projects/linux·blob master · refs

3727 lines · 88.6 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright © 2016 Intel Corporation
4 *
5 * Authors:
6 * Scott Bauer <[email protected]>
7 * Rafael Antognolli <[email protected]>
8 */
9
10#define pr_fmt(fmt) KBUILD_MODNAME ":OPAL: " fmt
11
12#include <linux/delay.h>
13#include <linux/device.h>
14#include <linux/kernel.h>
15#include <linux/list.h>
16#include <linux/blkdev.h>
17#include <linux/slab.h>
18#include <linux/uaccess.h>
19#include <uapi/linux/sed-opal.h>
20#include <linux/sed-opal.h>
21#include <linux/sed-opal-key.h>
22#include <linux/string.h>
23#include <linux/kdev_t.h>
24#include <linux/key.h>
25#include <linux/key-type.h>
26#include <keys/user-type.h>
27
28#include "opal_proto.h"
29
30#define IO_BUFFER_LENGTH 2048
31#define MAX_TOKS 64
32
33/* Number of bytes needed by cmd_finalize. */
34#define CMD_FINALIZE_BYTES_NEEDED 7
35
36static struct key *sed_opal_keyring;
37
38struct opal_step {
39 int (*fn)(struct opal_dev *dev, void *data);
40 void *data;
41};
42typedef int (cont_fn)(struct opal_dev *dev);
43
44enum opal_atom_width {
45 OPAL_WIDTH_TINY,
46 OPAL_WIDTH_SHORT,
47 OPAL_WIDTH_MEDIUM,
48 OPAL_WIDTH_LONG,
49 OPAL_WIDTH_TOKEN
50};
51
52/*
53 * On the parsed response, we don't store again the toks that are already
54 * stored in the response buffer. Instead, for each token, we just store a
55 * pointer to the position in the buffer where the token starts, and the size
56 * of the token in bytes.
57 */
58struct opal_resp_tok {
59 const u8 *pos;
60 size_t len;
61 enum opal_response_token type;
62 enum opal_atom_width width;
63 union {
64 u64 u;
65 s64 s;
66 } stored;
67};
68
69/*
70 * From the response header it's not possible to know how many tokens there are
71 * on the payload. So we hardcode that the maximum will be MAX_TOKS, and later
72 * if we start dealing with messages that have more than that, we can increase
73 * this number. This is done to avoid having to make two passes through the
74 * response, the first one counting how many tokens we have and the second one
75 * actually storing the positions.
76 */
77struct parsed_resp {
78 int num;
79 struct opal_resp_tok toks[MAX_TOKS];
80};
81
82struct opal_dev {
83 u32 flags;
84
85 void *data;
86 sec_send_recv *send_recv;
87
88 struct mutex dev_lock;
89 u16 comid;
90 u32 hsn;
91 u32 tsn;
92 u64 align; /* alignment granularity */
93 u64 lowest_lba;
94 u32 logical_block_size;
95 u8 align_required; /* ALIGN: 0 or 1 */
96
97 size_t pos;
98 u8 *cmd;
99 u8 *resp;
100
101 struct parsed_resp parsed;
102 size_t prev_d_len;
103 void *prev_data;
104
105 struct list_head unlk_lst;
106};
107
108
109static const u8 opaluid[][OPAL_UID_LENGTH] = {
110 /* users */
111 [OPAL_SMUID_UID] =
112 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff },
113 [OPAL_THISSP_UID] =
114 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
115 [OPAL_ADMINSP_UID] =
116 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x01 },
117 [OPAL_LOCKINGSP_UID] =
118 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x00, 0x00, 0x02 },
119 [OPAL_ENTERPRISE_LOCKINGSP_UID] =
120 { 0x00, 0x00, 0x02, 0x05, 0x00, 0x01, 0x00, 0x01 },
121 [OPAL_ANYBODY_UID] =
122 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x01 },
123 [OPAL_SID_UID] =
124 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x06 },
125 [OPAL_ADMIN1_UID] =
126 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0x01 },
127 [OPAL_USER1_UID] =
128 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x03, 0x00, 0x01 },
129 [OPAL_USER2_UID] =
130 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x03, 0x00, 0x02 },
131 [OPAL_PSID_UID] =
132 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x01, 0xff, 0x01 },
133 [OPAL_ENTERPRISE_BANDMASTER0_UID] =
134 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x80, 0x01 },
135 [OPAL_ENTERPRISE_ERASEMASTER_UID] =
136 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x84, 0x01 },
137
138 /* tables */
139 [OPAL_TABLE_TABLE] =
140 { 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01 },
141 [OPAL_LOCKINGRANGE_GLOBAL] =
142 { 0x00, 0x00, 0x08, 0x02, 0x00, 0x00, 0x00, 0x01 },
143 [OPAL_LOCKINGRANGE_ACE_START_TO_KEY] =
144 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xD0, 0x01 },
145 [OPAL_LOCKINGRANGE_ACE_RDLOCKED] =
146 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xE0, 0x01 },
147 [OPAL_LOCKINGRANGE_ACE_WRLOCKED] =
148 { 0x00, 0x00, 0x00, 0x08, 0x00, 0x03, 0xE8, 0x01 },
149 [OPAL_MBRCONTROL] =
150 { 0x00, 0x00, 0x08, 0x03, 0x00, 0x00, 0x00, 0x01 },
151 [OPAL_MBR] =
152 { 0x00, 0x00, 0x08, 0x04, 0x00, 0x00, 0x00, 0x00 },
153 [OPAL_AUTHORITY_TABLE] =
154 { 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00},
155 [OPAL_C_PIN_TABLE] =
156 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00},
157 [OPAL_LOCKING_INFO_TABLE] =
158 { 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x01 },
159 [OPAL_ENTERPRISE_LOCKING_INFO_TABLE] =
160 { 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00 },
161 [OPAL_DATASTORE] =
162 { 0x00, 0x00, 0x10, 0x01, 0x00, 0x00, 0x00, 0x00 },
163 [OPAL_LOCKING_TABLE] =
164 { 0x00, 0x00, 0x08, 0x02, 0x00, 0x00, 0x00, 0x00 },
165
166 /* C_PIN_TABLE object ID's */
167 [OPAL_C_PIN_MSID] =
168 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x84, 0x02},
169 [OPAL_C_PIN_SID] =
170 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x01},
171 [OPAL_C_PIN_ADMIN1] =
172 { 0x00, 0x00, 0x00, 0x0B, 0x00, 0x01, 0x00, 0x01},
173
174 /* half UID's (only first 4 bytes used) */
175 [OPAL_HALF_UID_AUTHORITY_OBJ_REF] =
176 { 0x00, 0x00, 0x0C, 0x05, 0xff, 0xff, 0xff, 0xff },
177 [OPAL_HALF_UID_BOOLEAN_ACE] =
178 { 0x00, 0x00, 0x04, 0x0E, 0xff, 0xff, 0xff, 0xff },
179
180 /* special value for omitted optional parameter */
181 [OPAL_UID_HEXFF] =
182 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
183};
184
185/*
186 * TCG Storage SSC Methods.
187 * Derived from: TCG_Storage_Architecture_Core_Spec_v2.01_r1.00
188 * Section: 6.3 Assigned UIDs
189 */
190static const u8 opalmethod[][OPAL_METHOD_LENGTH] = {
191 [OPAL_PROPERTIES] =
192 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x01 },
193 [OPAL_STARTSESSION] =
194 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x02 },
195 [OPAL_REVERT] =
196 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x02, 0x02 },
197 [OPAL_ACTIVATE] =
198 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x02, 0x03 },
199 [OPAL_EGET] =
200 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06 },
201 [OPAL_ESET] =
202 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x07 },
203 [OPAL_NEXT] =
204 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x08 },
205 [OPAL_EAUTHENTICATE] =
206 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0c },
207 [OPAL_GETACL] =
208 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x0d },
209 [OPAL_GENKEY] =
210 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x10 },
211 [OPAL_REVERTSP] =
212 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x11 },
213 [OPAL_GET] =
214 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x16 },
215 [OPAL_SET] =
216 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x17 },
217 [OPAL_AUTHENTICATE] =
218 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x1c },
219 [OPAL_RANDOM] =
220 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x06, 0x01 },
221 [OPAL_ERASE] =
222 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x08, 0x03 },
223 [OPAL_REACTIVATE] =
224 { 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x08, 0x01 },
225};
226
227static int end_opal_session_error(struct opal_dev *dev);
228static int opal_discovery0_step(struct opal_dev *dev);
229
230struct opal_suspend_data {
231 struct opal_lock_unlock unlk;
232 u8 lr;
233 struct list_head node;
234};
235
236/*
237 * Derived from:
238 * TCG_Storage_Architecture_Core_Spec_v2.01_r1.00
239 * Section: 5.1.5 Method Status Codes
240 */
241static const char * const opal_errors[] = {
242 "Success",
243 "Not Authorized",
244 "Unknown Error",
245 "SP Busy",
246 "SP Failed",
247 "SP Disabled",
248 "SP Frozen",
249 "No Sessions Available",
250 "Uniqueness Conflict",
251 "Insufficient Space",
252 "Insufficient Rows",
253 "Invalid Function",
254 "Invalid Parameter",
255 "Invalid Reference",
256 "Unknown Error",
257 "TPER Malfunction",
258 "Transaction Failure",
259 "Response Overflow",
260 "Authority Locked Out",
261};
262
263static const char *opal_error_to_human(int error)
264{
265 if (error == 0x3f)
266 return "Failed";
267
268 if (error >= ARRAY_SIZE(opal_errors) || error < 0)
269 return "Unknown Error";
270
271 return opal_errors[error];
272}
273
274static void print_buffer(const u8 *ptr, u32 length)
275{
276#ifdef DEBUG
277 print_hex_dump_bytes("OPAL: ", DUMP_PREFIX_OFFSET, ptr, length);
278 pr_debug("\n");
279#endif
280}
281
282/*
283 * Allocate/update a SED Opal key and add it to the SED Opal keyring.
284 */
285static int update_sed_opal_key(const char *desc, u_char *key_data, int keylen)
286{
287 key_ref_t kr;
288
289 if (!sed_opal_keyring)
290 return -ENOKEY;
291
292 kr = key_create_or_update(make_key_ref(sed_opal_keyring, true), "user",
293 desc, (const void *)key_data, keylen,
294 KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_WRITE,
295 KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_BUILT_IN |
296 KEY_ALLOC_BYPASS_RESTRICTION);
297 if (IS_ERR(kr)) {
298 pr_err("Error adding SED key (%ld)\n", PTR_ERR(kr));
299 return PTR_ERR(kr);
300 }
301
302 return 0;
303}
304
305/*
306 * Read a SED Opal key from the SED Opal keyring.
307 */
308static int read_sed_opal_key(const char *key_name, u_char *buffer, int buflen)
309{
310 int ret;
311 key_ref_t kref;
312 struct key *key;
313
314 if (!sed_opal_keyring)
315 return -ENOKEY;
316
317 kref = keyring_search(make_key_ref(sed_opal_keyring, true),
318 &key_type_user, key_name, true);
319
320 if (IS_ERR(kref))
321 return PTR_ERR(kref);
322
323 key = key_ref_to_ptr(kref);
324 down_read(&key->sem);
325 ret = key_validate(key);
326 if (ret == 0) {
327 if (buflen > key->datalen)
328 buflen = key->datalen;
329
330 ret = key->type->read(key, (char *)buffer, buflen);
331 }
332 up_read(&key->sem);
333
334 key_ref_put(kref);
335
336 return ret;
337}
338
339static int opal_get_key(struct opal_dev *dev, struct opal_key *key)
340{
341 int ret = 0;
342
343 switch (key->key_type) {
344 case OPAL_INCLUDED:
345 /* the key is ready to use */
346 break;
347 case OPAL_KEYRING:
348 /* the key is in the keyring */
349 ret = read_sed_opal_key(OPAL_AUTH_KEY, key->key, OPAL_KEY_MAX);
350 if (ret > 0) {
351 if (ret > U8_MAX) {
352 ret = -ENOSPC;
353 goto error;
354 }
355 key->key_len = ret;
356 key->key_type = OPAL_INCLUDED;
357 }
358 break;
359 default:
360 ret = -EINVAL;
361 break;
362 }
363 if (ret < 0)
364 goto error;
365
366 /* must have a PEK by now or it's an error */
367 if (key->key_type != OPAL_INCLUDED || key->key_len == 0) {
368 ret = -EINVAL;
369 goto error;
370 }
371 return 0;
372error:
373 pr_debug("Error getting password: %d\n", ret);
374 return ret;
375}
376
377static bool check_tper(const void *data)
378{
379 const struct d0_tper_features *tper = data;
380 u8 flags = tper->supported_features;
381
382 if (!(flags & TPER_SYNC_SUPPORTED)) {
383 pr_debug("TPer sync not supported. flags = %d\n",
384 tper->supported_features);
385 return false;
386 }
387
388 return true;
389}
390
391static bool check_lcksuppt(const void *data)
392{
393 const struct d0_locking_features *lfeat = data;
394 u8 sup_feat = lfeat->supported_features;
395
396 return !!(sup_feat & LOCKING_SUPPORTED_MASK);
397}
398
399static bool check_lckenabled(const void *data)
400{
401 const struct d0_locking_features *lfeat = data;
402 u8 sup_feat = lfeat->supported_features;
403
404 return !!(sup_feat & LOCKING_ENABLED_MASK);
405}
406
407static bool check_locked(const void *data)
408{
409 const struct d0_locking_features *lfeat = data;
410 u8 sup_feat = lfeat->supported_features;
411
412 return !!(sup_feat & LOCKED_MASK);
413}
414
415static bool check_mbrenabled(const void *data)
416{
417 const struct d0_locking_features *lfeat = data;
418 u8 sup_feat = lfeat->supported_features;
419
420 return !!(sup_feat & MBR_ENABLED_MASK);
421}
422
423static bool check_mbrdone(const void *data)
424{
425 const struct d0_locking_features *lfeat = data;
426 u8 sup_feat = lfeat->supported_features;
427
428 return !!(sup_feat & MBR_DONE_MASK);
429}
430
431static bool check_sum(const void *data)
432{
433 const struct d0_single_user_mode *sum = data;
434 u32 nlo = be32_to_cpu(sum->num_locking_objects);
435
436 if (nlo == 0) {
437 pr_debug("Need at least one locking object.\n");
438 return false;
439 }
440
441 pr_debug("Number of locking objects: %d\n", nlo);
442
443 return true;
444}
445
446static u16 get_comid_v100(const void *data)
447{
448 const struct d0_opal_v100 *v100 = data;
449
450 return be16_to_cpu(v100->baseComID);
451}
452
453static u16 get_comid_v200(const void *data)
454{
455 const struct d0_opal_v200 *v200 = data;
456
457 return be16_to_cpu(v200->baseComID);
458}
459
460static int opal_send_cmd(struct opal_dev *dev)
461{
462 return dev->send_recv(dev->data, dev->comid, TCG_SECP_01,
463 dev->cmd, IO_BUFFER_LENGTH,
464 true);
465}
466
467static int opal_recv_cmd(struct opal_dev *dev)
468{
469 return dev->send_recv(dev->data, dev->comid, TCG_SECP_01,
470 dev->resp, IO_BUFFER_LENGTH,
471 false);
472}
473
474static int opal_recv_check(struct opal_dev *dev)
475{
476 size_t buflen = IO_BUFFER_LENGTH;
477 void *buffer = dev->resp;
478 struct opal_header *hdr = buffer;
479 int ret;
480
481 do {
482 pr_debug("Sent OPAL command: outstanding=%d, minTransfer=%d\n",
483 hdr->cp.outstandingData,
484 hdr->cp.minTransfer);
485
486 if (hdr->cp.outstandingData == 0 ||
487 hdr->cp.minTransfer != 0)
488 return 0;
489
490 memset(buffer, 0, buflen);
491 ret = opal_recv_cmd(dev);
492 } while (!ret);
493
494 return ret;
495}
496
497static int opal_send_recv(struct opal_dev *dev, cont_fn *cont)
498{
499 int ret;
500
501 ret = opal_send_cmd(dev);
502 if (ret)
503 return ret;
504 ret = opal_recv_cmd(dev);
505 if (ret)
506 return ret;
507 ret = opal_recv_check(dev);
508 if (ret)
509 return ret;
510 return cont(dev);
511}
512
513static void check_geometry(struct opal_dev *dev, const void *data)
514{
515 const struct d0_geometry_features *geo = data;
516
517 dev->align = be64_to_cpu(geo->alignment_granularity);
518 dev->lowest_lba = be64_to_cpu(geo->lowest_aligned_lba);
519 dev->logical_block_size = be32_to_cpu(geo->logical_block_size);
520 dev->align_required = geo->reserved01 & 1;
521}
522
523static int execute_step(struct opal_dev *dev,
524 const struct opal_step *step, size_t stepIndex)
525{
526 int error = step->fn(dev, step->data);
527
528 if (error) {
529 pr_debug("Step %zu (%pS) failed with error %d: %s\n",
530 stepIndex, step->fn, error,
531 opal_error_to_human(error));
532 }
533
534 return error;
535}
536
537static int execute_steps(struct opal_dev *dev,
538 const struct opal_step *steps, size_t n_steps)
539{
540 size_t state = 0;
541 int error;
542
543 /* first do a discovery0 */
544 error = opal_discovery0_step(dev);
545 if (error)
546 return error;
547
548 for (state = 0; state < n_steps; state++) {
549 error = execute_step(dev, &steps[state], state);
550 if (error)
551 goto out_error;
552 }
553
554 return 0;
555
556out_error:
557 /*
558 * For each OPAL command the first step in steps starts some sort of
559 * session. If an error occurred in the initial discovery0 or if an
560 * error occurred in the first step (and thus stopping the loop with
561 * state == 0) then there was an error before or during the attempt to
562 * start a session. Therefore we shouldn't attempt to terminate a
563 * session, as one has not yet been created.
