 2288 2289 add_token_u8(&err, dev, OPAL_STARTLIST); 2290 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH); 2291 for (i = 1; i < opal_act->num_lrs; i++) { 2292 user_lr[7] = opal_act->lr[i]; 2293 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH); 2294 } 2295 add_token_u8(&err, dev, OPAL_ENDLIST); 2296 add_token_u8(&err, dev, OPAL_ENDNAME); 2297 } 2298 2299 if (err) { 2300 pr_debug("Error building Activate LockingSP command.\n"); 2301 return err; 2302 } 2303 2304 return finalize_and_send(dev, parse_and_check_status); 2305 } 2306 2307 static int reactivate_lsp(struct opal_dev *dev, void *data) 2308 { 2309 struct opal_lr_react *opal_react = data; 2310 u8 user_lr[OPAL_UID_LENGTH]; 2311 int err, i; 2312 2313 err = cmd_start(dev, opaluid[OPAL_THISSP_UID], 2314 opalmethod[OPAL_REACTIVATE]); 2315 2316 if (err) { 2317 pr_debug("Error building Reactivate LockingSP command.\n"); 2318 return err; 2319 } 2320 2321 /* 2322 * If neither 'entire_table' nor 'num_lrs' is set, the device 2323 * gets reactivated with SUM disabled. Only Admin1PIN will change 2324 * if set. 2325 */ 2326 if (opal_react->entire_table) { 2327 /* Entire Locking table (all locking ranges) will be put in SUM. */ 2328 add_token_u8(&err, dev, OPAL_STARTNAME); 2329 add_token_u64(&err, dev, OPAL_SUM_SET_LIST); 2330 add_token_bytestring(&err, dev, opaluid[OPAL_LOCKING_TABLE], OPAL_UID_LENGTH); 2331 add_token_u8(&err, dev, OPAL_ENDNAME); 2332 } else if (opal_react->num_lrs) { 2333 /* Subset of Locking table (selected locking range(s)) to be put in SUM */ 2334 err = build_locking_range(user_lr, sizeof(user_lr), 2335 opal_react->lr[0]); 2336 if (err) 2337 return err; 2338 2339 add_token_u8(&err, dev, OPAL_STARTNAME); 2340 add_token_u64(&err, dev, OPAL_SUM_SET_LIST); 2341 2342 add_token_u8(&err, dev, OPAL_STARTLIST); 2343 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH); 2344 for (i = 1; i < opal_react->num_lrs; i++) { 2345 user_lr[7] = opal_react->lr[i]; 2346 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH); 2347 } 2348 add_token_u8(&err, dev, OPAL_ENDLIST); 2349 add_token_u8(&err, dev, OPAL_ENDNAME); 2350 } 2351 2352 /* Skipping the rangle policy parameter is same as setting its value to zero */ 2353 if (opal_react->range_policy && (opal_react->num_lrs || opal_react->entire_table)) { 2354 add_token_u8(&err, dev, OPAL_STARTNAME); 2355 add_token_u64(&err, dev, OPAL_SUM_RANGE_POLICY); 2356 add_token_u8(&err, dev, 1); 2357 add_token_u8(&err, dev, OPAL_ENDNAME); 2358 } 2359 2360 /* 2361 * Optional parameter. If set, it changes the Admin1 PIN even when SUM 2362 * is being disabled. 2363 */ 2364 if (opal_react->new_admin_key.key_len) { 2365 add_token_u8(&err, dev, OPAL_STARTNAME); 2366 add_token_u64(&err, dev, OPAL_SUM_ADMIN1_PIN); 2367 add_token_bytestring(&err, dev, opal_react->new_admin_key.key, 2368 opal_react->new_admin_key.key_len); 2369 add_token_u8(&err, dev, OPAL_ENDNAME); 2370 } 2371 2372 return finalize_and_send(dev, parse_and_check_status); 2373 } 2374 2375 /* Determine if we're in the Manufactured Inactive or Active state */ 2376 static int get_lsp_lifecycle(struct opal_dev *dev, void *data) 2377 { 2378 u8 lc_status; 2379 int err; 2380 2381 err = generic_get_column(dev, opaluid[OPAL_LOCKINGSP_UID], 2382 OPAL_LIFECYCLE); 2383 if (err) 2384 return err; 2385 2386 lc_status = response_get_u64(&dev->parsed, 4); 2387 /* 0x08 is Manufactured Inactive */ 2388 /* 0x09 is Manufactured */ 2389 if (lc_status != OPAL_MANUFACTURED_INACTIVE) { 2390 pr_debug("Couldn't determine the status of the Lifecycle state\n"); 2391 return -ENODEV; 2392 } 2393 2394 return 0; 2395 } 2396 2397 static int get_msid_cpin_pin(struct opal_dev *dev, void *data) 2398 { 2399 const char *msid_pin; 2400 size_t strlen; 2401 int err; 2402 2403 err = generic_get_column(dev, opaluid[OPAL_C_PIN_MSID], OPAL_PIN); 2404 if (err) 2405 return err; 2406 2407 strlen = response_get_string(&dev->parsed, 4, &msid_pin); 2408 if (!msid_pin) { 2409 pr_debug("Couldn't extract MSID_CPIN from response\n"); 2410 return OPAL_INVAL_PARAM; 2411 } 2412 2413 dev->prev_data = kmemdup(msid_pin, strlen, GFP_KERNEL); 2414 if (!dev->prev_data) 2415 return -ENOMEM; 2416 2417 dev->prev_d_len = strlen; 2418 2419 return 0; 2420 } 2421 2422 static int write_table_data(struct opal_dev *dev, void *data) 2423 { 2424 struct opal_read_write_table *write_tbl = data; 2425 2426 return generic_table_write_data(dev, write_tbl->data, write_tbl->offset, 2427 write_tbl->size, write_tbl->table_uid); 2428 } 2429 2430 static int read_table_data_cont(struct opal_dev *dev) 2431 { 2432 int err; 2433 const char *data_read; 2434 2435 err = parse_and_check_status(dev); 2436 if (err) 2437 return err; 2438 2439 dev->prev_d_len = response_get_string(&dev->parsed, 1, &data_read); 2440 dev->prev_data = (void *)data_read; 2441 if (!dev->prev_data) { 2442 pr_debug("%s: Couldn't read data from the table.