@@ -18,6 +18,57 @@
#include "intel.h"
#include "nfit.h"
+static int intel_dimm_security_disable(struct nvdimm_bus *nvdimm_bus,
+ struct nvdimm *nvdimm, struct nvdimm_key_data *nkey)
+{
+ struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus);
+ int cmd_rc, rc = 0;
+ struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
+ struct {
+ struct nd_cmd_pkg pkg;
+ struct nd_intel_disable_passphrase cmd;
+ } nd_cmd = {
+ .pkg = {
+ .nd_command = NVDIMM_INTEL_DISABLE_PASSPHRASE,
+ .nd_family = NVDIMM_FAMILY_INTEL,
+ .nd_size_in = ND_INTEL_PASSPHRASE_SIZE,
+ .nd_size_out = ND_INTEL_STATUS_SIZE,
+ .nd_fw_size = ND_INTEL_STATUS_SIZE,
+ },
+ .cmd = {
+ .status = 0,
+ },
+ };
+
+ if (!test_bit(NVDIMM_INTEL_DISABLE_PASSPHRASE, &nfit_mem->dsm_mask))
+ return -ENOTTY;
+
+ memcpy(nd_cmd.cmd.passphrase, nkey->data, ND_INTEL_PASSPHRASE_SIZE);
+ rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_CALL, &nd_cmd,
+ sizeof(nd_cmd), &cmd_rc);
+ if (rc < 0)
+ goto out;
+ if (cmd_rc < 0) {
+ rc = cmd_rc;
+ goto out;
+ }
+
+ switch (nd_cmd.cmd.status) {
+ case 0:
+ break;
+ case ND_INTEL_STATUS_INVALID_PASS:
+ rc = -EINVAL;
+ goto out;
+ case ND_INTEL_STATUS_INVALID_STATE:
+ default:
+ rc = -ENXIO;
+ goto out;
+ }
+
+ out:
+ return rc;
+}
+
static int intel_dimm_security_update_passphrase(
struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
struct nvdimm_key_data *old_data,
@@ -205,4 +256,5 @@ struct nvdimm_security_ops intel_security_ops = {
.state = intel_dimm_security_state,
.unlock = intel_dimm_security_unlock,
.change_key = intel_dimm_security_update_passphrase,
+ .disable = intel_dimm_security_disable,
};
@@ -125,6 +125,45 @@ int nvdimm_security_get_state(struct device *dev)
&nvdimm->state);
}
+static int nvdimm_security_disable(struct device *dev)
+{
+ struct nvdimm *nvdimm = to_nvdimm(dev);
+ struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
+ struct key *key;
+ int rc;
+ void *payload;
+ bool cached_key = false;
+
+ if (!nvdimm->security_ops)
+ return 0;
+
+ if (nvdimm->state == NVDIMM_SECURITY_UNSUPPORTED)
+ return 0;
+
+ key = nvdimm_search_key(dev);
+ if (!key)
+ key = nvdimm_request_key(dev);
+ else
+ cached_key = true;
+ if (!key)
+ return -ENXIO;
+
+ down_read(&key->sem);
+ payload = key->payload.data[0];
+ rc = nvdimm->security_ops->disable(nvdimm_bus, nvdimm, payload);
+ up_read(&key->sem);
+ if (rc < 0)
+ goto out;
+
+ /* If we succeed then remove the key */
+ key_invalidate(key);
+
+ out:
+ key_put(key);
+ nvdimm_security_get_state(dev);
+ return rc;
+}
+
int nvdimm_security_unlock_dimm(struct device *dev)
{
struct nvdimm *nvdimm = to_nvdimm(dev);
@@ -631,6 +670,8 @@ static ssize_t security_store(struct device *dev,
if (sysfs_streq(buf, "update"))
rc = nvdimm_security_change_key(dev);
+ else if (sysfs_streq(buf, "disable"))
+ rc = nvdimm_security_disable(dev);
else
return -EINVAL;
@@ -183,6 +183,8 @@ struct nvdimm_security_ops {
struct nvdimm *nvdimm,
struct nvdimm_key_data *old_data,
struct nvdimm_key_data *new_data);
+ int (*disable)(struct nvdimm_bus *nvdimm_bus,
+ struct nvdimm *nvdimm, struct nvdimm_key_data *nkey);
};
void badrange_init(struct badrange *badrange);