564 */
565 if (state > 0)
566 end_opal_session_error(dev);
567
568 return error;
569}
570
571static int opal_discovery0_end(struct opal_dev *dev, void *data)
572{
573 struct opal_discovery *discv_out = data; /* may be NULL */
574 u8 __user *buf_out;
575 u64 len_out;
576 bool found_com_id = false, supported = true, single_user = false;
577 const struct d0_header *hdr = (struct d0_header *)dev->resp;
578 const u8 *epos = dev->resp, *cpos = dev->resp;
579 u16 comid = 0;
580 u32 hlen = be32_to_cpu(hdr->length);
581
582 print_buffer(dev->resp, hlen);
583 dev->flags &= OPAL_FL_SUPPORTED;
584
585 if (hlen > IO_BUFFER_LENGTH - sizeof(*hdr)) {
586 pr_debug("Discovery length overflows buffer (%zu+%u)/%u\n",
587 sizeof(*hdr), hlen, IO_BUFFER_LENGTH);
588 return -EFAULT;
589 }
590
591 if (discv_out) {
592 buf_out = (u8 __user *)(uintptr_t)discv_out->data;
593 len_out = min_t(u64, discv_out->size, hlen);
594 if (buf_out && copy_to_user(buf_out, dev->resp, len_out))
595 return -EFAULT;
596
597 discv_out->size = hlen; /* actual size of data */
598 }
599
600 epos += hlen; /* end of buffer */
601 cpos += sizeof(*hdr); /* current position on buffer */
602
603 while (cpos < epos && supported) {
604 const struct d0_features *body =
605 (const struct d0_features *)cpos;
606
607 switch (be16_to_cpu(body->code)) {
608 case FC_TPER:
609 supported = check_tper(body->features);
610 break;
611 case FC_SINGLEUSER:
612 single_user = check_sum(body->features);
613 if (single_user)
614 dev->flags |= OPAL_FL_SUM_SUPPORTED;
615 break;
616 case FC_GEOMETRY:
617 check_geometry(dev, body);
618 break;
619 case FC_LOCKING:
620 if (check_lcksuppt(body->features))
621 dev->flags |= OPAL_FL_LOCKING_SUPPORTED;
622 if (check_lckenabled(body->features))
623 dev->flags |= OPAL_FL_LOCKING_ENABLED;
624 if (check_locked(body->features))
625 dev->flags |= OPAL_FL_LOCKED;
626 if (check_mbrenabled(body->features))
627 dev->flags |= OPAL_FL_MBR_ENABLED;
628 if (check_mbrdone(body->features))
629 dev->flags |= OPAL_FL_MBR_DONE;
630 break;
631 case FC_ENTERPRISE:
632 case FC_DATASTORE:
633 /* some ignored properties */
634 pr_debug("Found OPAL feature description: %d\n",
635 be16_to_cpu(body->code));
636 break;
637 case FC_OPALV100:
638 comid = get_comid_v100(body->features);
639 found_com_id = true;
640 break;
641 case FC_OPALV200:
642 comid = get_comid_v200(body->features);
643 found_com_id = true;
644 break;
645 case 0xbfff ... 0xffff:
646 /* vendor specific, just ignore */
647 break;
648 default:
649 pr_debug("OPAL Unknown feature: %d\n",
650 be16_to_cpu(body->code));
651
652 }
653 cpos += body->length + 4;
654 }
655
656 if (!supported) {
657 pr_debug("This device is not Opal enabled. Not Supported!\n");
658 return -EOPNOTSUPP;
659 }
660
661 if (!single_user)
662 pr_debug("Device doesn't support single user mode\n");
663
664
665 if (!found_com_id) {
666 pr_debug("Could not find OPAL comid for device. Returning early\n");
667 return -EOPNOTSUPP;
668 }
669
670 dev->comid = comid;
671
672 return 0;
673}
674
675static int opal_discovery0(struct opal_dev *dev, void *data)
676{
677 int ret;
678
679 memset(dev->resp, 0, IO_BUFFER_LENGTH);
680 dev->comid = OPAL_DISCOVERY_COMID;
681 ret = opal_recv_cmd(dev);
682 if (ret)
683 return ret;
684
685 return opal_discovery0_end(dev, data);
686}
687
688static int opal_discovery0_step(struct opal_dev *dev)
689{
690 const struct opal_step discovery0_step = {
691 opal_discovery0, NULL
692 };
693
694 return execute_step(dev, &discovery0_step, 0);
695}
696
697static size_t remaining_size(struct opal_dev *cmd)
698{
699 return IO_BUFFER_LENGTH - cmd->pos;
700}
701
702static bool can_add(int *err, struct opal_dev *cmd, size_t len)
703{
704 if (*err)
705 return false;
706
707 if (remaining_size(cmd) < len) {
708 pr_debug("Error adding %zu bytes: end of buffer.\n", len);
709 *err = -ERANGE;
710 return false;
711 }
712
713 return true;
714}
715
716static void add_token_u8(int *err, struct opal_dev *cmd, u8 tok)
717{
718 if (!can_add(err, cmd, 1))
719 return;
720
721 cmd->cmd[cmd->pos++] = tok;
722}
723
724static void add_short_atom_header(struct opal_dev *cmd, bool bytestring,
725 bool has_sign, int len)
726{
727 u8 atom;
728 int err = 0;
729
730 atom = SHORT_ATOM_ID;
731 atom |= bytestring ? SHORT_ATOM_BYTESTRING : 0;
732 atom |= has_sign ? SHORT_ATOM_SIGNED : 0;
733 atom |= len & SHORT_ATOM_LEN_MASK;
734
735 add_token_u8(&err, cmd, atom);
736}
737
738static void add_medium_atom_header(struct opal_dev *cmd, bool bytestring,
739 bool has_sign, int len)
740{
741 u8 header0;
742
743 header0 = MEDIUM_ATOM_ID;
744 header0 |= bytestring ? MEDIUM_ATOM_BYTESTRING : 0;
745 header0 |= has_sign ? MEDIUM_ATOM_SIGNED : 0;
746 header0 |= (len >> 8) & MEDIUM_ATOM_LEN_MASK;
747
748 cmd->cmd[cmd->pos++] = header0;
749 cmd->cmd[cmd->pos++] = len;
750}
751
752static void add_token_u64(int *err, struct opal_dev *cmd, u64 number)
753{
754 size_t len;
755 int msb;
756
757 if (!(number & ~TINY_ATOM_DATA_MASK)) {
758 add_token_u8(err, cmd, number);
759 return;
760 }
761
762 msb = fls64(number);
763 len = DIV_ROUND_UP(msb, 8);
764
765 if (!can_add(err, cmd, len + 1)) {
766 pr_debug("Error adding u64: end of buffer.\n");
767 return;
768 }
769 add_short_atom_header(cmd, false, false, len);
770 while (len--)
771 add_token_u8(err, cmd, number >> (len * 8));
772}
773
774static u8 *add_bytestring_header(int *err, struct opal_dev *cmd, size_t len)
775{
776 size_t header_len = 1;
777 bool is_short_atom = true;
778
779 if (len & ~SHORT_ATOM_LEN_MASK) {
780 header_len = 2;
781 is_short_atom = false;
782 }
783
784 if (!can_add(err, cmd, header_len + len)) {
785 pr_debug("Error adding bytestring: end of buffer.\n");
786 return NULL;
787 }
788
789 if (is_short_atom)
790 add_short_atom_header(cmd, true, false, len);
791 else
792 add_medium_atom_header(cmd, true, false, len);
793
794 return &cmd->cmd[cmd->pos];
795}
796
797static void add_token_bytestring(int *err, struct opal_dev *cmd,
798 const u8 *bytestring, size_t len)
799{
800 u8 *start;
801
802 start = add_bytestring_header(err, cmd, len);
803 if (!start)
804 return;
805 memcpy(start, bytestring, len);
806 cmd->pos += len;
807}
808
809static int build_locking_range(u8 *buffer, size_t length, u8 lr)
810{
811 if (length > OPAL_UID_LENGTH) {
812 pr_debug("Can't build locking range. Length OOB\n");
813 return -ERANGE;
814 }
815
816 memcpy(buffer, opaluid[OPAL_LOCKINGRANGE_GLOBAL], OPAL_UID_LENGTH);
817
818 if (lr == 0)
819 return 0;
820
821 buffer[5] = LOCKING_RANGE_NON_GLOBAL;
822 buffer[7] = lr;
823
824 return 0;
825}
826
827static int build_locking_user(u8 *buffer, size_t length, u8 lr)
828{
829 if (length > OPAL_UID_LENGTH) {
830 pr_debug("Can't build locking range user. Length OOB\n");
831 return -ERANGE;
832 }
833
834 memcpy(buffer, opaluid[OPAL_USER1_UID], OPAL_UID_LENGTH);
835
836 buffer[7] = lr + 1;
837
838 return 0;
839}
840
841static void set_comid(struct opal_dev *cmd, u16 comid)
842{
843 struct opal_header *hdr = (struct opal_header *)cmd->cmd;
844
845 hdr->cp.extendedComID[0] = comid >> 8;
846 hdr->cp.extendedComID[1] = comid;
847 hdr->cp.extendedComID[2] = 0;
848 hdr->cp.extendedComID[3] = 0;
849}
850
851static int cmd_finalize(struct opal_dev *cmd, u32 hsn, u32 tsn)
852{
853 struct opal_header *hdr;
854 int err = 0;
855
856 /*
857 * Close the parameter list opened from cmd_start.
858 * The number of bytes added must be equal to
859 * CMD_FINALIZE_BYTES_NEEDED.