\n", __func__); 2443 return OPAL_INVAL_PARAM; 2444 } 2445 2446 return 0; 2447 } 2448 2449 /* 2450 * IO_BUFFER_LENGTH = 2048 2451 * sizeof(header) = 56 2452 * No. of Token Bytes in the Response = 11 2453 * MAX size of data that can be carried in response buffer 2454 * at a time is : 2048 - (56 + 11) = 1981 = 0x7BD. 2455 */ 2456 #define OPAL_MAX_READ_TABLE (0x7BD) 2457 2458 static int read_table_data(struct opal_dev *dev, void *data) 2459 { 2460 struct opal_read_write_table *read_tbl = data; 2461 int err; 2462 size_t off = 0, max_read_size = OPAL_MAX_READ_TABLE; 2463 u64 table_len, len; 2464 u64 offset = read_tbl->offset, read_size = read_tbl->size - 1; 2465 u8 __user *dst; 2466 2467 err = generic_get_table_info(dev, read_tbl->table_uid, OPAL_TABLE_ROWS); 2468 if (err) { 2469 pr_debug("Couldn't get the table size\n"); 2470 return err; 2471 } 2472 2473 table_len = response_get_u64(&dev->parsed, 4); 2474 2475 /* Check if the user is trying to read from the table limits */ 2476 if (read_size > table_len || offset > table_len - read_size) { 2477 pr_debug("Read size exceeds the Table size limits (%llu vs. %llu)\n", 2478 offset + read_size, table_len); 2479 return -EINVAL; 2480 } 2481 2482 while (off < read_size) { 2483 err = cmd_start(dev, read_tbl->table_uid, opalmethod[OPAL_GET]); 2484 2485 add_token_u8(&err, dev, OPAL_STARTLIST); 2486 add_token_u8(&err, dev, OPAL_STARTNAME); 2487 add_token_u8(&err, dev, OPAL_STARTROW); 2488 add_token_u64(&err, dev, offset + off); /* start row value */ 2489 add_token_u8(&err, dev, OPAL_ENDNAME); 2490 2491 add_token_u8(&err, dev, OPAL_STARTNAME); 2492 add_token_u8(&err, dev, OPAL_ENDROW); 2493 2494 len = min(max_read_size, (size_t)(read_size - off)); 2495 add_token_u64(&err, dev, offset + off + len); /* end row value 2496 */ 2497 add_token_u8(&err, dev, OPAL_ENDNAME); 2498 add_token_u8(&err, dev, OPAL_ENDLIST); 2499 2500 if (err) { 2501 pr_debug("Error building read table data command.\n"); 2502 break; 2503 } 2504 2505 err = finalize_and_send(dev, read_table_data_cont); 2506 if (err) 2507 break; 2508 2509 /* len+1: This includes the NULL terminator at the end*/ 2510 if (dev->prev_d_len > len + 1) { 2511 err = -EOVERFLOW; 2512 break; 2513 } 2514 2515 dst = (u8 __user *)(uintptr_t)read_tbl->data; 2516 if (copy_to_user(dst + off, dev->prev_data, dev->prev_d_len)) { 2517 pr_debug("Error copying data to userspace\n"); 2518 err = -EFAULT; 2519 break; 2520 } 2521 dev->prev_data = NULL; 2522 2523 off += len; 2524 } 2525 2526 return err; 2527 } 2528 2529 static int end_opal_session(struct opal_dev *dev, void *data) 2530 { 2531 int err = 0; 2532 2533 clear_opal_cmd(dev); 2534 set_comid(dev, dev->comid); 2535 add_token_u8(&err, dev, OPAL_ENDOFSESSION); 2536 2537 if (err < 0) 2538 return err; 2539 2540 return finalize_and_send(dev, end_session_cont); 2541 } 2542 2543 static int end_opal_session_error(struct opal_dev *dev) 2544 { 2545 const struct opal_step error_end_session = { 2546 end_opal_session, 2547 }; 2548 2549 return execute_step(dev, &error_end_session, 0); 2550 } 2551 2552 static inline void setup_opal_dev(struct opal_dev *dev) 2553 { 2554 dev->tsn = 0; 2555 dev->hsn = 0; 2556 dev->prev_data = NULL; 2557 } 2558 2559 static int check_opal_support(struct opal_dev *dev) 2560 { 2561 int ret; 2562 2563 mutex_lock(&dev->dev_lock); 2564 setup_opal_dev(dev); 2565 ret = opal_discovery0_step(dev); 2566 if (!ret) 2567 dev->flags |= OPAL_FL_SUPPORTED; 2568 mutex_unlock(&dev->dev_lock); 2569 2570 return ret; 2571 } 2572 2573 static void clean_opal_dev(struct opal_dev *dev) 2574 { 2575 2576 struct opal_suspend_data *suspend, *next; 2577 2578 mutex_lock(&dev->dev_lock); 2579 list_for_each_entry_safe(suspend, next, &dev->unlk_lst, node) { 2580 list_del(&suspend->node); 2581 kfree(suspend); 2582 } 2583 mutex_unlock(&dev->dev_lock); 2584 } 2585 2586 void free_opal_dev(struct opal_dev *dev) 2587 { 2588 if (!dev) 2589 return; 2590 2591 clean_opal_dev(dev); 2592 kfree(dev->resp); 2593 kfree(dev->cmd); 2594 kfree(dev); 2595 } 2596 EXPORT_SYMBOL(free_opal_dev); 2597 2598 struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv) 2599 { 2600 struct opal_dev *dev; 2601 2602 dev = kmalloc_obj(*dev); 2603 if (!dev) 2604 return NULL; 2605 2606 /* 2607 * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes 2608 * sure the allocated buffer is DMA-safe in that regard. 2609 */ 2610 dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); 2611 if (!dev->cmd) 2612 goto err_free_dev; 2613 2614 dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); 2615 if (!dev->resp) 2616 goto err_free_cmd; 2617 2618 INIT_LIST_HEAD(&dev->unlk_lst); 2619 mutex_init(&dev->dev_lock); 2620 dev->flags = 0; 2621 dev->data = data; 2622 dev->send_recv = send_recv; 2623 if (check_opal_support(dev) != 0) { 2624 pr_debug("Opal is not supported on this device\n"); 2625 goto err_free_resp; 2626 } 2627 2628 return dev; 2629 2630 err_free_resp: 2631 kfree(dev->resp); 2632 2633 err_free_cmd: 2634 kfree(dev->cmd); 2635 2636 err_free_dev: 2637 kfree(dev); 2638 2639 return NULL; 2640 } 2641 EXPORT_SYMBOL(init_opal_dev); 2642 2643 static int opal_secure_erase_locking_range(struct opal_dev *dev, 2644 struct opal_session_info *opal_session) 2645 { 2646 const struct opal_step erase_steps[] = { 2647 { start_auth_opal_session, opal_session }, 2648 { get_active_key, &opal_session->opal_key.lr }, 2649 { gen_key, }, 2650 { end_opal_session, } 2651 }; 2652 int ret; 2653 2654 ret = opal_get_key(dev, &opal_session->opal_key); 2655 if (ret) 2656 return ret; 2657 mutex_lock(&dev->dev_lock); 2658 setup_opal_dev(dev); 2659 ret = execute_steps(dev, erase_steps, ARRAY_SIZE(erase_steps)); 2660 mutex_unlock(&dev->dev_lock); 2661 2662 return ret; 2663 } 2664 2665 static int opal_get_discv(struct opal_dev *dev, struct opal_discovery *discv) 2666 { 2667 const struct opal_step discovery0_step = { 2668 opal_discovery0, discv 2669 }; 2670 int ret; 2671 2672 mutex_lock(&dev->dev_lock); 2673 setup_opal_dev(dev); 2674 ret = execute_step(dev, &discovery0_step, 0); 2675 mutex_unlock(&dev->dev_lock); 2676 if (ret) 2677 return ret; 2678 return discv->size; /* modified to actual length of data */ 2679 } 2680 2681 static int opal_revertlsp(struct opal_dev *dev, struct opal_revert_lsp *rev) 2682 { 2683 /* controller will terminate session */ 2684 const struct opal_step steps[] = { 2685 { start_admin1LSP_opal_session, &rev->key }, 2686 { revert_lsp, rev } 2687 }; 2688 int ret; 2689 2690 ret = opal_get_key(dev, &rev->key); 2691 if (ret) 2692 return ret; 2693 mutex_lock(&dev->dev_lock); 2694 setup_opal_dev(dev); 2695 ret = execute_steps(dev, steps, ARRAY_SIZE(steps)); 2696 mutex_unlock(&dev->dev_lock); 2697 2698 return ret; 2699 } 2700 2701 static int opal_erase_locking_range(struct opal_dev *dev, 2702 struct opal_session_info *opal_session) 2703 { 2704 const struct opal_step erase_steps[] = { 2705 { start_auth_opal_session, opal_session }, 2706 { erase_locking_range, opal_session }, 2707 { end_opal_session, } 2708 }; 2709 int ret; 2710 2711 ret = opal_get_key(dev, &opal_session->opal_key); 2712 if (ret) 2713 return ret; 2714 mutex_lock(&dev->dev_lock); 2715 setup_opal_dev(dev); 2716 ret = execute_steps(dev, erase_steps, ARRAY_SIZE(erase_steps)); 2717 mutex_unlock(&dev->dev_lock); 2718 2719 return ret; 2720 } 2721 2722 static int opal_enable_disable_shadow_mbr(struct opal_dev *dev, 2723 struct opal_mbr_data *opal_mbr) 2724 { 2725 u8 enable_disable = opal_mbr->enable_disable == OPAL_MBR_ENABLE ? 2726 OPAL_TRUE : OPAL_FALSE; 2727 2728 const struct opal_step mbr_steps[] = { 2729 { start_admin1LSP_opal_session, &opal_mbr->key }, 2730 { set_mbr_done, &enable_disable }, 2731 { end_opal_session, }, 2732 { start_admin1LSP_opal_session, &opal_mbr->key }, 2733 { set_mbr_enable_disable, &enable_disable }, 2734 { end_opal_session, } 2735 }; 2736 int ret; 2737 2738 if (opal_mbr->enable_disable != OPAL_MBR_ENABLE && 2739 opal_mbr->enable_disable != OPAL_MBR_DISABLE) 2740 return -EINVAL; 2741 2742 ret = opal_get_key(dev, &opal_mbr->key); 2743 if (ret) 2744 return ret; 2745 mutex_lock(&dev->dev_lock); 2746 setup_opal_dev(dev); 2747 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps)); 2748 mutex_unlock(&dev->dev_lock); 2749 2750 return ret; 2751 } 2752 2753 static int opal_set_mbr_done(struct opal_dev *dev, 2754 struct opal_mbr_done *mbr_done) 2755 { 2756 u8 mbr_done_tf = mbr_done->done_flag == OPAL_MBR_DONE ? 2757 OPAL_TRUE : OPAL_FALSE; 2758 2759 const struct opal_step mbr_steps[] = { 2760 { start_admin1LSP_opal_session, &mbr_done->key }, 2761 { set_mbr_done, &mbr_done_tf }, 2762 { end_opal_session, } 2763 }; 2764 int ret; 2765 2766 if (mbr_done->done_flag != OPAL_MBR_DONE && 2767 mbr_done->done_flag != OPAL_MBR_NOT_DONE) 2768 return -EINVAL; 2769 2770 ret = opal_get_key(dev, &mbr_done->key); 2771 if (ret) 2772 return ret; 2773 mutex_lock(&dev->dev_lock); 2774 setup_opal_dev(dev); 2775 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps)); 2776 mutex_unlock(&dev->dev_lock); 2777 2778 return ret; 2779 } 2780 2781 static int opal_write_shadow_mbr(struct opal_dev *dev, 2782 struct opal_shadow_mbr *info) 2783 { 2784 const struct opal_step mbr_steps[] = { 2785 { start_admin1LSP_opal_session, &info->key }, 2786 { write_shadow_mbr, info }, 2787 { end_opal_session, } 2788 }; 2789 int ret; 2790 2791 if (info->size == 0) 2792 return 0; 2793 2794 ret = opal_get_key(dev, &info->key); 2795 if (ret) 2796 return ret; 2797 mutex_lock(&dev->dev_lock); 2798 setup_opal_dev(dev); 2799 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps)); 2800 mutex_unlock(&dev->dev_lock); 2801 2802 return ret; 2803 } 2804 2805 static int opal_save(struct opal_dev *dev, struct opal_lock_unlock *lk_unlk) 2806 { 2807 struct opal_suspend_data *suspend; 2808 2809 suspend = kzalloc_obj(*suspend); 2810 if (!suspend) 2811 return -ENOMEM; 2812 2813 suspend->unlk = *lk_unlk; 2814 suspend->lr = lk_unlk->session.opal_key.lr; 2815 2816 mutex_lock(&dev->dev_lock); 2817 setup_opal_dev(dev); 2818 add_suspend_info(dev, suspend); 2819 mutex_unlock(&dev->dev_lock); 2820 2821 return 0; 2822 } 2823 2824 static int opal_add_user_to_lr(struct opal_dev *dev, 2825 struct opal_lock_unlock *lk_unlk) 2826 { 2827 const struct opal_step steps[] = { 2828 { start_admin1LSP_opal_session, &lk_unlk->session.opal_key }, 2829 { add_user_to_lr, lk_unlk }, 2830 { add_user_to_lr_ace, lk_unlk }, 2831 { end_opal_session, } 2832 }; 2833 int ret; 2834 2835 if (lk_unlk->l_state != OPAL_RO && 2836 lk_unlk->l_state != OPAL_RW) { 2837 pr_debug("Locking state was not RO or RW\n"); 2838 return -EINVAL; 2839 } 2840 2841 if (lk_unlk->session.who < OPAL_USER1 || 2842 lk_unlk->session.who > OPAL_USER9) { 2843 