860 */
861 add_token_u8(&err, cmd, OPAL_ENDLIST);
862
863 add_token_u8(&err, cmd, OPAL_ENDOFDATA);
864 add_token_u8(&err, cmd, OPAL_STARTLIST);
865 add_token_u8(&err, cmd, 0);
866 add_token_u8(&err, cmd, 0);
867 add_token_u8(&err, cmd, 0);
868 add_token_u8(&err, cmd, OPAL_ENDLIST);
869
870 if (err) {
871 pr_debug("Error finalizing command.\n");
872 return -EFAULT;
873 }
874
875 hdr = (struct opal_header *) cmd->cmd;
876
877 hdr->pkt.tsn = cpu_to_be32(tsn);
878 hdr->pkt.hsn = cpu_to_be32(hsn);
879
880 hdr->subpkt.length = cpu_to_be32(cmd->pos - sizeof(*hdr));
881 while (cmd->pos % 4) {
882 if (cmd->pos >= IO_BUFFER_LENGTH) {
883 pr_debug("Error: Buffer overrun\n");
884 return -ERANGE;
885 }
886 cmd->cmd[cmd->pos++] = 0;
887 }
888 hdr->pkt.length = cpu_to_be32(cmd->pos - sizeof(hdr->cp) -
889 sizeof(hdr->pkt));
890 hdr->cp.length = cpu_to_be32(cmd->pos - sizeof(hdr->cp));
891
892 return 0;
893}
894
895static const struct opal_resp_tok *response_get_token(
896 const struct parsed_resp *resp,
897 int n)
898{
899 const struct opal_resp_tok *tok;
900
901 if (!resp) {
902 pr_debug("Response is NULL\n");
903 return ERR_PTR(-EINVAL);
904 }
905
906 if (n >= resp->num) {
907 pr_debug("Token number doesn't exist: %d, resp: %d\n",
908 n, resp->num);
909 return ERR_PTR(-EINVAL);
910 }
911
912 tok = &resp->toks[n];
913 if (tok->len == 0) {
914 pr_debug("Token length must be non-zero\n");
915 return ERR_PTR(-EINVAL);
916 }
917
918 return tok;
919}
920
921static ssize_t response_parse_tiny(struct opal_resp_tok *tok,
922 const u8 *pos)
923{
924 tok->pos = pos;
925 tok->len = 1;
926 tok->width = OPAL_WIDTH_TINY;
927
928 if (pos[0] & TINY_ATOM_SIGNED) {
929 tok->type = OPAL_DTA_TOKENID_SINT;
930 } else {
931 tok->type = OPAL_DTA_TOKENID_UINT;
932 tok->stored.u = pos[0] & 0x3f;
933 }
934
935 return tok->len;
936}
937
938static ssize_t response_parse_short(struct opal_resp_tok *tok,
939 const u8 *pos)
940{
941 tok->pos = pos;
942 tok->len = (pos[0] & SHORT_ATOM_LEN_MASK) + 1;
943 tok->width = OPAL_WIDTH_SHORT;
944
945 if (pos[0] & SHORT_ATOM_BYTESTRING) {
946 tok->type = OPAL_DTA_TOKENID_BYTESTRING;
947 } else if (pos[0] & SHORT_ATOM_SIGNED) {
948 tok->type = OPAL_DTA_TOKENID_SINT;
949 } else {
950 u64 u_integer = 0;
951 ssize_t i, b = 0;
952
953 tok->type = OPAL_DTA_TOKENID_UINT;
954 if (tok->len > 9) {
955 pr_debug("uint64 with more than 8 bytes\n");
956 return -EINVAL;
957 }
958 for (i = tok->len - 1; i > 0; i--) {
959 u_integer |= ((u64)pos[i] << (8 * b));
960 b++;
961 }
962 tok->stored.u = u_integer;
963 }
964
965 return tok->len;
966}
967
968static ssize_t response_parse_medium(struct opal_resp_tok *tok,
969 const u8 *pos)
970{
971 tok->pos = pos;
972 tok->len = (((pos[0] & MEDIUM_ATOM_LEN_MASK) << 8) | pos[1]) + 2;
973 tok->width = OPAL_WIDTH_MEDIUM;
974
975 if (pos[0] & MEDIUM_ATOM_BYTESTRING)
976 tok->type = OPAL_DTA_TOKENID_BYTESTRING;
977 else if (pos[0] & MEDIUM_ATOM_SIGNED)
978 tok->type = OPAL_DTA_TOKENID_SINT;
979 else
980 tok->type = OPAL_DTA_TOKENID_UINT;
981
982 return tok->len;
983}
984
985static ssize_t response_parse_long(struct opal_resp_tok *tok,
986 const u8 *pos)
987{
988 tok->pos = pos;
989 tok->len = ((pos[1] << 16) | (pos[2] << 8) | pos[3]) + 4;
990 tok->width = OPAL_WIDTH_LONG;
991
992 if (pos[0] & LONG_ATOM_BYTESTRING)
993 tok->type = OPAL_DTA_TOKENID_BYTESTRING;
994 else if (pos[0] & LONG_ATOM_SIGNED)
995 tok->type = OPAL_DTA_TOKENID_SINT;
996 else
997 tok->type = OPAL_DTA_TOKENID_UINT;
998
999 return tok->len;
1000}
1001
1002static ssize_t response_parse_token(struct opal_resp_tok *tok,
1003 const u8 *pos)
1004{
1005 tok->pos = pos;
1006 tok->len = 1;
1007 tok->type = OPAL_DTA_TOKENID_TOKEN;
1008 tok->width = OPAL_WIDTH_TOKEN;
1009
1010 return tok->len;
1011}
1012
1013static int response_parse(const u8 *buf, size_t length,
1014 struct parsed_resp *resp)
1015{
1016 const struct opal_header *hdr;
1017 struct opal_resp_tok *iter;
1018 int num_entries = 0;
1019 int total;
1020 ssize_t token_length;
1021 const u8 *pos;
1022 u32 clen, plen, slen;
1023
1024 if (!buf)
1025 return -EFAULT;
1026
1027 if (!resp)
1028 return -EFAULT;
1029
1030 hdr = (struct opal_header *)buf;
1031 pos = buf;
1032 pos += sizeof(*hdr);
1033
1034 clen = be32_to_cpu(hdr->cp.length);
1035 plen = be32_to_cpu(hdr->pkt.length);
1036 slen = be32_to_cpu(hdr->subpkt.length);
1037 pr_debug("Response size: cp: %u, pkt: %u, subpkt: %u\n",
1038 clen, plen, slen);
1039
1040 if (clen == 0 || plen == 0 || slen == 0 ||
1041 slen > IO_BUFFER_LENGTH - sizeof(*hdr)) {
1042 pr_debug("Bad header length. cp: %u, pkt: %u, subpkt: %u\n",
1043 clen, plen, slen);
1044 print_buffer(pos, sizeof(*hdr));
1045 return -EINVAL;
1046 }
1047
1048 if (pos > buf + length)
1049 return -EFAULT;
1050
1051 iter = resp->toks;
1052 total = slen;
1053 print_buffer(pos, total);
1054 while (total > 0) {
1055 if (pos[0] <= TINY_ATOM_BYTE) /* tiny atom */
1056 token_length = response_parse_tiny(iter, pos);
1057 else if (pos[0] <= SHORT_ATOM_BYTE) /* short atom */
1058 token_length = response_parse_short(iter, pos);
1059 else if (pos[0] <= MEDIUM_ATOM_BYTE) /* medium atom */
1060 token_length = response_parse_medium(iter, pos);
1061 else if (pos[0] <= LONG_ATOM_BYTE) /* long atom */
1062 token_length = response_parse_long(iter, pos);
1063 else if (pos[0] == EMPTY_ATOM_BYTE) /* empty atom */
1064 token_length = 1;
1065 else /* TOKEN */
1066 token_length = response_parse_token(iter, pos);
1067
1068 if (token_length < 0)
1069 return token_length;
1070
1071 if (pos[0] != EMPTY_ATOM_BYTE)
1072 num_entries++;
1073
1074 pos += token_length;
1075 total -= token_length;
1076 iter++;
1077 }
1078
1079 resp->num = num_entries;
1080
1081 return 0;
1082}
1083
1084static size_t response_get_string(const struct parsed_resp *resp, int n,
1085 const char **store)
1086{
1087 u8 skip;
1088 const struct opal_resp_tok *tok;
1089
1090 *store = NULL;
1091 tok = response_get_token(resp, n);
1092 if (IS_ERR(tok))
1093 return 0;
1094
1095 if (tok->type != OPAL_DTA_TOKENID_BYTESTRING) {
1096 pr_debug("Token is not a byte string!\n");
1097 return 0;
1098 }
1099
1100 switch (tok->width) {
1101 case OPAL_WIDTH_TINY:
1102 case OPAL_WIDTH_SHORT:
1103 skip = 1;
1104 break;
1105 case OPAL_WIDTH_MEDIUM:
1106 skip = 2;
1107 break;
1108 case OPAL_WIDTH_LONG:
1109 skip = 4;
1110 break;
1111 default:
1112 pr_debug("Token has invalid width!\n");
1113 return 0;
1114 }
1115
1116 *store = tok->pos + skip;
1117
1118 return tok->len - skip;
1119}
1120
1121static u64 response_get_u64(const struct parsed_resp *resp, int n)
1122{
1123 const struct opal_resp_tok *tok;
1124
1125 tok = response_get_token(resp, n);
1126 if (IS_ERR(tok))
1127 return 0;
1128
1129 if (tok->type != OPAL_DTA_TOKENID_UINT) {
1130 pr_debug("Token is not unsigned int: %d\n", tok->type);
1131 return 0;
1132 }
1133
1134 if (tok->width != OPAL_WIDTH_TINY && tok->width != OPAL_WIDTH_SHORT) {
1135 pr_debug("Atom is not short or tiny: %d\n", tok->width);
1136 return 0;
1137 }
1138
1139 return tok->stored.u;
1140}
1141
1142static bool response_token_matches(const struct opal_resp_tok *token, u8 match)
1143{
1144 if (IS_ERR(token) ||
1145 token->type != OPAL_DTA_TOKENID_TOKEN ||
1146 token->pos[0] != match)
1147 return false;
1148 return true;
1149}
1150
1151static u8 response_status(const struct parsed_resp *resp)
1152{
1153 const struct opal_resp_tok *tok;
1154
1155 tok = response_get_token(resp, 0);
1156 if (response_token_matches(tok, OPAL_ENDOFSESSION))
1157 return 0;
1158
1159 if (resp->num < 5)
1160 return DTAERROR_NO_METHOD_STATUS;
1161
1162 tok = response_get_token(resp, resp->num - 5);
1163 if (!response_token_matches(tok, OPAL_STARTLIST))
1164 return DTAERROR_NO_METHOD_STATUS;
1165
1166 tok = response_get_token(resp, resp->num - 1);
1167 if (!response_token_matches(tok, OPAL_ENDLIST))
1168 return DTAERROR_NO_METHOD_STATUS;
1169
1170 return response_get_u64(resp, resp->num - 4);
1171}
1172
1173/* Parses and checks for errors */
1174static int parse_and_check_status(struct opal_dev *dev)
1175{
1176 int error;
1177
1178 print_buffer(dev->cmd, dev->pos);
1179
1180 error = response_parse(dev->resp, IO_BUFFER_LENGTH, &dev->parsed);
1181 if (error) {
1182 pr_debug("Couldn't parse response.\n");
1183 return error;
1184 }
1185
1186 return response_status(&dev->parsed);
1187}
1188
1189static void clear_opal_cmd(struct opal_dev *dev)
1190{
1191 dev->pos = sizeof(struct opal_header);
1192 memset(dev->cmd, 0, IO_BUFFER_LENGTH);
1193}
1194
1195static int cmd_start(struct opal_dev *dev, const u8 *uid, const u8 *method)
1196{
1197 int err = 0;
1198
1199 clear_opal_cmd(dev);
1200 set_comid(dev, dev->comid);
1201
1202 add_token_u8(&err, dev, OPAL_CALL);
1203 add_token_bytestring(&err, dev, uid, OPAL_UID_LENGTH);
1204 add_token_bytestring(&err, dev, method, OPAL_METHOD_LENGTH);
1205
1206 /*
1207 * Every method call is followed by its parameters enclosed within
1208 * OPAL_STARTLIST and OPAL_ENDLIST tokens. We automatically open the
1209 * parameter list here and close it later in cmd_finalize.
1210 */
1211 add_token_u8(&err, dev, OPAL_STARTLIST);
1212
1213 return err;
1214}
1215
1216static int start_opal_session_cont(struct opal_dev *dev)
1217{
1218 u32 hsn, tsn;
1219 int error;
1220
1221 error = parse_and_check_status(dev);
1222 if (error)
1223 return error;
1224
1225 hsn = response_get_u64(&dev->parsed, 4);
1226 tsn = response_get_u64(&dev->parsed, 5);
1227
1228 if (hsn != GENERIC_HOST_SESSION_NUM || tsn < FIRST_TPER_SESSION_NUM) {
1229 pr_debug("Couldn't authenticate session\n");
1230 return -EPERM;
1231 }
1232
1233 dev->hsn = hsn;
1234 dev->tsn = tsn;
1235
1236 return 0;
1237}
1238
1239static void add_suspend_info(struct opal_dev *dev,
1240 struct opal_suspend_data *sus)
1241{
1242 struct opal_suspend_data *iter;
1243
1244 list_for_each_entry(iter, &dev->unlk_lst, node) {
1245 if (iter->lr == sus->lr) {
1246 list_del(&iter->node);
1247 kfree(iter);
1248 break;
1249 }
1250 }
1251 list_add_tail(&sus->node, &dev->unlk_lst);
1252}
1253
1254static int end_session_cont(struct opal_dev *dev)
1255{
1256 dev->hsn = 0;
1257 dev->tsn = 0;
1258
1259 return parse_and_check_status(dev);
1260}
1261
1262static int finalize_and_send(struct opal_dev *dev, cont_fn cont)
1263{
1264 int ret;
1265
1266 ret = cmd_finalize(dev, dev->hsn, dev->tsn);
1267 if (ret) {
1268 pr_debug("Error finalizing command buffer: %d\n", ret);
1269 return ret;
1270 }
1271
1272 print_buffer(dev->cmd, dev->pos);
1273
1274 return opal_send_recv(dev, cont);
1275}
1276
1277static int generic_get_columns(struct opal_dev *dev, const u8 *table,
1278 u64 start_column, u64 end_column)
1279{
1280 int err;
1281
1282 err = cmd_start(dev, table, opalmethod[OPAL_GET]);
1283
1284 add_token_u8(&err, dev, OPAL_STARTLIST);
1285
1286 add_token_u8(&err, dev, OPAL_STARTNAME);
1287 add_token_u8(&err, dev, OPAL_STARTCOLUMN);
1288 add_token_u64(&err, dev, start_column);
1289 add_token_u8(&err, dev, OPAL_ENDNAME);
1290
1291 add_token_u8(&err, dev, OPAL_STARTNAME);
1292 add_token_u8(&err, dev, OPAL_ENDCOLUMN);
1293 add_token_u64(&err, dev, end_column);
1294 add_token_u8(&err, dev, OPAL_ENDNAME);
1295
1296 add_token_u8(&err, dev, OPAL_ENDLIST);
1297
1298 if (err)
1299 return err;
1300
1301 return finalize_and_send(dev, parse_and_check_status);
1302}
1303
1304/*
1305 * request @column from table @table on device @dev. On success, the column
1306 * data will be available in dev->resp->tok[4]
1307 */
1308static int generic_get_column(struct opal_dev *dev, const u8 *table,
1309 u64 column)
1310{
1311 return generic_get_columns(dev, table, column, column);
1312}
1313
1314/*
1315 * see TCG SAS 5.3.2.3 for a description of the available columns
1316 *
1317 * the result is provided in dev->resp->tok[4]
1318 */
1319static int generic_get_table_info(struct opal_dev *dev, const u8 *table_uid,
1320 u64 column)
1321{
1322 u8 uid[OPAL_UID_LENGTH];
1323 const unsigned int half = OPAL_UID_LENGTH_HALF;
1324
1325 /* sed-opal UIDs can be split in two halves:
1326 * first: actual table index
1327 * second: relative index in the table
1328 * so we have to get the first half of the OPAL_TABLE_TABLE and use the
1329 * first part of the target table as relative index into that table
1330 */
1331 memcpy(uid, opaluid[OPAL_TABLE_TABLE], half);
1332 memcpy(uid + half, table_uid, half);
1333
1334 return generic_get_column(dev, uid, column);
1335}
1336
1337static int gen_key(struct opal_dev *dev, void *data)
1338{
1339 u8 uid[OPAL_UID_LENGTH];
1340 int err;
1341
1342 memcpy(uid, dev->prev_data, min(sizeof(uid), dev->prev_d_len));
1343 kfree(dev->prev_data);
1344 dev->prev_data = NULL;
1345
1346 err = cmd_start(dev, uid, opalmethod[OPAL_GENKEY]);
1347
1348 if (err) {
1349 pr_debug("Error building gen key command\n");
1350 return err;
1351
1352 }
1353
1354 return finalize_and_send(dev, parse_and_check_status);
1355}
1356
1357static int get_active_key_cont(struct opal_dev *dev)
1358{
1359 const char *activekey;
1360 size_t keylen;
1361 int error;
1362
1363 error = parse_and_check_status(dev);
1364 if (error)
1365 return error;
1366
1367 keylen = response_get_string(&dev->parsed, 4, &activekey);
1368 if (!activekey) {
1369 pr_debug("%s: Couldn't extract the Activekey from the response\n",
1370 __func__);
1371 return OPAL_INVAL_PARAM;
1372 }
1373
1374 dev->prev_data = kmemdup(activekey, keylen, GFP_KERNEL);
1375
1376 if (!dev->prev_data)
1377 return -ENOMEM;
1378
1379 dev->prev_d_len = keylen;
1380
1381 return 0;
1382}
1383
1384static int get_active_key(struct opal_dev *dev, void *data)
1385{
1386 u8 uid[OPAL_UID_LENGTH];
1387 int err;
1388 u8 *lr = data;
1389
1390 err = build_locking_range(uid, sizeof(uid), *lr);
1391 if (err)
1392 return err;
1393
1394 err = generic_get_column(dev, uid, OPAL_ACTIVEKEY);
1395 if (err)
1396 return err;
1397
1398 return get_active_key_cont(dev);
1399}
1400
1401static int generic_table_write_data(struct opal_dev *dev, const u64 data,
1402 u64 offset, u64 size, const u8 *uid)
1403{
1404 const u8 __user *src = (u8 __user *)(uintptr_t)data;
1405 u8 *dst;
1406 u64 len;
1407 size_t off = 0;
1408 int err;
1409
1410 /* do we fit in the available space? */
1411 err = generic_get_table_info(dev, uid, OPAL_TABLE_ROWS);
1412 if (err) {
1413 pr_debug("Couldn't get the table size\n");
1414 return err;
1415 }
1416
1417 len = response_get_u64(&dev->parsed, 4);
1418 if (size > len || offset > len - size) {
1419 pr_debug("Does not fit in the table (%llu vs. %llu)\n",
1420 offset + size, len);
1421 return -ENOSPC;
1422 }
1423
1424 /* do the actual transmission(s) */
1425 while (off < size) {
1426 err = cmd_start(dev, uid, opalmethod[OPAL_SET]);
1427 add_token_u8(&err, dev, OPAL_STARTNAME);
1428 add_token_u8(&err, dev, OPAL_WHERE);
1429 add_token_u64(&err, dev, offset + off);
1430 add_token_u8(&err, dev, OPAL_ENDNAME);
1431
1432 add_token_u8(&err, dev, OPAL_STARTNAME);
1433 add_token_u8(&err, dev, OPAL_VALUES);
1434
1435 /*
1436 * The bytestring header is either 1 or 2 bytes, so assume 2.