pr_debug("Authority was not within the range of users: %d\n", 2844 lk_unlk->session.who); 2845 return -EINVAL; 2846 } 2847 2848 if (lk_unlk->session.sum) { 2849 pr_debug("%s not supported in sum. Use setup locking range\n", 2850 __func__); 2851 return -EINVAL; 2852 } 2853 2854 ret = opal_get_key(dev, &lk_unlk->session.opal_key); 2855 if (ret) 2856 return ret; 2857 mutex_lock(&dev->dev_lock); 2858 setup_opal_dev(dev); 2859 ret = execute_steps(dev, steps, ARRAY_SIZE(steps)); 2860 mutex_unlock(&dev->dev_lock); 2861 2862 return ret; 2863 } 2864 2865 static int opal_reverttper(struct opal_dev *dev, struct opal_key *opal, bool psid) 2866 { 2867 /* controller will terminate session */ 2868 const struct opal_step revert_steps[] = { 2869 { start_SIDASP_opal_session, opal }, 2870 { revert_tper, } 2871 }; 2872 const struct opal_step psid_revert_steps[] = { 2873 { start_PSID_opal_session, opal }, 2874 { revert_tper, } 2875 }; 2876 2877 int ret; 2878 2879 ret = opal_get_key(dev, opal); 2880 2881 if (ret) 2882 return ret; 2883 mutex_lock(&dev->dev_lock); 2884 setup_opal_dev(dev); 2885 if (psid) 2886 ret = execute_steps(dev, psid_revert_steps, 2887 ARRAY_SIZE(psid_revert_steps)); 2888 else 2889 ret = execute_steps(dev, revert_steps, 2890 ARRAY_SIZE(revert_steps)); 2891 mutex_unlock(&dev->dev_lock); 2892 2893 /* 2894 * If we successfully reverted lets clean 2895 * any saved locking ranges. 2896 */ 2897 if (!ret) 2898 clean_opal_dev(dev); 2899 2900 return ret; 2901 } 2902 2903 static int __opal_lock_unlock(struct opal_dev *dev, 2904 struct opal_lock_unlock *lk_unlk) 2905 { 2906 const struct opal_step unlock_steps[] = { 2907 { start_auth_opal_session, &lk_unlk->session }, 2908 { lock_unlock_locking_range, lk_unlk }, 2909 { end_opal_session, } 2910 }; 2911 const struct opal_step unlock_sum_steps[] = { 2912 { start_auth_opal_session, &lk_unlk->session }, 2913 { lock_unlock_locking_range_sum, lk_unlk }, 2914 { end_opal_session, } 2915 }; 2916 2917 if (lk_unlk->session.sum) 2918 return execute_steps(dev, unlock_sum_steps, 2919 ARRAY_SIZE(unlock_sum_steps)); 2920 else 2921 return execute_steps(dev, unlock_steps, 2922 ARRAY_SIZE(unlock_steps)); 2923 } 2924 2925 static int __opal_set_mbr_done(struct opal_dev *dev, struct opal_key *key) 2926 { 2927 u8 mbr_done_tf = OPAL_TRUE; 2928 const struct opal_step mbrdone_step[] = { 2929 { start_admin1LSP_opal_session, key }, 2930 { set_mbr_done, &mbr_done_tf }, 2931 { end_opal_session, } 2932 }; 2933 2934 return execute_steps(dev, mbrdone_step, ARRAY_SIZE(mbrdone_step)); 2935 } 2936 2937 static void opal_lock_check_for_saved_key(struct opal_dev *dev, 2938 struct opal_lock_unlock *lk_unlk) 2939 { 2940 struct opal_suspend_data *iter; 2941 2942 if (lk_unlk->l_state != OPAL_LK || 2943 lk_unlk->session.opal_key.key_len > 0) 2944 return; 2945 2946 /* 2947 * Usually when closing a crypto device (eg: dm-crypt with LUKS) the 2948 * volume key is not required, as it requires root privileges anyway, 2949 * and root can deny access to a disk in many ways regardless. 2950 * Requiring the volume key to lock the device is a peculiarity of the 2951 * OPAL specification. Given we might already have saved the key if 2952 * the user requested it via the 'IOC_OPAL_SAVE' ioctl, we can use 2953 * that key to lock the device if no key was provided here, the 2954 * locking range matches and the appropriate flag was passed with 2955 * 'IOC_OPAL_SAVE'. 2956 * This allows integrating OPAL with tools and libraries that are used 2957 * to the common behaviour and do not ask for the volume key when 2958 * closing a device. 2959 */ 2960 setup_opal_dev(dev); 2961 list_for_each_entry(iter, &dev->unlk_lst, node) { 2962 if ((iter->unlk.flags & OPAL_SAVE_FOR_LOCK) && 2963 iter->lr == lk_unlk->session.opal_key.lr && 2964 iter->unlk.session.opal_key.key_len > 0) { 2965 lk_unlk->session.opal_key.key_len = 2966 iter->unlk.session.opal_key.key_len; 2967 memcpy(lk_unlk->session.opal_key.key, 2968 iter->unlk.session.opal_key.key, 2969 iter->unlk.session.opal_key.key_len); 2970 break; 2971 } 2972 } 2973 } 2974 2975 static int opal_lock_unlock(struct opal_dev *dev, 2976 struct opal_lock_unlock *lk_unlk) 2977 { 2978 int ret; 2979 2980 if (lk_unlk->session.who > OPAL_USER9) 2981 return -EINVAL; 2982 2983 mutex_lock(&dev->dev_lock); 2984 opal_lock_check_for_saved_key(dev, lk_unlk); 2985 ret = opal_get_key(dev, &lk_unlk->session.opal_key); 2986 if (!ret) 2987 ret = __opal_lock_unlock(dev, lk_unlk); 2988 mutex_unlock(&dev->dev_lock); 2989 2990 return ret; 2991 } 2992 2993 static int opal_take_ownership(struct opal_dev *dev, struct opal_key *opal) 2994 { 2995 const struct opal_step owner_steps[] = { 2996 { start_anybodyASP_opal_session, }, 2997 { get_msid_cpin_pin, }, 2998 { end_opal_session, }, 2999 { start_SIDASP_opal_session, opal }, 3000 { set_sid_cpin_pin, opal }, 3001 { end_opal_session, } 3002 }; 3003 int ret; 3004 3005 if (!dev) 3006 return -ENODEV; 3007 3008 ret = opal_get_key(dev, opal); 3009 if (ret) 3010 return ret; 3011 mutex_lock(&dev->dev_lock); 3012 setup_opal_dev(dev); 3013 ret = execute_steps(dev, owner_steps, ARRAY_SIZE(owner_steps)); 3014 mutex_unlock(&dev->dev_lock); 3015 3016 return ret; 3017 } 3018 