1437 * There also needs to be enough space to accommodate the
1438 * trailing OPAL_ENDNAME (1 byte) and tokens added by
1439 * cmd_finalize.
1440 */
1441 len = min(remaining_size(dev) - (2+1+CMD_FINALIZE_BYTES_NEEDED),
1442 (size_t)(size - off));
1443 pr_debug("Write bytes %zu+%llu/%llu\n", off, len, size);
1444
1445 dst = add_bytestring_header(&err, dev, len);
1446 if (!dst)
1447 break;
1448
1449 if (copy_from_user(dst, src + off, len)) {
1450 err = -EFAULT;
1451 break;
1452 }
1453
1454 dev->pos += len;
1455
1456 add_token_u8(&err, dev, OPAL_ENDNAME);
1457 if (err)
1458 break;
1459
1460 err = finalize_and_send(dev, parse_and_check_status);
1461 if (err)
1462 break;
1463
1464 off += len;
1465 }
1466
1467 return err;
1468}
1469
1470static int generic_lr_enable_disable(struct opal_dev *dev,
1471 u8 *uid, bool rle, bool wle,
1472 bool rl, bool wl)
1473{
1474 int err;
1475
1476 err = cmd_start(dev, uid, opalmethod[OPAL_SET]);
1477
1478 add_token_u8(&err, dev, OPAL_STARTNAME);
1479 add_token_u8(&err, dev, OPAL_VALUES);
1480 add_token_u8(&err, dev, OPAL_STARTLIST);
1481
1482 add_token_u8(&err, dev, OPAL_STARTNAME);
1483 add_token_u8(&err, dev, OPAL_READLOCKENABLED);
1484 add_token_u8(&err, dev, rle);
1485 add_token_u8(&err, dev, OPAL_ENDNAME);
1486
1487 add_token_u8(&err, dev, OPAL_STARTNAME);
1488 add_token_u8(&err, dev, OPAL_WRITELOCKENABLED);
1489 add_token_u8(&err, dev, wle);
1490 add_token_u8(&err, dev, OPAL_ENDNAME);
1491
1492 add_token_u8(&err, dev, OPAL_STARTNAME);
1493 add_token_u8(&err, dev, OPAL_READLOCKED);
1494 add_token_u8(&err, dev, rl);
1495 add_token_u8(&err, dev, OPAL_ENDNAME);
1496
1497 add_token_u8(&err, dev, OPAL_STARTNAME);
1498 add_token_u8(&err, dev, OPAL_WRITELOCKED);
1499 add_token_u8(&err, dev, wl);
1500 add_token_u8(&err, dev, OPAL_ENDNAME);
1501
1502 add_token_u8(&err, dev, OPAL_ENDLIST);
1503 add_token_u8(&err, dev, OPAL_ENDNAME);
1504
1505 return err;
1506}
1507
1508static inline int enable_global_lr(struct opal_dev *dev, u8 *uid,
1509 struct opal_user_lr_setup *setup)
1510{
1511 int err;
1512
1513 err = generic_lr_enable_disable(dev, uid, !!setup->RLE, !!setup->WLE,
1514 0, 0);
1515 if (err)
1516 pr_debug("Failed to create enable global lr command\n");
1517
1518 return err;
1519}
1520
1521static int setup_enable_range(struct opal_dev *dev, void *data)
1522{
1523 u8 uid[OPAL_UID_LENGTH];
1524 struct opal_user_lr_setup *setup = data;
1525 u8 lr;
1526 int err;
1527
1528 lr = setup->session.opal_key.lr;
1529 err = build_locking_range(uid, sizeof(uid), lr);
1530 if (err)
1531 return err;
1532
1533 if (lr == 0)
1534 err = enable_global_lr(dev, uid, setup);
1535 else
1536 err = generic_lr_enable_disable(dev, uid, !!setup->RLE, !!setup->WLE, 0, 0);
1537 if (err) {
1538 pr_debug("Failed to create enable lr command.\n");
1539 return err;
1540 }
1541
1542 return finalize_and_send(dev, parse_and_check_status);
1543}
1544
1545static int setup_locking_range_start_length(struct opal_dev *dev, void *data)
1546{
1547 int err;
1548 u8 uid[OPAL_UID_LENGTH];
1549 struct opal_user_lr_setup *setup = data;
1550
1551 err = build_locking_range(uid, sizeof(uid), setup->session.opal_key.lr);
1552 if (err)
1553 return err;
1554
1555 err = cmd_start(dev, uid, opalmethod[OPAL_SET]);
1556
1557 add_token_u8(&err, dev, OPAL_STARTNAME);
1558 add_token_u8(&err, dev, OPAL_VALUES);
1559 add_token_u8(&err, dev, OPAL_STARTLIST);
1560
1561 add_token_u8(&err, dev, OPAL_STARTNAME);
1562 add_token_u8(&err, dev, OPAL_RANGESTART);
1563 add_token_u64(&err, dev, setup->range_start);
1564 add_token_u8(&err, dev, OPAL_ENDNAME);
1565
1566 add_token_u8(&err, dev, OPAL_STARTNAME);
1567 add_token_u8(&err, dev, OPAL_RANGELENGTH);
1568 add_token_u64(&err, dev, setup->range_length);
1569 add_token_u8(&err, dev, OPAL_ENDNAME);
1570
1571 add_token_u8(&err, dev, OPAL_ENDLIST);
1572 add_token_u8(&err, dev, OPAL_ENDNAME);
1573
1574 if (err) {
1575 pr_debug("Error building Setup Locking RangeStartLength command.\n");
1576 return err;
1577 }
1578
1579 return finalize_and_send(dev, parse_and_check_status);
1580}
1581
1582static int response_get_column(const struct parsed_resp *resp,
1583 int *iter,
1584 u64 column,
1585 u64 *value)
1586{
1587 const struct opal_resp_tok *tok;
1588 int n = *iter;
1589 u64 val;
1590
1591 tok = response_get_token(resp, n);
1592 if (IS_ERR(tok))
1593 return PTR_ERR(tok);
1594
1595 if (!response_token_matches(tok, OPAL_STARTNAME)) {
1596 pr_debug("Unexpected response token type %d.\n", n);
1597 return OPAL_INVAL_PARAM;
1598 }
1599 n++;
1600
1601 if (response_get_u64(resp, n) != column) {
1602 pr_debug("Token %d does not match expected column %llu.\n",
1603 n, column);
1604 return OPAL_INVAL_PARAM;
1605 }
1606 n++;
1607
1608 val = response_get_u64(resp, n);
1609 n++;
1610
1611 tok = response_get_token(resp, n);
1612 if (IS_ERR(tok))
1613 return PTR_ERR(tok);
1614
1615 if (!response_token_matches(tok, OPAL_ENDNAME)) {
1616 pr_debug("Unexpected response token type %d.\n", n);
1617 return OPAL_INVAL_PARAM;
1618 }
1619 n++;
1620
1621 *value = val;
1622 *iter = n;
1623
1624 return 0;
1625}
1626
1627static int locking_range_status(struct opal_dev *dev, void *data)
1628{
1629 u8 lr_buffer[OPAL_UID_LENGTH];
1630 u64 resp;
1631 bool rlocked, wlocked;
1632 int err, tok_n = 2;
1633 struct opal_lr_status *lrst = data;
1634
1635 err = build_locking_range(lr_buffer, sizeof(lr_buffer),
1636 lrst->session.opal_key.lr);
1637 if (err)
1638 return err;
1639
1640 err = generic_get_columns(dev, lr_buffer, OPAL_RANGESTART,
1641 OPAL_WRITELOCKED);
1642 if (err) {
1643 pr_debug("Couldn't get lr %u table columns %d to %d.\n",
1644 lrst->session.opal_key.lr, OPAL_RANGESTART,
1645 OPAL_WRITELOCKED);
1646 return err;
1647 }
1648
1649 /* range start */
1650 err = response_get_column(&dev->parsed, &tok_n, OPAL_RANGESTART,
1651 &lrst->range_start);
1652 if (err)
1653 return err;
1654
1655 /* range length */
1656 err = response_get_column(&dev->parsed, &tok_n, OPAL_RANGELENGTH,
1657 &lrst->range_length);
1658 if (err)
1659 return err;
1660
1661 /* RLE */
1662 err = response_get_column(&dev->parsed, &tok_n, OPAL_READLOCKENABLED,
1663 &resp);
1664 if (err)
1665 return err;
1666
1667 lrst->RLE = !!resp;
1668
1669 /* WLE */
1670 err = response_get_column(&dev->parsed, &tok_n, OPAL_WRITELOCKENABLED,
1671 &resp);
1672 if (err)
1673 return err;
1674
1675 lrst->WLE = !!resp;
1676
1677 /* read locked */
1678 err = response_get_column(&dev->parsed, &tok_n, OPAL_READLOCKED, &resp);
1679 if (err)
1680 return err;
1681
1682 rlocked = !!resp;
1683
1684 /* write locked */
1685 err = response_get_column(&dev->parsed, &tok_n, OPAL_WRITELOCKED, &resp);
1686 if (err)
1687 return err;
1688
1689 wlocked = !!resp;
1690
1691 /* opal_lock_state can not map 'read locked' only state. */
1692 lrst->l_state = OPAL_RW;
1693 if (rlocked && wlocked)
1694 lrst->l_state = OPAL_LK;
1695 else if (wlocked)
1696 lrst->l_state = OPAL_RO;
1697 else if (rlocked) {
1698 pr_debug("Can not report read locked only state.\n");
1699 return -EINVAL;
1700 }
1701
1702 return 0;
1703}
1704
1705static int start_generic_opal_session(struct opal_dev *dev,
1706 enum opal_uid auth,
1707 enum opal_uid sp_type,
1708 const char *key,
1709 u8 key_len)
1710{
1711 u32 hsn;
1712 int err;
1713
1714 if (key == NULL && auth != OPAL_ANYBODY_UID)
1715 return OPAL_INVAL_PARAM;
1716
1717 hsn = GENERIC_HOST_SESSION_NUM;
1718 err = cmd_start(dev, opaluid[OPAL_SMUID_UID],
1719 opalmethod[OPAL_STARTSESSION]);
1720
1721 add_token_u64(&err, dev, hsn);
1722 add_token_bytestring(&err, dev, opaluid[sp_type], OPAL_UID_LENGTH);
1723 add_token_u8(&err, dev, 1);
1724
1725 switch (auth) {
1726 case OPAL_ANYBODY_UID:
1727 break;
1728 case OPAL_ADMIN1_UID:
1729 case OPAL_SID_UID:
1730 case OPAL_PSID_UID:
1731 add_token_u8(&err, dev, OPAL_STARTNAME);
1732 add_token_u8(&err, dev, 0); /* HostChallenge */
1733 add_token_bytestring(&err, dev, key, key_len);
1734 add_token_u8(&err, dev, OPAL_ENDNAME);
1735 add_token_u8(&err, dev, OPAL_STARTNAME);
1736 add_token_u8(&err, dev, 3); /* HostSignAuth */
1737 add_token_bytestring(&err, dev, opaluid[auth],
1738 OPAL_UID_LENGTH);
1739 add_token_u8(&err, dev, OPAL_ENDNAME);
1740 break;
1741 default:
1742 pr_debug("Cannot start Admin SP session with auth %d\n", auth);
1743 return OPAL_INVAL_PARAM;
1744 }
1745
1746 if (err) {
1747 pr_debug("Error building start adminsp session command.\n");
1748 return err;
1749 }
1750
1751 return finalize_and_send(dev, start_opal_session_cont);
1752}
1753
1754static int start_anybodyASP_opal_session(struct opal_dev *dev, void *data)
1755{
1756 return start_generic_opal_session(dev, OPAL_ANYBODY_UID,
1757 OPAL_ADMINSP_UID, NULL, 0);
1758}
1759
1760static int start_anybodyLSP_opal_session(struct opal_dev *dev, void *data)
1761{
1762 return start_generic_opal_session(dev, OPAL_ANYBODY_UID,
1763 OPAL_LOCKINGSP_UID, NULL, 0);
1764}
1765
1766static int start_SIDASP_opal_session(struct opal_dev *dev, void *data)
1767{
1768 int ret;
1769 const u8 *key = dev->prev_data;
1770
1771 if (!key) {
1772 const struct opal_key *okey = data;
1773
1774 ret = start_generic_opal_session(dev, OPAL_SID_UID,
1775 OPAL_ADMINSP_UID,
1776 okey->key,
1777 okey->key_len);
1778 } else {
1779 ret = start_generic_opal_session(dev, OPAL_SID_UID,
1780 OPAL_ADMINSP_UID,
1781 key, dev->prev_d_len);
1782 kfree(key);
1783 dev->prev_data = NULL;
1784 }
1785
1786 return ret;
1787}
1788
1789static int start_admin1LSP_opal_session(struct opal_dev *dev, void *data)
1790{
1791 struct opal_key *key = data;
1792
1793 return start_generic_opal_session(dev, OPAL_ADMIN1_UID,
1794 OPAL_LOCKINGSP_UID,
1795 key->key, key->key_len);
1796}
1797
1798static int start_PSID_opal_session(struct opal_dev *dev, void *data)
1799{
1800 const struct opal_key *okey = data;
1801
1802 return start_generic_opal_session(dev, OPAL_PSID_UID,
1803 OPAL_ADMINSP_UID,
1804 okey->key,
1805 okey->key_len);
1806}
1807
1808static int start_auth_opal_session(struct opal_dev *dev, void *data)
1809{
1810 struct opal_session_info *session = data;
1811 u8 lk_ul_user[OPAL_UID_LENGTH];
1812 size_t keylen = session->opal_key.key_len;
1813 int err = 0;
1814
1815 u8 *key = session->opal_key.key;
1816 u32 hsn = GENERIC_HOST_SESSION_NUM;
1817
1818 if (session->sum)
1819 err = build_locking_user(lk_ul_user, sizeof(lk_ul_user),
1820 session->opal_key.lr);
1821 else if (session->who != OPAL_ADMIN1 && !session->sum)
1822 err = build_locking_user(lk_ul_user, sizeof(lk_ul_user),
1823 session->who - 1);
1824 else
1825 memcpy(lk_ul_user, opaluid[OPAL_ADMIN1_UID], OPAL_UID_LENGTH);
1826
1827 if (err)
1828 return err;
1829
1830 err = cmd_start(dev, opaluid[OPAL_SMUID_UID],
1831 opalmethod[OPAL_STARTSESSION]);
1832
1833 add_token_u64(&err, dev, hsn);
1834 add_token_bytestring(&err, dev, opaluid[OPAL_LOCKINGSP_UID],
1835 OPAL_UID_LENGTH);
1836 add_token_u8(&err, dev, 1);
1837 add_token_u8(&err, dev, OPAL_STARTNAME);
1838 add_token_u8(&err, dev, 0);
1839 add_token_bytestring(&err, dev, key, keylen);
1840 add_token_u8(&err, dev, OPAL_ENDNAME);
1841 add_token_u8(&err, dev, OPAL_STARTNAME);
1842 add_token_u8(&err, dev, 3);
1843 add_token_bytestring(&err, dev, lk_ul_user, OPAL_UID_LENGTH);
1844 add_token_u8(&err, dev, OPAL_ENDNAME);
1845
1846 if (err) {
1847 pr_debug("Error building STARTSESSION command.\n");
1848 return err;
1849 }
1850
1851 return finalize_and_send(dev, start_opal_session_cont);
1852}
1853
1854static int revert_tper(struct opal_dev *dev, void *data)
1855{
1856 int err;
1857
1858 err = cmd_start(dev, opaluid[OPAL_ADMINSP_UID],
1859 opalmethod[OPAL_REVERT]);
1860 if (err) {
1861 pr_debug("Error building REVERT TPER command.\n");
1862 return err;
1863 }
1864
1865 return finalize_and_send(dev, parse_and_check_status);
1866}
1867
1868static int internal_activate_user(struct opal_dev *dev, void *data)
1869{
1870 struct opal_session_info *session = data;
1871 u8 uid[OPAL_UID_LENGTH];
1872 int err;
1873
1874 memcpy(uid, opaluid[OPAL_USER1_UID], OPAL_UID_LENGTH);
1875 uid[7] = session->who;
1876
1877 err = cmd_start(dev, uid, opalmethod[OPAL_SET]);
1878 add_token_u8(&err, dev, OPAL_STARTNAME);
1879 add_token_u8(&err, dev, OPAL_VALUES);
1880 add_token_u8(&err, dev, OPAL_STARTLIST);
1881 add_token_u8(&err, dev, OPAL_STARTNAME);
1882 add_token_u8(&err, dev, 5); /* Enabled */
1883 add_token_u8(&err, dev, OPAL_TRUE);
1884 add_token_u8(&err, dev, OPAL_ENDNAME);
1885 add_token_u8(&err, dev, OPAL_ENDLIST);
1886 add_token_u8(&err, dev, OPAL_ENDNAME);
1887
1888 if (err) {
1889 pr_debug("Error building Activate UserN command.\n");
1890 return err;
1891 }
1892
1893 return finalize_and_send(dev, parse_and_check_status);
1894}
1895
1896static int revert_lsp(struct opal_dev *dev, void *data)
1897{
1898 struct opal_revert_lsp *rev = data;
1899 int err;
1900
1901 err = cmd_start(dev, opaluid[OPAL_THISSP_UID],
1902 opalmethod[OPAL_REVERTSP]);
1903 add_token_u8(&err, dev, OPAL_STARTNAME);
1904 add_token_u64(&err, dev, OPAL_KEEP_GLOBAL_RANGE_KEY);
1905 add_token_u8(&err, dev, (rev->options & OPAL_PRESERVE) ?