3019 static int opal_activate_lsp(struct opal_dev *dev, 3020 struct opal_lr_act *opal_lr_act) 3021 { 3022 const struct opal_step active_steps[] = { 3023 { start_SIDASP_opal_session, &opal_lr_act->key }, 3024 { get_lsp_lifecycle, }, 3025 { activate_lsp, opal_lr_act }, 3026 { end_opal_session, } 3027 }; 3028 int ret; 3029 3030 if (opal_lr_act->sum && 3031 (!opal_lr_act->num_lrs || opal_lr_act->num_lrs > OPAL_MAX_LRS)) 3032 return -EINVAL; 3033 3034 ret = opal_get_key(dev, &opal_lr_act->key); 3035 if (ret) 3036 return ret; 3037 mutex_lock(&dev->dev_lock); 3038 setup_opal_dev(dev); 3039 ret = execute_steps(dev, active_steps, ARRAY_SIZE(active_steps)); 3040 mutex_unlock(&dev->dev_lock); 3041 3042 return ret; 3043 } 3044 3045 static int opal_reactivate_lsp(struct opal_dev *dev, 3046 struct opal_lr_react *opal_lr_react) 3047 { 3048 const struct opal_step active_steps[] = { 3049 { start_admin1LSP_opal_session, &opal_lr_react->key }, 3050 { reactivate_lsp, opal_lr_react }, 3051 /* No end_opal_session. The controller terminates the session */ 3052 }; 3053 int ret; 3054 3055 /* use either 'entire_table' parameter or set of locking ranges */ 3056 if (opal_lr_react->num_lrs > OPAL_MAX_LRS || 3057 (opal_lr_react->num_lrs && opal_lr_react->entire_table)) 3058 return -EINVAL; 3059 3060 ret = opal_get_key(dev, &opal_lr_react->key); 3061 if (ret) 3062 return ret; 3063 mutex_lock(&dev->dev_lock); 3064 setup_opal_dev(dev); 3065 ret = execute_steps(dev, active_steps, ARRAY_SIZE(active_steps)); 3066 mutex_unlock(&dev->dev_lock); 3067 3068 return ret; 3069 } 3070 3071 static int opal_setup_locking_range(struct opal_dev *dev, 3072 struct opal_user_lr_setup *opal_lrs) 3073 { 3074 const struct opal_step lr_steps[] = { 3075 { start_auth_opal_session, &opal_lrs->session }, 3076 { setup_locking_range_start_length, opal_lrs }, 3077 { setup_enable_range, opal_lrs }, 3078 { end_opal_session, } 3079 }, lr_global_steps[] = { 3080 { start_auth_opal_session, &opal_lrs->session }, 3081 { setup_enable_range, opal_lrs }, 3082 { end_opal_session, } 3083 }; 3084 int ret; 3085 3086 ret = opal_get_key(dev, &opal_lrs->session.opal_key); 3087 if (ret) 3088 return ret; 3089 mutex_lock(&dev->dev_lock); 3090 setup_opal_dev(dev); 3091 if (opal_lrs->session.opal_key.lr == 0) 3092 ret = execute_steps(dev, lr_global_steps, ARRAY_SIZE(lr_global_steps)); 3093 else 3094 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps)); 3095 mutex_unlock(&dev->dev_lock); 3096 3097 return ret; 3098 } 3099 3100 static int opal_setup_locking_range_start_length(struct opal_dev *dev, 3101 struct opal_user_lr_setup *opal_lrs) 3102 { 3103 const struct opal_step lr_steps[] = { 3104 { start_auth_opal_session, &opal_lrs->session }, 3105 { setup_locking_range_start_length, opal_lrs }, 3106 { end_opal_session, } 3107 }; 3108 int ret; 3109 3110 /* we can not set global locking range offset or length */ 3111 if (opal_lrs->session.opal_key.lr == 0) 3112 return -EINVAL; 3113 3114 ret = opal_get_key(dev, &opal_lrs->session.opal_key); 3115 if (ret) 3116 return ret; 3117 mutex_lock(&dev->dev_lock); 3118 setup_opal_dev(dev); 3119 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps)); 3120 mutex_unlock(&dev->dev_lock); 3121 3122 return ret; 3123 } 3124 3125 static int opal_enable_disable_range(struct opal_dev *dev, 3126 struct opal_user_lr_setup *opal_lrs) 3127 { 3128 const struct opal_step lr_steps[] = { 3129 { start_auth_opal_session, &opal_lrs->session }, 3130 { setup_enable_range, opal_lrs }, 3131 { end_opal_session, } 3132 }; 3133 int ret; 3134 3135 ret = opal_get_key(dev, &opal_lrs->session.opal_key); 3136 if (ret) 3137 return ret; 3138 mutex_lock(&dev->dev_lock); 3139 setup_opal_dev(dev); 3140 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps)); 3141 mutex_unlock(&dev->dev_lock); 3142 3143 return ret; 3144 } 3145 3146 static int opal_locking_range_status(struct opal_dev *dev, 3147 struct opal_lr_status *opal_lrst, 3148 void __user *data) 3149 { 3150 const struct opal_step lr_steps[] = { 3151 { start_auth_opal_session, &opal_lrst->session }, 3152 { locking_range_status, opal_lrst }, 3153 { end_opal_session, } 3154 }; 3155 int ret; 3156 3157 mutex_lock(&dev->dev_lock); 3158 setup_opal_dev(dev); 3159 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps)); 3160 mutex_unlock(&dev->dev_lock); 3161 3162 /* skip session info when copying back to uspace */ 3163 if (!ret && copy_to_user(data + offsetof(struct opal_lr_status, range_start), 3164 (void *)opal_lrst + offsetof(struct opal_lr_status, range_start), 3165 sizeof(*opal_lrst) - offsetof(struct opal_lr_status, range_start))) { 3166 pr_debug("Error copying status to userspace\n"); 3167 return -EFAULT; 3168 } 3169 3170 return ret; 3171 } 3172 3173 static int opal_set_new_pw(struct opal_dev *dev, struct opal_new_pw *opal_pw) 3174 { 3175 const struct opal_step pw_steps[] = { 3176 { start_auth_opal_session, &opal_pw->session }, 3177 { set_new_pw, &opal_pw->new_user_pw }, 3178 { end_opal_session, } 3179 }; 3180 int ret; 3181 3182 if (opal_pw->session.who > OPAL_USER9 || 3183 opal_pw->new_user_pw.who > OPAL_USER9) 3184 return -EINVAL; 3185 3186 mutex_lock(&dev->dev_lock); 3187 setup_opal_dev(dev); 3188 ret = execute_steps(dev, pw_steps, ARRAY_SIZE(pw_steps)); 3189 mutex_unlock(&dev->dev_lock); 3190 3191 if (ret) 3192 return ret; 3193 3194 /* update keyring and key store with new password */ 3195 ret = sed_write_key(OPAL_AUTH_KEY, 3196 opal_pw->new_user_pw.opal_key.key, 3197 opal_pw->new_user_pw.opal_key.key_len); 3198 if (ret != -EOPNOTSUPP) 3199 pr_warn("error updating SED key: %d\n", ret); 3200 3201 ret = update_sed_opal_key(OPAL_AUTH_KEY, 3202 opal_pw->new_user_pw.opal_key.key, 3203 opal_pw->new_user_pw.opal_key.key_len); 3204 3205 return ret; 3206 } 3207 3208 static int opal_set_new_sid_pw(struct opal_dev *dev, struct opal_new_pw *opal_pw) 3209 { 3210 int ret; 3211 struct opal_key *newkey = &opal_pw->new_user_pw.opal_key; 3212 struct opal_key *oldkey = &opal_pw->session.opal_key; 3213 3214 const struct opal_step pw_steps[] = { 3215 { start_SIDASP_opal_session, oldkey }, 3216 { set_sid_cpin_pin, newkey }, 3217 { end_opal_session, } 3218 }; 3219 3220 if (!dev) 3221 return -ENODEV; 3222 3223 mutex_lock(&dev->dev_lock); 3224 setup_opal_dev(dev); 3225 ret = execute_steps(dev, pw_steps, ARRAY_SIZE(pw_steps)); 3226 mutex_unlock(&dev->dev_lock); 3227 3228 return ret; 3229 } 3230 3231 static int opal_activate_user(struct opal_dev *dev, 3232 struct opal_session_info *opal_session) 3233 { 3234 const struct opal_step act_steps[] = { 3235 { start_admin1LSP_opal_session, &opal_session->opal_key }, 3236 { internal_activate_user, opal_session }, 3237 { end_opal_session, } 3238 }; 3239 int ret; 3240 3241 /* We can't activate Admin1 it's active as manufactured */ 3242 if (opal_session->who < OPAL_USER1 || 3243 opal_session->who > OPAL_USER9) { 3244 pr_debug("Who was not a valid user: %d\n", opal_session->who); 3245 return -EINVAL; 3246 } 3247 3248 ret = opal_get_key(dev, &opal_session->opal_key); 3249 if (ret) 3250 return ret; 3251 mutex_lock(&dev->dev_lock); 3252 setup_opal_dev(dev); 3253 ret = execute_steps(dev, act_steps, ARRAY_SIZE(act_steps)); 3254 mutex_unlock(&dev->dev_lock); 3255 3256 return ret; 3257 } 3258 3259 bool opal_unlock_from_suspend(struct opal_dev *dev) 3260 { 3261 struct opal_suspend_data *suspend; 3262 bool was_failure = false; 3263 int ret; 3264 3265 if (!dev) 3266 return false; 3267 3268 if (!(dev->flags & OPAL_FL_SUPPORTED)) 3269 return false; 3270 3271 mutex_lock(&dev->dev_lock); 3272 setup_opal_dev(dev); 3273 3274 list_for_each_entry(suspend, &dev->unlk_lst, node) { 3275 dev->tsn = 0; 3276 dev->hsn = 0; 3277 3278 ret = __opal_lock_unlock(dev, &suspend->unlk); 3279 if (ret) { 3280 pr_debug("Failed to unlock LR %hhu with sum %d\n", 3281 suspend->unlk.session.opal_key.lr, 3282 suspend->unlk.session.sum); 3283 was_failure = true; 3284 } 3285 3286 if (dev->flags & OPAL_FL_MBR_ENABLED) { 3287 ret = __opal_set_mbr_done(dev, &suspend->unlk.session.opal_key); 3288 if (ret) 3289 pr_debug("Failed to set MBR Done in S3 resume\n"); 3290 } 3291 } 3292 mutex_unlock(&dev->dev_lock); 3293 3294 return was_failure; 3295 } 3296 EXPORT_SYMBOL(opal_unlock_from_suspend); 3297 3298 static int opal_read_table(struct opal_dev *dev, 3299 struct opal_read_write_table *rw_tbl) 3300 { 3301 const struct opal_step read_table_steps[] = { 3302 { start_admin1LSP_opal_session, &rw_tbl->key }, 3303 { read_table_data, rw_tbl }, 3304 { end_opal_session, } 3305 }; 3306 3307 if (!rw_tbl->size) 3308 return 0; 3309 3310 return execute_steps(dev, read_table_steps, 3311 ARRAY_SIZE(read_table_steps)); 3312 } 3313 3314 static int opal_write_table(struct opal_dev *dev, 3315 struct opal_read_write_table *rw_tbl) 3316 { 3317 const struct opal_step write_table_steps[] = { 3318 { start_admin1LSP_opal_session, &rw_tbl->key }, 3319 { write_table_data, rw_tbl }, 3320 { end_opal_session, } 3321 }; 3322 3323 if (!rw_tbl->size) 3324 return 0; 3325 3326 return execute_steps(dev, write_table_steps, 3327 ARRAY_SIZE(write_table_steps)); 3328 } 3329 3330 static int opal_generic_read_write_table(struct opal_dev *dev, 3331 struct opal_read_write_table *rw_tbl) 3332 { 3333 int ret, bit_set; 3334 3335 ret = opal_get_key(dev, &rw_tbl->key); 3336 if (ret) 3337 return ret; 3338 mutex_lock(&dev->dev_lock); 3339 setup_opal_dev(dev); 3340 3341 bit_set = fls64(rw_tbl->flags) - 1; 3342 switch (bit_set) { 3343 case OPAL_READ_TABLE: 3344 ret = opal_read_table(dev, rw_tbl); 3345 break; 3346 case OPAL_WRITE_TABLE: 3347 ret = opal_write_table(dev, rw_tbl); 3348 break; 3349 default: 3350 pr_debug("Invalid bit set in the flag (%016llx).