1906 OPAL_TRUE : OPAL_FALSE);
1907 add_token_u8(&err, dev, OPAL_ENDNAME);
1908 if (err) {
1909 pr_debug("Error building REVERT SP command.\n");
1910 return err;
1911 }
1912
1913 return finalize_and_send(dev, parse_and_check_status);
1914}
1915
1916static int erase_locking_range(struct opal_dev *dev, void *data)
1917{
1918 struct opal_session_info *session = data;
1919 u8 uid[OPAL_UID_LENGTH];
1920 int err;
1921
1922 if (build_locking_range(uid, sizeof(uid), session->opal_key.lr) < 0)
1923 return -ERANGE;
1924
1925 err = cmd_start(dev, uid, opalmethod[OPAL_ERASE]);
1926
1927 if (err) {
1928 pr_debug("Error building Erase Locking Range Command.\n");
1929 return err;
1930 }
1931
1932 return finalize_and_send(dev, parse_and_check_status);
1933}
1934
1935static int set_mbr_done(struct opal_dev *dev, void *data)
1936{
1937 u8 *mbr_done_tf = data;
1938 int err;
1939
1940 err = cmd_start(dev, opaluid[OPAL_MBRCONTROL],
1941 opalmethod[OPAL_SET]);
1942
1943 add_token_u8(&err, dev, OPAL_STARTNAME);
1944 add_token_u8(&err, dev, OPAL_VALUES);
1945 add_token_u8(&err, dev, OPAL_STARTLIST);
1946 add_token_u8(&err, dev, OPAL_STARTNAME);
1947 add_token_u8(&err, dev, OPAL_MBRDONE);
1948 add_token_u8(&err, dev, *mbr_done_tf); /* Done T or F */
1949 add_token_u8(&err, dev, OPAL_ENDNAME);
1950 add_token_u8(&err, dev, OPAL_ENDLIST);
1951 add_token_u8(&err, dev, OPAL_ENDNAME);
1952
1953 if (err) {
1954 pr_debug("Error Building set MBR Done command\n");
1955 return err;
1956 }
1957
1958 return finalize_and_send(dev, parse_and_check_status);
1959}
1960
1961static int set_mbr_enable_disable(struct opal_dev *dev, void *data)
1962{
1963 u8 *mbr_en_dis = data;
1964 int err;
1965
1966 err = cmd_start(dev, opaluid[OPAL_MBRCONTROL],
1967 opalmethod[OPAL_SET]);
1968
1969 add_token_u8(&err, dev, OPAL_STARTNAME);
1970 add_token_u8(&err, dev, OPAL_VALUES);
1971 add_token_u8(&err, dev, OPAL_STARTLIST);
1972 add_token_u8(&err, dev, OPAL_STARTNAME);
1973 add_token_u8(&err, dev, OPAL_MBRENABLE);
1974 add_token_u8(&err, dev, *mbr_en_dis);
1975 add_token_u8(&err, dev, OPAL_ENDNAME);
1976 add_token_u8(&err, dev, OPAL_ENDLIST);
1977 add_token_u8(&err, dev, OPAL_ENDNAME);
1978
1979 if (err) {
1980 pr_debug("Error Building set MBR done command\n");
1981 return err;
1982 }
1983
1984 return finalize_and_send(dev, parse_and_check_status);
1985}
1986
1987static int write_shadow_mbr(struct opal_dev *dev, void *data)
1988{
1989 struct opal_shadow_mbr *shadow = data;
1990
1991 return generic_table_write_data(dev, shadow->data, shadow->offset,
1992 shadow->size, opaluid[OPAL_MBR]);
1993}
1994
1995static int generic_pw_cmd(u8 *key, size_t key_len, u8 *cpin_uid,
1996 struct opal_dev *dev)
1997{
1998 int err;
1999
2000 err = cmd_start(dev, cpin_uid, opalmethod[OPAL_SET]);
2001
2002 add_token_u8(&err, dev, OPAL_STARTNAME);
2003 add_token_u8(&err, dev, OPAL_VALUES);
2004 add_token_u8(&err, dev, OPAL_STARTLIST);
2005 add_token_u8(&err, dev, OPAL_STARTNAME);
2006 add_token_u8(&err, dev, OPAL_PIN);
2007 add_token_bytestring(&err, dev, key, key_len);
2008 add_token_u8(&err, dev, OPAL_ENDNAME);
2009 add_token_u8(&err, dev, OPAL_ENDLIST);
2010 add_token_u8(&err, dev, OPAL_ENDNAME);
2011
2012 return err;
2013}
2014
2015static int set_new_pw(struct opal_dev *dev, void *data)
2016{
2017 u8 cpin_uid[OPAL_UID_LENGTH];
2018 struct opal_session_info *usr = data;
2019
2020 memcpy(cpin_uid, opaluid[OPAL_C_PIN_ADMIN1], OPAL_UID_LENGTH);
2021
2022 if (usr->who != OPAL_ADMIN1) {
2023 cpin_uid[5] = 0x03;
2024 if (usr->sum)
2025 cpin_uid[7] = usr->opal_key.lr + 1;
2026 else
2027 cpin_uid[7] = usr->who;
2028 }
2029
2030 if (generic_pw_cmd(usr->opal_key.key, usr->opal_key.key_len,
2031 cpin_uid, dev)) {
2032 pr_debug("Error building set password command.\n");
2033 return -ERANGE;
2034 }
2035
2036 return finalize_and_send(dev, parse_and_check_status);
2037}
2038
2039static int set_sid_cpin_pin(struct opal_dev *dev, void *data)
2040{
2041 u8 cpin_uid[OPAL_UID_LENGTH];
2042 struct opal_key *key = data;
2043
2044 memcpy(cpin_uid, opaluid[OPAL_C_PIN_SID], OPAL_UID_LENGTH);
2045
2046 if (generic_pw_cmd(key->key, key->key_len, cpin_uid, dev)) {
2047 pr_debug("Error building Set SID cpin\n");
2048 return -ERANGE;
2049 }
2050 return finalize_and_send(dev, parse_and_check_status);
2051}
2052
2053static void add_authority_object_ref(int *err,
2054 struct opal_dev *dev,
2055 const u8 *uid,
2056 size_t uid_len)
2057{
2058 add_token_u8(err, dev, OPAL_STARTNAME);
2059 add_token_bytestring(err, dev,
2060 opaluid[OPAL_HALF_UID_AUTHORITY_OBJ_REF],
2061 OPAL_UID_LENGTH/2);
2062 add_token_bytestring(err, dev, uid, uid_len);
2063 add_token_u8(err, dev, OPAL_ENDNAME);
2064}
2065
2066static void add_boolean_object_ref(int *err,
2067 struct opal_dev *dev,
2068 u8 boolean_op)
2069{
2070 add_token_u8(err, dev, OPAL_STARTNAME);
2071 add_token_bytestring(err, dev, opaluid[OPAL_HALF_UID_BOOLEAN_ACE],
2072 OPAL_UID_LENGTH/2);
2073 add_token_u8(err, dev, boolean_op);
2074 add_token_u8(err, dev, OPAL_ENDNAME);
2075}
2076
2077static int set_lr_boolean_ace(struct opal_dev *dev,
2078 unsigned int opal_uid,
2079 u8 lr,
2080 const u8 *users,
2081 size_t users_len)
2082{
2083 u8 lr_buffer[OPAL_UID_LENGTH];
2084 u8 user_uid[OPAL_UID_LENGTH];
2085 u8 u;
2086 int err;
2087
2088 memcpy(lr_buffer, opaluid[opal_uid], OPAL_UID_LENGTH);
2089 lr_buffer[7] = lr;
2090
2091 err = cmd_start(dev, lr_buffer, opalmethod[OPAL_SET]);
2092
2093 add_token_u8(&err, dev, OPAL_STARTNAME);
2094 add_token_u8(&err, dev, OPAL_VALUES);
2095
2096 add_token_u8(&err, dev, OPAL_STARTLIST);
2097 add_token_u8(&err, dev, OPAL_STARTNAME);
2098 add_token_u8(&err, dev, 3);
2099
2100 add_token_u8(&err, dev, OPAL_STARTLIST);
2101
2102 for (u = 0; u < users_len; u++) {
2103 if (users[u] == OPAL_ADMIN1)
2104 memcpy(user_uid, opaluid[OPAL_ADMIN1_UID],
2105 OPAL_UID_LENGTH);
2106 else {
2107 memcpy(user_uid, opaluid[OPAL_USER1_UID],
2108 OPAL_UID_LENGTH);
2109 user_uid[7] = users[u];
2110 }
2111
2112 add_authority_object_ref(&err, dev, user_uid, sizeof(user_uid));
2113
2114 /*
2115 * Add boolean operator in postfix only with
2116 * two or more authorities being added in ACE
2117 * expresion.
2118 * */
2119 if (u > 0)
2120 add_boolean_object_ref(&err, dev, OPAL_BOOLEAN_OR);
2121 }
2122
2123 add_token_u8(&err, dev, OPAL_ENDLIST);
2124 add_token_u8(&err, dev, OPAL_ENDNAME);
2125 add_token_u8(&err, dev, OPAL_ENDLIST);
2126 add_token_u8(&err, dev, OPAL_ENDNAME);
2127
2128 return err;
2129}
2130
2131static int add_user_to_lr(struct opal_dev *dev, void *data)
2132{
2133 int err;
2134 struct opal_lock_unlock *lkul = data;
2135 const u8 users[] = {
2136 lkul->session.who
2137 };
2138
2139 err = set_lr_boolean_ace(dev,
2140 lkul->l_state == OPAL_RW ?
2141 OPAL_LOCKINGRANGE_ACE_WRLOCKED :
2142 OPAL_LOCKINGRANGE_ACE_RDLOCKED,
2143 lkul->session.opal_key.lr, users,
2144 ARRAY_SIZE(users));
2145 if (err) {
2146 pr_debug("Error building add user to locking range command.\n");
2147 return err;
2148 }
2149
2150 return finalize_and_send(dev, parse_and_check_status);
2151}
2152
2153static int add_user_to_lr_ace(struct opal_dev *dev, void *data)
2154{
2155 int err;
2156 struct opal_lock_unlock *lkul = data;
2157 const u8 users[] = {
2158 OPAL_ADMIN1,
2159 lkul->session.who
2160 };
2161
2162 err = set_lr_boolean_ace(dev, OPAL_LOCKINGRANGE_ACE_START_TO_KEY,
2163 lkul->session.opal_key.lr, users,
2164 ARRAY_SIZE(users));
2165
2166 if (err) {
2167 pr_debug("Error building add user to locking ranges ACEs.\n");
2168 return err;
2169 }
2170
2171 return finalize_and_send(dev, parse_and_check_status);
2172}
2173
2174static int lock_unlock_locking_range(struct opal_dev *dev, void *data)
2175{
2176 u8 lr_buffer[OPAL_UID_LENGTH];
2177 struct opal_lock_unlock *lkul = data;
2178 u8 read_locked = 1, write_locked = 1;
2179 int err;
2180
2181 if (build_locking_range(lr_buffer, sizeof(lr_buffer),
2182 lkul->session.opal_key.lr) < 0)
2183 return -ERANGE;
2184
2185 switch (lkul->l_state) {
2186 case OPAL_RO:
2187 read_locked = 0;
2188 write_locked = 1;
2189 break;
2190 case OPAL_RW:
2191 read_locked = 0;
2192 write_locked = 0;
2193 break;
2194 case OPAL_LK:
2195 /* vars are initialized to locked */
2196 break;
2197 default:
2198 pr_debug("Tried to set an invalid locking state... returning to uland\n");
2199 return OPAL_INVAL_PARAM;
2200 }
2201
2202 err = cmd_start(dev, lr_buffer, opalmethod[OPAL_SET]);
2203
2204 add_token_u8(&err, dev, OPAL_STARTNAME);
2205 add_token_u8(&err, dev, OPAL_VALUES);
2206 add_token_u8(&err, dev, OPAL_STARTLIST);
2207
2208 add_token_u8(&err, dev, OPAL_STARTNAME);
2209 add_token_u8(&err, dev, OPAL_READLOCKED);
2210 add_token_u8(&err, dev, read_locked);
2211 add_token_u8(&err, dev, OPAL_ENDNAME);
2212
2213 add_token_u8(&err, dev, OPAL_STARTNAME);
2214 add_token_u8(&err, dev, OPAL_WRITELOCKED);
2215 add_token_u8(&err, dev, write_locked);
2216 add_token_u8(&err, dev, OPAL_ENDNAME);
2217
2218 add_token_u8(&err, dev, OPAL_ENDLIST);
2219 add_token_u8(&err, dev, OPAL_ENDNAME);
2220
2221 if (err) {
2222 pr_debug("Error building SET command.\n");
2223 return err;
2224 }
2225
2226 return finalize_and_send(dev, parse_and_check_status);
2227}
2228
2229
2230static int lock_unlock_locking_range_sum(struct opal_dev *dev, void *data)
2231{
2232 u8 lr_buffer[OPAL_UID_LENGTH];
2233 u8 read_locked = 1, write_locked = 1;
2234 struct opal_lock_unlock *lkul = data;
2235 int ret;
2236
2237 clear_opal_cmd(dev);
2238 set_comid(dev, dev->comid);
2239
2240 if (build_locking_range(lr_buffer, sizeof(lr_buffer),
2241 lkul->session.opal_key.lr) < 0)
2242 return -ERANGE;
2243
2244 switch (lkul->l_state) {
2245 case OPAL_RO:
2246 read_locked = 0;
2247 write_locked = 1;
2248 break;
2249 case OPAL_RW:
2250 read_locked = 0;
2251 write_locked = 0;
2252 break;
2253 case OPAL_LK:
2254 /* vars are initialized to locked */
2255 break;
2256 default:
2257 pr_debug("Tried to set an invalid locking state.\n");
2258 return OPAL_INVAL_PARAM;
2259 }
2260 ret = generic_lr_enable_disable(dev, lr_buffer, 1, 1,
2261 read_locked, write_locked);
2262
2263 if (ret < 0) {
2264 pr_debug("Error building SET command.\n");
2265 return ret;
2266 }
2267
2268 return finalize_and_send(dev, parse_and_check_status);
2269}
2270
2271static int activate_lsp(struct opal_dev *dev, void *data)
2272{
2273 struct opal_lr_act *opal_act = data;
2274 u8 user_lr[OPAL_UID_LENGTH];
2275 int err, i;
2276
2277 err = cmd_start(dev, opaluid[OPAL_LOCKINGSP_UID],
2278 opalmethod[OPAL_ACTIVATE]);
2279
2280 if (opal_act->sum) {
2281 err = build_locking_range(user_lr, sizeof(user_lr),
2282 opal_act->lr[0]);
2283 if (err)
2284 return err;
2285
2286 add_token_u8(&err, dev, OPAL_STARTNAME);
2287 add_token_u64(&err, dev, OPAL_SUM_SET_LIST);
2288
2289 add_token_u8(&err, dev, OPAL_STARTLIST);
2290 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH);
2291 for (i = 1; i < opal_act->num_lrs; i++) {
2292 user_lr[7] = opal_act->lr[i];
2293 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH);
2294 }
2295 add_token_u8(&err, dev, OPAL_ENDLIST);
2296 add_token_u8(&err, dev, OPAL_ENDNAME);
2297 }
2298
2299 if (err) {
2300 pr_debug("Error building Activate LockingSP command.\n");
2301 return err;
2302 }
2303
2304 return finalize_and_send(dev, parse_and_check_status);
2305}
2306
2307static int reactivate_lsp(struct opal_dev *dev, void *data)
2308{
2309 struct opal_lr_react *opal_react = data;
2310 u8 user_lr[OPAL_UID_LENGTH];
2311 int err, i;
2312
2313 err = cmd_start(dev, opaluid[OPAL_THISSP_UID],
2314 opalmethod[OPAL_REACTIVATE]);
2315
2316 if (err) {
2317 pr_debug("Error building Reactivate LockingSP command.\n");
2318 return err;
2319 }
2320
2321 /*
2322 * If neither 'entire_table' nor 'num_lrs' is set, the device
2323 * gets reactivated with SUM disabled. Only Admin1PIN will change
2324 * if set.
2325 */
2326 if (opal_react->entire_table) {
2327 /* Entire Locking table (all locking ranges) will be put in SUM. */
2328 add_token_u8(&err, dev, OPAL_STARTNAME);
2329 add_token_u64(&err, dev, OPAL_SUM_SET_LIST);
2330 add_token_bytestring(&err, dev, opaluid[OPAL_LOCKING_TABLE], OPAL_UID_LENGTH);
2331 add_token_u8(&err, dev, OPAL_ENDNAME);
2332 } else if (opal_react->num_lrs) {
2333 /* Subset of Locking table (selected locking range(s)) to be put in SUM */
2334 err = build_locking_range(user_lr, sizeof(user_lr),
2335 opal_react->lr[0]);
2336 if (err)
2337 return err;
2338
2339 add_token_u8(&err, dev, OPAL_STARTNAME);
2340 add_token_u64(&err, dev, OPAL_SUM_SET_LIST);
2341
2342 add_token_u8(&err, dev, OPAL_STARTLIST);
2343 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH);
2344 for (i = 1; i < opal_react->num_lrs; i++) {
2345 user_lr[7] = opal_react->lr[i];
2346 add_token_bytestring(&err, dev, user_lr, OPAL_UID_LENGTH);
2347 }
2348 add_token_u8(&err, dev, OPAL_ENDLIST);
2349 add_token_u8(&err, dev, OPAL_ENDNAME);
2350 }
2351
2352 /* Skipping the rangle policy parameter is same as setting its value to zero */
2353 if (opal_react->range_policy && (opal_react->num_lrs || opal_react->entire_table)) {
2354 add_token_u8(&err, dev, OPAL_STARTNAME);
2355 add_token_u64(&err, dev, OPAL_SUM_RANGE_POLICY);
2356 add_token_u8(&err, dev, 1);
2357 add_token_u8(&err, dev, OPAL_ENDNAME);
2358 }
2359
2360 /*
2361 * Optional parameter. If set, it changes the Admin1 PIN even when SUM
2362 * is being disabled.
2363 */
2364 if (opal_react->new_admin_key.key_len) {
2365 add_token_u8(&err, dev, OPAL_STARTNAME);
2366 add_token_u64(&err, dev, OPAL_SUM_ADMIN1_PIN);
2367 add_token_bytestring(&err, dev, opal_react->new_admin_key.key,
2368 opal_react->new_admin_key.key_len);
2369 add_token_u8(&err, dev, OPAL_ENDNAME);
2370 }
2371
2372 return finalize_and_send(dev, parse_and_check_status);
2373}
2374
2375/* Determine if we're in the Manufactured Inactive or Active state */
2376static int get_lsp_lifecycle(struct opal_dev *dev, void *data)
2377{
2378 u8 lc_status;
2379 int err;
2380
2381 err = generic_get_column(dev, opaluid[OPAL_LOCKINGSP_UID],
2382 OPAL_LIFECYCLE);
2383 if (err)
2384 return err;
2385
2386 lc_status = response_get_u64(&dev->parsed, 4);
2387 /* 0x08 is Manufactured Inactive */
2388 /* 0x09 is Manufactured */
2389 if (lc_status != OPAL_MANUFACTURED_INACTIVE) {
2390 pr_debug("Couldn't determine the status of the Lifecycle state\n");
2391 return -ENODEV;
2392 }
2393
2394 return 0;
2395}
2396
2397static int get_msid_cpin_pin(struct opal_dev *dev, void *data)
2398{
2399 const char *msid_pin;
2400 size_t strlen;
2401 int err;
2402
2403 err = generic_get_column(dev, opaluid[OPAL_C_PIN_MSID], OPAL_PIN);
2404 if (err)
2405 return err;
2406
2407 strlen = response_get_string(&dev->parsed, 4, &msid_pin);
2408 if (!msid_pin) {
2409 pr_debug("Couldn't extract MSID_CPIN from response\n");
2410 return OPAL_INVAL_PARAM;
2411 }
2412
2413 dev->prev_data = kmemdup(msid_pin, strlen, GFP_KERNEL);
2414 if (!dev->prev_data)
2415 return -ENOMEM;
2416
2417 dev->prev_d_len = strlen;
2418
2419 return 0;
2420}
2421
2422static int write_table_data(struct opal_dev *dev, void *data)
2423{
2424 struct opal_read_write_table *write_tbl = data;
2425
2426 return generic_table_write_data(dev, write_tbl->data, write_tbl->offset,
2427 write_tbl->size, write_tbl->table_uid);
2428}
2429
2430static int read_table_data_cont(struct opal_dev *dev)
2431{
2432 int err;
2433 const char *data_read;
2434
2435 err = parse_and_check_status(dev);
2436 if (err)
2437 return err;
2438
2439 dev->prev_d_len = response_get_string(&dev->parsed, 1, &data_read);
2440 dev->prev_data = (void *)data_read;
2441 if (!dev->prev_data) {
2442 pr_debug("%s: Couldn't read data from the table.\n", __func__);
2443 return OPAL_INVAL_PARAM;
2444 }
2445
2446 return 0;
2447}
2448
2449/*
2450 * IO_BUFFER_LENGTH = 2048
2451 * sizeof(header) = 56
2452 * No. of Token Bytes in the Response = 11
2453 * MAX size of data that can be carried in response buffer
2454 * at a time is : 2048 - (56 + 11) = 1981 = 0x7BD.
2455 */
2456#define OPAL_MAX_READ_TABLE (0x7BD)
2457
2458static int read_table_data(struct opal_dev *dev, void *data)
2459{
2460 struct opal_read_write_table *read_tbl = data;
2461 int err;
2462 size_t off = 0, max_read_size = OPAL_MAX_READ_TABLE;
2463 u64 table_len, len;
2464 u64 offset = read_tbl->offset, read_size = read_tbl->size - 1;
2465 u8 __user *dst;
2466
2467 err = generic_get_table_info(dev, read_tbl->table_uid, OPAL_TABLE_ROWS);
2468 if (err) {
2469 pr_debug("Couldn't get the table size\n");
2470 return err;
2471 }
2472
2473 table_len = response_get_u64(&dev->parsed, 4);
2474
2475 /* Check if the user is trying to read from the table limits */
2476 if (read_size > table_len || offset > table_len - read_size) {
2477 pr_debug("Read size exceeds the Table size limits (%llu vs. %llu)\n",
2478 offset + read_size, table_len);
2479 return -EINVAL;
2480 }
2481
2482 while (off < read_size) {
2483 err = cmd_start(dev, read_tbl->table_uid, opalmethod[OPAL_GET]);
2484
2485 add_token_u8(&err, dev, OPAL_STARTLIST);
2486 add_token_u8(&err, dev, OPAL_STARTNAME);
2487 add_token_u8(&err, dev, OPAL_STARTROW);
2488 add_token_u64(&err, dev, offset + off); /* start row value */
2489 add_token_u8(&err, dev, OPAL_ENDNAME);
2490
2491 add_token_u8(&err, dev, OPAL_STARTNAME);
2492 add_token_u8(&err, dev, OPAL_ENDROW);
2493
2494 len = min(max_read_size, (size_t)(read_size - off));
2495 add_token_u64(&err, dev, offset + off + len); /* end row value
2496 */
2497 add_token_u8(&err, dev, OPAL_ENDNAME);
2498 add_token_u8(&err, dev, OPAL_ENDLIST);
2499
2500 if (err) {
2501 pr_debug("Error building read table data command.\n");
2502 break;
2503 }
2504
2505 err = finalize_and_send(dev, read_table_data_cont);
2506 if (err)
2507 break;
2508
2509 /* len+1: This includes the NULL terminator at the end*/
2510 if (dev->prev_d_len > len + 1) {
2511 err = -EOVERFLOW;
2512 break;
2513 }
2514
2515 dst = (u8 __user *)(uintptr_t)read_tbl->data;
2516 if (copy_to_user(dst + off, dev->prev_data, dev->prev_d_len)) {
2517 pr_debug("Error copying data to userspace\n");
2518 err = -EFAULT;
2519 break;
2520 }
2521 dev->prev_data = NULL;
2522
2523 off += len;
2524 }
2525
2526 return err;
2527}
2528
2529static int end_opal_session(struct opal_dev *dev, void *data)
2530{
2531 int err = 0;
2532
2533 clear_opal_cmd(dev);
2534 set_comid(dev, dev->comid);
2535 add_token_u8(&err, dev, OPAL_ENDOFSESSION);
2536
2537 if (err < 0)
2538 return err;
2539
2540 return finalize_and_send(dev, end_session_cont);
2541}
2542
2543static int end_opal_session_error(struct opal_dev *dev)
2544{
2545 const struct opal_step error_end_session = {
2546 end_opal_session,
2547 };
2548
2549 return execute_step(dev, &error_end_session, 0);
2550}
2551
2552static inline void setup_opal_dev(struct opal_dev *dev)
2553{
2554 dev->tsn = 0;
2555 dev->hsn = 0;
2556 dev->prev_data = NULL;
2557}
2558
2559static int check_opal_support(struct opal_dev *dev)
2560{
2561 int ret;
2562
2563 mutex_lock(&dev->dev_lock);
2564 setup_opal_dev(dev);
2565 ret = opal_discovery0_step(dev);
2566 if (!ret)
2567 dev->flags |= OPAL_FL_SUPPORTED;
2568 mutex_unlock(&dev->dev_lock);
2569
2570 return ret;
2571}
2572
2573static void clean_opal_dev(struct opal_dev *dev)
2574{
2575
2576 struct opal_suspend_data *suspend, *next;
2577
2578 mutex_lock(&dev->dev_lock);
2579 list_for_each_entry_safe(suspend, next, &dev->unlk_lst, node) {
2580 list_del(&suspend->node);
2581 kfree(suspend);
2582 }
2583 mutex_unlock(&dev->dev_lock);
2584}
2585
2586void free_opal_dev(struct opal_dev *dev)
2587{
2588 if (!dev)
2589 return;
2590
2591 clean_opal_dev(dev);
2592 kfree(dev->resp);
2593 kfree(dev->cmd);
2594 kfree(dev);
2595}
2596EXPORT_SYMBOL(free_opal_dev);
2597
2598struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
2599{
2600 struct opal_dev *dev;
2601
2602 dev = kmalloc_obj(*dev);
2603 if (!dev)
2604 return NULL;
2605
2606 /*
2607 * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes
2608 * sure the allocated buffer is DMA-safe in that regard.