\n", 3351 rw_tbl->flags); 3352 ret = -EINVAL; 3353 break; 3354 } 3355 3356 mutex_unlock(&dev->dev_lock); 3357 3358 return ret; 3359 } 3360 3361 static int opal_get_status(struct opal_dev *dev, void __user *data) 3362 { 3363 struct opal_status sts = {0}; 3364 3365 /* 3366 * check_opal_support() error is not fatal, 3367 * !dev->supported is a valid condition 3368 */ 3369 if (!check_opal_support(dev)) 3370 sts.flags = dev->flags; 3371 if (copy_to_user(data, &sts, sizeof(sts))) { 3372 pr_debug("Error copying status to userspace\n"); 3373 return -EFAULT; 3374 } 3375 return 0; 3376 } 3377 3378 static int opal_get_geometry(struct opal_dev *dev, void __user *data) 3379 { 3380 struct opal_geometry geo = {0}; 3381 3382 if (check_opal_support(dev)) 3383 return -EINVAL; 3384 3385 geo.align = dev->align_required; 3386 geo.logical_block_size = dev->logical_block_size; 3387 geo.alignment_granularity = dev->align; 3388 geo.lowest_aligned_lba = dev->lowest_lba; 3389 3390 if (copy_to_user(data, &geo, sizeof(geo))) { 3391 pr_debug("Error copying geometry data to userspace\n"); 3392 return -EFAULT; 3393 } 3394 3395 return 0; 3396 } 3397 3398 static int get_sum_ranges(struct opal_dev *dev, void *data) 3399 { 3400 const char *lr_uid; 3401 size_t lr_uid_len; 3402 u64 val; 3403 const struct opal_resp_tok *tok; 3404 int err, tok_n = 2; 3405 struct opal_sum_ranges *sranges = data; 3406 const __u8 lr_all[OPAL_MAX_LRS] = { 0, 1, 2, 3, 4, 5, 6, 7, 8 }; 3407 3408 err = generic_get_columns(dev, opaluid[OPAL_LOCKING_INFO_TABLE], OPAL_SUM_SET_LIST, 3409 OPAL_SUM_RANGE_POLICY); 3410 if (err) { 3411 pr_debug("Couldn't get locking info table columns %d to %d.\n", 3412 OPAL_SUM_SET_LIST, OPAL_SUM_RANGE_POLICY); 3413 return err; 3414 } 3415 3416 tok = response_get_token(&dev->parsed, tok_n); 3417 if (IS_ERR(tok)) 3418 return PTR_ERR(tok); 3419 3420 if (!response_token_matches(tok, OPAL_STARTNAME)) { 3421 pr_debug("Unexpected response token type %d.\n", tok_n); 3422 return OPAL_INVAL_PARAM; 3423 } 3424 tok_n++; 3425 3426 if (response_get_u64(&dev->parsed, tok_n) != OPAL_SUM_SET_LIST) { 3427 pr_debug("Token %d does not match expected column %u.\n", 3428 tok_n, OPAL_SUM_SET_LIST); 3429 return OPAL_INVAL_PARAM; 3430 } 3431 tok_n++; 3432 3433 tok = response_get_token(&dev->parsed, tok_n); 3434 if (IS_ERR(tok)) 3435 return PTR_ERR(tok); 3436 3437 /* 3438 * The OPAL_SUM_SET_LIST response contains two distinct values: 3439 * 3440 * - the list of individual locking ranges (UIDs) put in SUM. The list 3441 * may also be empty signaling the SUM is disabled. 3442 * 3443 * - the Locking table UID if the entire Locking table is put in SUM. 3444 */ 3445 if (response_token_matches(tok, OPAL_STARTLIST)) { 3446 sranges->num_lrs = 0; 3447 3448 tok_n++; 3449 tok = response_get_token(&dev->parsed, tok_n); 3450 if (IS_ERR(tok)) 3451 return PTR_ERR(tok); 3452 3453 while (!response_token_matches(tok, OPAL_ENDLIST)) { 3454 lr_uid_len = response_get_string(&dev->parsed, tok_n, &lr_uid); 3455 if (lr_uid_len != OPAL_UID_LENGTH) { 3456 pr_debug("Unexpected response token type %d.\n", tok_n); 3457 return OPAL_INVAL_PARAM; 3458 } 3459 3460 if (memcmp(lr_uid, opaluid[OPAL_LOCKINGRANGE_GLOBAL], OPAL_UID_LENGTH)) { 3461 if (lr_uid[5] != LOCKING_RANGE_NON_GLOBAL) { 3462 pr_debug("Unexpected byte %d at LR UUID position 5.\n", 3463 lr_uid[5]); 3464 return OPAL_INVAL_PARAM; 3465 } 3466 sranges->lr[sranges->num_lrs++] = lr_uid[7]; 3467 } else 3468 sranges->lr[sranges->num_lrs++] = 0; 3469 3470 tok_n++; 3471 tok = response_get_token(&dev->parsed, tok_n); 3472 if (IS_ERR(tok)) 3473 return PTR_ERR(tok); 3474 } 3475 } else { 3476 /* Only OPAL_LOCKING_TABLE UID is an alternative to OPAL_STARTLIST here. */ 3477 lr_uid_len = response_get_string(&dev->parsed, tok_n, &lr_uid); 3478 if (lr_uid_len != OPAL_UID_LENGTH) { 3479 pr_debug("Unexpected response token type %d.\n", tok_n); 3480 return OPAL_INVAL_PARAM; 3481 } 3482 3483 if (memcmp(lr_uid, opaluid[OPAL_LOCKING_TABLE], OPAL_UID_LENGTH)) { 3484 pr_debug("Unexpected response UID.\n"); 3485 return OPAL_INVAL_PARAM; 3486 } 3487 3488 /* sed-opal kernel API already provides following limit in Activate command */ 3489 sranges->num_lrs = OPAL_MAX_LRS; 3490 memcpy(sranges->lr, lr_all, OPAL_MAX_LRS); 3491 } 3492 tok_n++; 3493 3494 tok = response_get_token(&dev->parsed, tok_n); 3495 if (IS_ERR(tok)) 3496 return PTR_ERR(tok); 3497 3498 if (!response_token_matches(tok, OPAL_ENDNAME)) { 3499 pr_debug("Unexpected response token type %d.\n", tok_n); 3500 return OPAL_INVAL_PARAM; 3501 } 3502 tok_n++; 3503 3504 err = response_get_column(&dev->parsed, &tok_n, OPAL_SUM_RANGE_POLICY, &val); 3505 if (err) 3506 return err; 3507 3508 sranges->range_policy = val ? 1 : 0; 3509 3510 return 0; 3511 } 3512 3513 static int opal_get_sum_ranges(struct opal_dev *dev, struct opal_sum_ranges *opal_sum_rngs, 3514 void __user *data) 3515 { 3516 const struct opal_step admin_steps[] = { 3517 { start_admin1LSP_opal_session, &opal_sum_rngs->key }, 3518 { get_sum_ranges, opal_sum_rngs }, 3519 { end_opal_session, } 3520 }, anybody_steps[] = { 3521 { start_anybodyLSP_opal_session, NULL }, 3522 { get_sum_ranges, opal_sum_rngs }, 3523 { end_opal_session, } 3524 }; 3525 int ret; 3526 3527 mutex_lock(&dev->dev_lock); 3528 setup_opal_dev(dev); 3529 if (opal_sum_rngs->key.key_len) 3530 /* Use Admin1 session (authenticated by PIN) to retrieve LockingInfo columns */ 3531 ret = execute_steps(dev, admin_steps, ARRAY_SIZE(admin_steps)); 3532 else 3533 /* Use Anybody session (no key) to retrieve LockingInfo columns */ 3534 ret = execute_steps(dev, anybody_steps, ARRAY_SIZE(anybody_steps)); 3535 mutex_unlock(&dev->dev_lock); 3536 3537 /* skip session info when copying back to uspace */ 3538 if (!ret && copy_to_user(data + offsetof(struct opal_sum_ranges, num_lrs), 3539 (void *)opal_sum_rngs + offsetof(struct opal_sum_ranges, num_lrs), 3540 sizeof(*opal_sum_rngs) - offsetof(struct