2609 */
2610 dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
2611 if (!dev->cmd)
2612 goto err_free_dev;
2613
2614 dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
2615 if (!dev->resp)
2616 goto err_free_cmd;
2617
2618 INIT_LIST_HEAD(&dev->unlk_lst);
2619 mutex_init(&dev->dev_lock);
2620 dev->flags = 0;
2621 dev->data = data;
2622 dev->send_recv = send_recv;
2623 if (check_opal_support(dev) != 0) {
2624 pr_debug("Opal is not supported on this device\n");
2625 goto err_free_resp;
2626 }
2627
2628 return dev;
2629
2630err_free_resp:
2631 kfree(dev->resp);
2632
2633err_free_cmd:
2634 kfree(dev->cmd);
2635
2636err_free_dev:
2637 kfree(dev);
2638
2639 return NULL;
2640}
2641EXPORT_SYMBOL(init_opal_dev);
2642
2643static int opal_secure_erase_locking_range(struct opal_dev *dev,
2644 struct opal_session_info *opal_session)
2645{
2646 const struct opal_step erase_steps[] = {
2647 { start_auth_opal_session, opal_session },
2648 { get_active_key, &opal_session->opal_key.lr },
2649 { gen_key, },
2650 { end_opal_session, }
2651 };
2652 int ret;
2653
2654 ret = opal_get_key(dev, &opal_session->opal_key);
2655 if (ret)
2656 return ret;
2657 mutex_lock(&dev->dev_lock);
2658 setup_opal_dev(dev);
2659 ret = execute_steps(dev, erase_steps, ARRAY_SIZE(erase_steps));
2660 mutex_unlock(&dev->dev_lock);
2661
2662 return ret;
2663}
2664
2665static int opal_get_discv(struct opal_dev *dev, struct opal_discovery *discv)
2666{
2667 const struct opal_step discovery0_step = {
2668 opal_discovery0, discv
2669 };
2670 int ret;
2671
2672 mutex_lock(&dev->dev_lock);
2673 setup_opal_dev(dev);
2674 ret = execute_step(dev, &discovery0_step, 0);
2675 mutex_unlock(&dev->dev_lock);
2676 if (ret)
2677 return ret;
2678 return discv->size; /* modified to actual length of data */
2679}
2680
2681static int opal_revertlsp(struct opal_dev *dev, struct opal_revert_lsp *rev)
2682{
2683 /* controller will terminate session */
2684 const struct opal_step steps[] = {
2685 { start_admin1LSP_opal_session, &rev->key },
2686 { revert_lsp, rev }
2687 };
2688 int ret;
2689
2690 ret = opal_get_key(dev, &rev->key);
2691 if (ret)
2692 return ret;
2693 mutex_lock(&dev->dev_lock);
2694 setup_opal_dev(dev);
2695 ret = execute_steps(dev, steps, ARRAY_SIZE(steps));
2696 mutex_unlock(&dev->dev_lock);
2697
2698 return ret;
2699}
2700
2701static int opal_erase_locking_range(struct opal_dev *dev,
2702 struct opal_session_info *opal_session)
2703{
2704 const struct opal_step erase_steps[] = {
2705 { start_auth_opal_session, opal_session },
2706 { erase_locking_range, opal_session },
2707 { end_opal_session, }
2708 };
2709 int ret;
2710
2711 ret = opal_get_key(dev, &opal_session->opal_key);
2712 if (ret)
2713 return ret;
2714 mutex_lock(&dev->dev_lock);
2715 setup_opal_dev(dev);
2716 ret = execute_steps(dev, erase_steps, ARRAY_SIZE(erase_steps));
2717 mutex_unlock(&dev->dev_lock);
2718
2719 return ret;
2720}
2721
2722static int opal_enable_disable_shadow_mbr(struct opal_dev *dev,
2723 struct opal_mbr_data *opal_mbr)
2724{
2725 u8 enable_disable = opal_mbr->enable_disable == OPAL_MBR_ENABLE ?
2726 OPAL_TRUE : OPAL_FALSE;
2727
2728 const struct opal_step mbr_steps[] = {
2729 { start_admin1LSP_opal_session, &opal_mbr->key },
2730 { set_mbr_done, &enable_disable },
2731 { end_opal_session, },
2732 { start_admin1LSP_opal_session, &opal_mbr->key },
2733 { set_mbr_enable_disable, &enable_disable },
2734 { end_opal_session, }
2735 };
2736 int ret;
2737
2738 if (opal_mbr->enable_disable != OPAL_MBR_ENABLE &&
2739 opal_mbr->enable_disable != OPAL_MBR_DISABLE)
2740 return -EINVAL;
2741
2742 ret = opal_get_key(dev, &opal_mbr->key);
2743 if (ret)
2744 return ret;
2745 mutex_lock(&dev->dev_lock);
2746 setup_opal_dev(dev);
2747 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps));
2748 mutex_unlock(&dev->dev_lock);
2749
2750 return ret;
2751}
2752
2753static int opal_set_mbr_done(struct opal_dev *dev,
2754 struct opal_mbr_done *mbr_done)
2755{
2756 u8 mbr_done_tf = mbr_done->done_flag == OPAL_MBR_DONE ?
2757 OPAL_TRUE : OPAL_FALSE;
2758
2759 const struct opal_step mbr_steps[] = {
2760 { start_admin1LSP_opal_session, &mbr_done->key },
2761 { set_mbr_done, &mbr_done_tf },
2762 { end_opal_session, }
2763 };
2764 int ret;
2765
2766 if (mbr_done->done_flag != OPAL_MBR_DONE &&
2767 mbr_done->done_flag != OPAL_MBR_NOT_DONE)
2768 return -EINVAL;
2769
2770 ret = opal_get_key(dev, &mbr_done->key);
2771 if (ret)
2772 return ret;
2773 mutex_lock(&dev->dev_lock);
2774 setup_opal_dev(dev);
2775 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps));
2776 mutex_unlock(&dev->dev_lock);
2777
2778 return ret;
2779}
2780
2781static int opal_write_shadow_mbr(struct opal_dev *dev,
2782 struct opal_shadow_mbr *info)
2783{
2784 const struct opal_step mbr_steps[] = {
2785 { start_admin1LSP_opal_session, &info->key },
2786 { write_shadow_mbr, info },
2787 { end_opal_session, }
2788 };
2789 int ret;
2790
2791 if (info->size == 0)
2792 return 0;
2793
2794 ret = opal_get_key(dev, &info->key);
2795 if (ret)
2796 return ret;
2797 mutex_lock(&dev->dev_lock);
2798 setup_opal_dev(dev);
2799 ret = execute_steps(dev, mbr_steps, ARRAY_SIZE(mbr_steps));
2800 mutex_unlock(&dev->dev_lock);
2801
2802 return ret;
2803}
2804
2805static int opal_save(struct opal_dev *dev, struct opal_lock_unlock *lk_unlk)
2806{
2807 struct opal_suspend_data *suspend;
2808
2809 suspend = kzalloc_obj(*suspend);
2810 if (!suspend)
2811 return -ENOMEM;
2812
2813 suspend->unlk = *lk_unlk;
2814 suspend->lr = lk_unlk->session.opal_key.lr;
2815
2816 mutex_lock(&dev->dev_lock);
2817 setup_opal_dev(dev);
2818 add_suspend_info(dev, suspend);
2819 mutex_unlock(&dev->dev_lock);
2820
2821 return 0;
2822}
2823
2824static int opal_add_user_to_lr(struct opal_dev *dev,
2825 struct opal_lock_unlock *lk_unlk)
2826{
2827 const struct opal_step steps[] = {
2828 { start_admin1LSP_opal_session, &lk_unlk->session.opal_key },
2829 { add_user_to_lr, lk_unlk },
2830 { add_user_to_lr_ace, lk_unlk },
2831 { end_opal_session, }
2832 };
2833 int ret;
2834
2835 if (lk_unlk->l_state != OPAL_RO &&
2836 lk_unlk->l_state != OPAL_RW) {
2837 pr_debug("Locking state was not RO or RW\n");
2838 return -EINVAL;
2839 }
2840
2841 if (lk_unlk->session.who < OPAL_USER1 ||
2842 lk_unlk->session.who > OPAL_USER9) {
2843 pr_debug("Authority was not within the range of users: %d\n",
2844 lk_unlk->session.who);
2845 return -EINVAL;
2846 }
2847
2848 if (lk_unlk->session.sum) {
2849 pr_debug("%s not supported in sum. Use setup locking range\n",
2850 __func__);
2851 return -EINVAL;
2852 }
2853
2854 ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2855 if (ret)
2856 return ret;
2857 mutex_lock(&dev->dev_lock);
2858 setup_opal_dev(dev);
2859 ret = execute_steps(dev, steps, ARRAY_SIZE(steps));
2860 mutex_unlock(&dev->dev_lock);
2861
2862 return ret;
2863}
2864
2865static int opal_reverttper(struct opal_dev *dev, struct opal_key *opal, bool psid)
2866{
2867 /* controller will terminate session */
2868 const struct opal_step revert_steps[] = {
2869 { start_SIDASP_opal_session, opal },
2870 { revert_tper, }
2871 };
2872 const struct opal_step psid_revert_steps[] = {
2873 { start_PSID_opal_session, opal },
2874 { revert_tper, }
2875 };
2876
2877 int ret;
2878
2879 ret = opal_get_key(dev, opal);
2880
2881 if (ret)
2882 return ret;
2883 mutex_lock(&dev->dev_lock);
2884 setup_opal_dev(dev);
2885 if (psid)
2886 ret = execute_steps(dev, psid_revert_steps,
2887 ARRAY_SIZE(psid_revert_steps));
2888 else
2889 ret = execute_steps(dev, revert_steps,
2890 ARRAY_SIZE(revert_steps));
2891 mutex_unlock(&dev->dev_lock);
2892
2893 /*
2894 * If we successfully reverted lets clean
2895 * any saved locking ranges.
2896 */
2897 if (!ret)
2898 clean_opal_dev(dev);
2899
2900 return ret;
2901}
2902
2903static int __opal_lock_unlock(struct opal_dev *dev,
2904 struct opal_lock_unlock *lk_unlk)
2905{
2906 const struct opal_step unlock_steps[] = {
2907 { start_auth_opal_session, &lk_unlk->session },
2908 { lock_unlock_locking_range, lk_unlk },
2909 { end_opal_session, }
2910 };
2911 const struct opal_step unlock_sum_steps[] = {
2912 { start_auth_opal_session, &lk_unlk->session },
2913 { lock_unlock_locking_range_sum, lk_unlk },
2914 { end_opal_session, }
2915 };
2916
2917 if (lk_unlk->session.sum)
2918 return execute_steps(dev, unlock_sum_steps,
2919 ARRAY_SIZE(unlock_sum_steps));
2920 else
2921 return execute_steps(dev, unlock_steps,
2922 ARRAY_SIZE(unlock_steps));
2923}
2924
2925static int __opal_set_mbr_done(struct opal_dev *dev, struct opal_key *key)
2926{
2927 u8 mbr_done_tf = OPAL_TRUE;
2928 const struct opal_step mbrdone_step[] = {
2929 { start_admin1LSP_opal_session, key },
2930 { set_mbr_done, &mbr_done_tf },
2931 { end_opal_session, }
2932 };
2933
2934 return execute_steps(dev, mbrdone_step, ARRAY_SIZE(mbrdone_step));
2935}
2936
2937static void opal_lock_check_for_saved_key(struct opal_dev *dev,
2938 struct opal_lock_unlock *lk_unlk)
2939{
2940 struct opal_suspend_data *iter;
2941
2942 if (lk_unlk->l_state != OPAL_LK ||
2943 lk_unlk->session.opal_key.key_len > 0)
2944 return;
2945
2946 /*
2947 * Usually when closing a crypto device (eg: dm-crypt with LUKS) the
2948 * volume key is not required, as it requires root privileges anyway,
2949 * and root can deny access to a disk in many ways regardless.
2950 * Requiring the volume key to lock the device is a peculiarity of the
2951 * OPAL specification. Given we might already have saved the key if
2952 * the user requested it via the 'IOC_OPAL_SAVE' ioctl, we can use
2953 * that key to lock the device if no key was provided here, the
2954 * locking range matches and the appropriate flag was passed with
2955 * 'IOC_OPAL_SAVE'.
2956 * This allows integrating OPAL with tools and libraries that are used
2957 * to the common behaviour and do not ask for the volume key when
2958 * closing a device.