opal_sum_ranges, num_lrs))) { 3541 pr_debug("Error copying SUM ranges info to userspace\n"); 3542 return -EFAULT; 3543 } 3544 3545 return ret; 3546 } 3547 3548 static int opal_stack_reset(struct opal_dev *dev) 3549 { 3550 struct opal_stack_reset *req; 3551 struct opal_stack_reset_response *resp; 3552 int ret; 3553 3554 mutex_lock(&dev->dev_lock); 3555 3556 memset(dev->cmd, 0, IO_BUFFER_LENGTH); 3557 req = (struct opal_stack_reset *)dev->cmd; 3558 req->extendedComID[0] = dev->comid >> 8; 3559 req->extendedComID[1] = dev->comid & 0xFF; 3560 req->request_code = cpu_to_be32(OPAL_STACK_RESET); 3561 3562 ret = dev->send_recv(dev->data, dev->comid, TCG_SECP_02, 3563 dev->cmd, IO_BUFFER_LENGTH, true); 3564 if (ret) { 3565 pr_debug("Error sending stack reset: %d\n", ret); 3566 goto out; 3567 } 3568 3569 memset(dev->resp, 0, IO_BUFFER_LENGTH); 3570 ret = dev->send_recv(dev->data, dev->comid, TCG_SECP_02, 3571 dev->resp, IO_BUFFER_LENGTH, false); 3572 if (ret) { 3573 pr_debug("Error receiving stack reset response: %d\n", ret); 3574 goto out; 3575 } 3576 3577 resp = (struct opal_stack_reset_response *)dev->resp; 3578 if (be16_to_cpu(resp->data_length) != 4) { 3579 pr_debug("Stack reset pending\n"); 3580 ret = -EBUSY; 3581 goto out; 3582 } 3583 if (be32_to_cpu(resp->response) != 0) { 3584 pr_debug("Stack reset failed: %u\n", be32_to_cpu(resp->response)); 3585 ret = -EIO; 3586 } 3587 out: 3588 mutex_unlock(&dev->dev_lock); 3589 return ret; 3590 } 3591 3592 int sed_ioctl(struct opal_dev *dev, unsigned int cmd, void __user *arg) 3593 { 3594 void *p; 3595 int ret = -ENOTTY; 3596 3597 if (!capable(CAP_SYS_ADMIN)) 3598 return -EACCES; 3599 if (!dev) 3600 return -EOPNOTSUPP; 3601 if (!(dev->flags & OPAL_FL_SUPPORTED)) 3602 return -EOPNOTSUPP; 3603 3604 if (cmd & IOC_IN) { 3605 p = memdup_user(arg, _IOC_SIZE(cmd)); 3606 if (IS_ERR(p)) 3607 return PTR_ERR(p); 3608 } 3609 3610 switch (cmd) { 3611 case IOC_OPAL_SAVE: 3612 ret = opal_save(dev, p); 3613 break; 3614 case IOC_OPAL_LOCK_UNLOCK: 3615 ret = opal_lock_unlock(dev, p); 3616 break; 3617 case IOC_OPAL_TAKE_OWNERSHIP: 3618 ret = opal_take_ownership(dev, p); 3619 break; 3620 case IOC_OPAL_ACTIVATE_LSP: 3621 ret = opal_activate_lsp(dev, p); 3622 break; 3623 case IOC_OPAL_SET_PW: 3624 ret = opal_set_new_pw(dev, p); 3625 break; 3626 case IOC_OPAL_ACTIVATE_USR: 3627 ret = opal_activate_user(dev, p); 3628 break; 3629 case IOC_OPAL_REVERT_TPR: 3630 ret = opal_reverttper(dev, p, false); 3631 break; 3632 case IOC_OPAL_LR_SETUP: 3633 ret = opal_setup_locking_range(dev, p); 3634 break; 3635 case IOC_OPAL_ADD_USR_TO_LR: 3636 ret = opal_add_user_to_lr(dev, p); 3637 break; 3638 case IOC_OPAL_ENABLE_DISABLE_MBR: 3639 ret = opal_enable_disable_shadow_mbr(dev, p); 3640 break; 3641 case IOC_OPAL_MBR_DONE: 3642 ret = opal_set_mbr_done(dev, p); 3643 break; 3644 case IOC_OPAL_WRITE_SHADOW_MBR: 3645 ret = opal_write_shadow_mbr(dev, p); 3646 break; 3647 case IOC_OPAL_ERASE_LR: 3648 ret = opal_erase_locking_range(dev, p); 3649 break; 3650 case IOC_OPAL_SECURE_ERASE_LR: 3651 ret = opal_secure_erase_locking_range(dev, p); 3652 break; 3653 case IOC_OPAL_PSID_REVERT_TPR: 3654 ret = opal_reverttper(dev, p, true); 3655 break; 3656 case IOC_OPAL_GENERIC_TABLE_RW: 3657 ret = opal_generic_read_write_table(dev, p); 3658 break; 3659 case IOC_OPAL_GET_STATUS: 3660 ret = opal_get_status(dev, arg); 3661 break; 3662 case IOC_OPAL_GET_LR_STATUS: 3663 ret = opal_locking_range_status(dev, p, arg); 3664 break; 3665 case IOC_OPAL_GET_GEOMETRY: 3666 ret = opal_get_geometry(dev, arg); 3667 break; 3668 case IOC_OPAL_REVERT_LSP: 3669 ret = opal_revertlsp(dev, p); 3670 break; 3671 case IOC_OPAL_DISCOVERY: 3672 ret = opal_get_discv(dev, p); 3673 break; 3674 case IOC_OPAL_SET_SID_PW: 3675 ret = opal_set_new_sid_pw(dev, p); 3676 break; 3677 case IOC_OPAL_REACTIVATE_LSP: 3678 ret = opal_reactivate_lsp(dev, p); 3679 break; 3680 case IOC_OPAL_LR_SET_START_LEN: 3681 ret = opal_setup_locking_range_start_length(dev, p); 3682 break; 3683 case IOC_OPAL_ENABLE_DISABLE_LR: 3684 ret = opal_enable_disable_range(dev, p); 3685 break; 3686 case IOC_OPAL_GET_SUM_STATUS: 3687 ret = opal_get_sum_ranges(dev, p, arg); 3688 break; 3689 case IOC_OPAL_STACK_RESET: 3690 ret = opal_stack_reset(dev); 3691 break; 3692 3693 default: 3694 break; 3695 } 3696 3697 if (cmd & IOC_IN) 3698 kfree(p); 3699 return ret; 3700 } 3701 EXPORT_SYMBOL_GPL(sed_ioctl); 3702 3703 static int __init sed_opal_init(void) 3704 { 3705 struct key *kr; 3706 char init_sed_key[OPAL_KEY_MAX]; 3707 int keylen = OPAL_KEY_MAX - 1; 3708 3709 kr = keyring_alloc(".sed_opal", 3710 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(), 3711 (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | 3712 KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE, 3713 KEY_ALLOC_NOT_IN_QUOTA, 3714 NULL, NULL); 3715 if (IS_ERR(kr)) 3716 return PTR_ERR(kr); 3717 3718 sed_opal_keyring = kr; 3719 3720 if (sed_read_key(OPAL_AUTH_KEY, init_sed_key, &keylen) < 0) { 3721 memset(init_sed_key, '\0', sizeof(init_sed_key)); 3722 keylen = OPAL_KEY_MAX - 1; 3723 } 3724 3725 return update_sed_opal_key(OPAL_AUTH_KEY, init_sed_key, keylen); 3726 } 3727 late_initcall(sed_opal_init); 3728