2959 */
2960 setup_opal_dev(dev);
2961 list_for_each_entry(iter, &dev->unlk_lst, node) {
2962 if ((iter->unlk.flags & OPAL_SAVE_FOR_LOCK) &&
2963 iter->lr == lk_unlk->session.opal_key.lr &&
2964 iter->unlk.session.opal_key.key_len > 0) {
2965 lk_unlk->session.opal_key.key_len =
2966 iter->unlk.session.opal_key.key_len;
2967 memcpy(lk_unlk->session.opal_key.key,
2968 iter->unlk.session.opal_key.key,
2969 iter->unlk.session.opal_key.key_len);
2970 break;
2971 }
2972 }
2973}
2974
2975static int opal_lock_unlock(struct opal_dev *dev,
2976 struct opal_lock_unlock *lk_unlk)
2977{
2978 int ret;
2979
2980 if (lk_unlk->session.who > OPAL_USER9)
2981 return -EINVAL;
2982
2983 mutex_lock(&dev->dev_lock);
2984 opal_lock_check_for_saved_key(dev, lk_unlk);
2985 ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2986 if (!ret)
2987 ret = __opal_lock_unlock(dev, lk_unlk);
2988 mutex_unlock(&dev->dev_lock);
2989
2990 return ret;
2991}
2992
2993static int opal_take_ownership(struct opal_dev *dev, struct opal_key *opal)
2994{
2995 const struct opal_step owner_steps[] = {
2996 { start_anybodyASP_opal_session, },
2997 { get_msid_cpin_pin, },
2998 { end_opal_session, },
2999 { start_SIDASP_opal_session, opal },
3000 { set_sid_cpin_pin, opal },
3001 { end_opal_session, }
3002 };
3003 int ret;
3004
3005 if (!dev)
3006 return -ENODEV;
3007
3008 ret = opal_get_key(dev, opal);
3009 if (ret)
3010 return ret;
3011 mutex_lock(&dev->dev_lock);
3012 setup_opal_dev(dev);
3013 ret = execute_steps(dev, owner_steps, ARRAY_SIZE(owner_steps));
3014 mutex_unlock(&dev->dev_lock);
3015
3016 return ret;
3017}
3018
3019static int opal_activate_lsp(struct opal_dev *dev,
3020 struct opal_lr_act *opal_lr_act)
3021{
3022 const struct opal_step active_steps[] = {
3023 { start_SIDASP_opal_session, &opal_lr_act->key },
3024 { get_lsp_lifecycle, },
3025 { activate_lsp, opal_lr_act },
3026 { end_opal_session, }
3027 };
3028 int ret;
3029
3030 if (opal_lr_act->sum &&
3031 (!opal_lr_act->num_lrs || opal_lr_act->num_lrs > OPAL_MAX_LRS))
3032 return -EINVAL;
3033
3034 ret = opal_get_key(dev, &opal_lr_act->key);
3035 if (ret)
3036 return ret;
3037 mutex_lock(&dev->dev_lock);
3038 setup_opal_dev(dev);
3039 ret = execute_steps(dev, active_steps, ARRAY_SIZE(active_steps));
3040 mutex_unlock(&dev->dev_lock);
3041
3042 return ret;
3043}
3044
3045static int opal_reactivate_lsp(struct opal_dev *dev,
3046 struct opal_lr_react *opal_lr_react)
3047{
3048 const struct opal_step active_steps[] = {
3049 { start_admin1LSP_opal_session, &opal_lr_react->key },
3050 { reactivate_lsp, opal_lr_react },
3051 /* No end_opal_session. The controller terminates the session */
3052 };
3053 int ret;
3054
3055 /* use either 'entire_table' parameter or set of locking ranges */
3056 if (opal_lr_react->num_lrs > OPAL_MAX_LRS ||
3057 (opal_lr_react->num_lrs && opal_lr_react->entire_table))
3058 return -EINVAL;
3059
3060 ret = opal_get_key(dev, &opal_lr_react->key);
3061 if (ret)
3062 return ret;
3063 mutex_lock(&dev->dev_lock);
3064 setup_opal_dev(dev);
3065 ret = execute_steps(dev, active_steps, ARRAY_SIZE(active_steps));
3066 mutex_unlock(&dev->dev_lock);
3067
3068 return ret;
3069}
3070
3071static int opal_setup_locking_range(struct opal_dev *dev,
3072 struct opal_user_lr_setup *opal_lrs)
3073{
3074 const struct opal_step lr_steps[] = {
3075 { start_auth_opal_session, &opal_lrs->session },
3076 { setup_locking_range_start_length, opal_lrs },
3077 { setup_enable_range, opal_lrs },
3078 { end_opal_session, }
3079 }, lr_global_steps[] = {
3080 { start_auth_opal_session, &opal_lrs->session },
3081 { setup_enable_range, opal_lrs },
3082 { end_opal_session, }
3083 };
3084 int ret;
3085
3086 ret = opal_get_key(dev, &opal_lrs->session.opal_key);
3087 if (ret)
3088 return ret;
3089 mutex_lock(&dev->dev_lock);
3090 setup_opal_dev(dev);
3091 if (opal_lrs->session.opal_key.lr == 0)
3092 ret = execute_steps(dev, lr_global_steps, ARRAY_SIZE(lr_global_steps));
3093 else
3094 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps));
3095 mutex_unlock(&dev->dev_lock);
3096
3097 return ret;
3098}
3099
3100static int opal_setup_locking_range_start_length(struct opal_dev *dev,
3101 struct opal_user_lr_setup *opal_lrs)
3102{
3103 const struct opal_step lr_steps[] = {
3104 { start_auth_opal_session, &opal_lrs->session },
3105 { setup_locking_range_start_length, opal_lrs },
3106 { end_opal_session, }
3107 };
3108 int ret;
3109
3110 /* we can not set global locking range offset or length */
3111 if (opal_lrs->session.opal_key.lr == 0)
3112 return -EINVAL;
3113
3114 ret = opal_get_key(dev, &opal_lrs->session.opal_key);
3115 if (ret)
3116 return ret;
3117 mutex_lock(&dev->dev_lock);
3118 setup_opal_dev(dev);
3119 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps));
3120 mutex_unlock(&dev->dev_lock);
3121
3122 return ret;
3123}
3124
3125static int opal_enable_disable_range(struct opal_dev *dev,
3126 struct opal_user_lr_setup *opal_lrs)
3127{
3128 const struct opal_step lr_steps[] = {
3129 { start_auth_opal_session, &opal_lrs->session },
3130 { setup_enable_range, opal_lrs },
3131 { end_opal_session, }
3132 };
3133 int ret;
3134
3135 ret = opal_get_key(dev, &opal_lrs->session.opal_key);
3136 if (ret)
3137 return ret;
3138 mutex_lock(&dev->dev_lock);
3139 setup_opal_dev(dev);
3140 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps));
3141 mutex_unlock(&dev->dev_lock);
3142
3143 return ret;
3144}
3145
3146static int opal_locking_range_status(struct opal_dev *dev,
3147 struct opal_lr_status *opal_lrst,
3148 void __user *data)
3149{
3150 const struct opal_step lr_steps[] = {
3151 { start_auth_opal_session, &opal_lrst->session },
3152 { locking_range_status, opal_lrst },
3153 { end_opal_session, }
3154 };
3155 int ret;
3156
3157 mutex_lock(&dev->dev_lock);
3158 setup_opal_dev(dev);
3159 ret = execute_steps(dev, lr_steps, ARRAY_SIZE(lr_steps));
3160 mutex_unlock(&dev->dev_lock);
3161
3162 /* skip session info when copying back to uspace */
3163 if (!ret && copy_to_user(data + offsetof(struct opal_lr_status, range_start),
3164 (void *)opal_lrst + offsetof(struct opal_lr_status, range_start),
3165 sizeof(*opal_lrst) - offsetof(struct opal_lr_status, range_start))) {
3166 pr_debug("Error copying status to userspace\n");
3167 return -EFAULT;
3168 }
3169
3170 return ret;
3171}
3172
3173static int opal_set_new_pw(struct opal_dev *dev, struct opal_new_pw *opal_pw)
3174{
3175 const struct opal_step pw_steps[] = {
3176 { start_auth_opal_session, &opal_pw->session },
3177 { set_new_pw, &opal_pw->new_user_pw },
3178 { end_opal_session, }
3179 };
3180 int ret;
3181
3182 if (opal_pw->session.who > OPAL_USER9 ||
3183 opal_pw->new_user_pw.who > OPAL_USER9)
3184 return -EINVAL;
3185
3186 mutex_lock(&dev->dev_lock);
3187 setup_opal_dev(dev);
3188 ret = execute_steps(dev, pw_steps, ARRAY_SIZE(pw_steps));
3189 mutex_unlock(&dev->dev_lock);
3190
3191 if (ret)
3192 return ret;
3193
3194 /* update keyring and key store with new password */
3195 ret = sed_write_key(OPAL_AUTH_KEY,
3196 opal_pw->new_user_pw.opal_key.key,
3197 opal_pw->new_user_pw.opal_key.key_len);
3198 if (ret != -EOPNOTSUPP)
3199 pr_warn("error updating SED key: %d\n", ret);
3200
3201 ret = update_sed_opal_key(OPAL_AUTH_KEY,
3202 opal_pw->new_user_pw.opal_key.key,
3203 opal_pw->new_user_pw.opal_key.key_len);
3204
3205 return ret;
3206}
3207
3208static int opal_set_new_sid_pw(struct opal_dev *dev, struct opal_new_pw *opal_pw)
3209{
3210 int ret;
3211 struct opal_key *newkey = &opal_pw->new_user_pw.opal_key;
3212 struct opal_key *oldkey = &opal_pw->session.opal_key;
3213
3214 const struct opal_step pw_steps[] = {
3215 { start_SIDASP_opal_session, oldkey },
3216 { set_sid_cpin_pin, newkey },
3217 { end_opal_session, }
3218 };
3219
3220 if (!dev)
3221 return -ENODEV;
3222
3223 mutex_lock(&dev->dev_lock);
3224 setup_opal_dev(dev);
3225 ret = execute_steps(dev, pw_steps, ARRAY_SIZE(pw_steps));
3226 mutex_unlock(&dev->dev_lock);
3227
3228 return ret;
3229}
3230
3231static int opal_activate_user(struct opal_dev *dev,
3232 struct opal_session_info *opal_session)
3233{
3234 const struct opal_step act_steps[] = {
3235 { start_admin1LSP_opal_session, &opal_session->opal_key },
3236 { internal_activate_user, opal_session },
3237 { end_opal_session, }
3238 };
3239 int ret;
3240
3241 /* We can't activate Admin1 it's active as manufactured */
3242 if (opal_session->who < OPAL_USER1 ||
3243 opal_session->who > OPAL_USER9) {
3244 pr_debug("Who was not a valid user: %d\n", opal_session->who);
3245 return -EINVAL;
3246 }
3247
3248 ret = opal_get_key(dev, &opal_session->opal_key);
3249 if (ret)
3250 return ret;
3251 mutex_lock(&dev->dev_lock);
3252 setup_opal_dev(dev);
3253 ret = execute_steps(dev, act_steps, ARRAY_SIZE(act_steps));
3254 mutex_unlock(&dev->dev_lock);
3255
3256 return ret;
3257}
3258
3259bool opal_unlock_from_suspend(struct opal_dev *dev)
3260{
3261 struct opal_suspend_data *suspend;
3262 bool was_failure = false;
3263 int ret;
3264
3265 if (!dev)
3266 return false;
3267
3268 if (!(dev->flags & OPAL_FL_SUPPORTED))
3269 return false;
3270
3271 mutex_lock(&dev->dev_lock);
3272 setup_opal_dev(dev);
3273
3274 list_for_each_entry(suspend, &dev->unlk_lst, node) {
3275 dev->tsn = 0;
3276 dev->hsn = 0;
3277
3278 ret = __opal_lock_unlock(dev, &suspend->unlk);
3279 if (ret) {
3280 pr_debug("Failed to unlock LR %hhu with sum %d\n",
3281 suspend->unlk.session.opal_key.lr,
3282 suspend->unlk.session.sum);
3283 was_failure = true;
3284 }
3285
3286 if (dev->flags & OPAL_FL_MBR_ENABLED) {
3287 ret = __opal_set_mbr_done(dev, &suspend->unlk.session.opal_key);
3288 if (ret)
3289 pr_debug("Failed to set MBR Done in S3 resume\n");
3290 }
3291 }
3292 mutex_unlock(&dev->dev_lock);
3293
3294 return was_failure;
3295}
3296EXPORT_SYMBOL(opal_unlock_from_suspend);
3297
3298static int opal_read_table(struct opal_dev *dev,
3299 struct opal_read_write_table *rw_tbl)
3300{
3301 const struct opal_step read_table_steps[] = {
3302 { start_admin1LSP_opal_session, &rw_tbl->key },
3303 { read_table_data, rw_tbl },
3304 { end_opal_session, }
3305 };
3306
3307 if (!rw_tbl->size)
3308 return 0;
3309
3310 return execute_steps(dev, read_table_steps,
3311 ARRAY_SIZE(read_table_steps));
3312}
3313
3314static int opal_write_table(struct opal_dev *dev,
3315 struct opal_read_write_table *rw_tbl)
3316{
3317 const struct opal_step write_table_steps[] = {
3318 { start_admin1LSP_opal_session, &rw_tbl->key },
3319 { write_table_data, rw_tbl },
3320 { end_opal_session, }
3321 };
3322
3323 if (!rw_tbl->size)
3324 return 0;
3325
3326 return execute_steps(dev, write_table_steps,
3327 ARRAY_SIZE(write_table_steps));
3328}
3329
3330static int opal_generic_read_write_table(struct opal_dev *dev,
3331 struct opal_read_write_table *rw_tbl)
3332{
3333 int ret, bit_set;
3334
3335 ret = opal_get_key(dev, &rw_tbl->key);
3336 if (ret)
3337 return ret;
3338 mutex_lock(&dev->dev_lock);
3339 setup_opal_dev(dev);
3340
3341 bit_set = fls64(rw_tbl->flags) - 1;
3342 switch (bit_set) {
3343 case OPAL_READ_TABLE:
3344 ret = opal_read_table(dev, rw_tbl);
3345 break;
3346 case OPAL_WRITE_TABLE:
3347 ret = opal_write_table(dev, rw_tbl);
3348 break;
3349 default:
3350 pr_debug("Invalid bit set in the flag (%016llx).\n",
3351 rw_tbl->flags);
3352 ret = -EINVAL;
3353 break;
3354 }
3355
3356 mutex_unlock(&dev->dev_lock);
3357
3358 return ret;
3359}
3360
3361static int opal_get_status(struct opal_dev *dev, void __user *data)
3362{
3363 struct opal_status sts = {0};
3364
3365 /*
3366 * check_opal_support() error is not fatal,
3367 * !dev->supported is a valid condition
3368 */
3369 if (!check_opal_support(dev))
3370 sts.flags = dev->flags;
3371 if (copy_to_user(data, &sts, sizeof(sts))) {
3372 pr_debug("Error copying status to userspace\n");
3373 return -EFAULT;
3374 }
3375 return 0;
3376}
3377
3378static int opal_get_geometry(struct opal_dev *dev, void __user *data)
3379{
3380 struct opal_geometry geo = {0};
3381
3382 if (check_opal_support(dev))
3383 return -EINVAL;
3384
3385 geo.align = dev->align_required;
3386 geo.logical_block_size = dev->logical_block_size;
3387 geo.alignment_granularity = dev->align;
3388 geo.lowest_aligned_lba = dev->lowest_lba;
3389
3390 if (copy_to_user(data, &geo, sizeof(geo))) {
3391 pr_debug("Error copying geometry data to userspace\n");
3392 return -EFAULT;
3393 }
3394
3395 return 0;
3396}
3397
3398static int get_sum_ranges(struct opal_dev *dev, void *data)
3399{
3400 const char *lr_uid;
3401 size_t lr_uid_len;
3402 u64 val;
3403 const struct opal_resp_tok *tok;
3404 int err, tok_n = 2;
3405 struct opal_sum_ranges *sranges = data;
3406 const __u8 lr_all[OPAL_MAX_LRS] = { 0, 1, 2, 3, 4, 5, 6, 7, 8 };
3407
3408 err = generic_get_columns(dev, opaluid[OPAL_LOCKING_INFO_TABLE], OPAL_SUM_SET_LIST,
3409 OPAL_SUM_RANGE_POLICY);
3410 if (err) {
3411 pr_debug("Couldn't get locking info table columns %d to %d.\n",
3412 OPAL_SUM_SET_LIST, OPAL_SUM_RANGE_POLICY);
3413 return err;
3414 }
3415
3416 tok = response_get_token(&dev->parsed, tok_n);
3417 if (IS_ERR(tok))
3418 return PTR_ERR(tok);
3419
3420 if (!response_token_matches(tok, OPAL_STARTNAME)) {
3421 pr_debug("Unexpected response token type %d.\n", tok_n);
3422 return OPAL_INVAL_PARAM;
3423 }
3424 tok_n++;
3425
3426 if (response_get_u64(&dev->parsed, tok_n) != OPAL_SUM_SET_LIST) {
3427 pr_debug("Token %d does not match expected column %u.\n",
3428 tok_n, OPAL_SUM_SET_LIST);
3429 return OPAL_INVAL_PARAM;
3430 }
3431 tok_n++;
3432
3433 tok = response_get_token(&dev->parsed, tok_n);
3434 if (IS_ERR(tok))
3435 return PTR_ERR(tok);
3436
3437 /*
3438 * The OPAL_SUM_SET_LIST response contains two distinct values:
3439 *
3440 * - the list of individual locking ranges (UIDs) put in SUM. The list
3441 * may also be empty signaling the SUM is disabled.
3442 *
3443 * - the Locking table UID if the entire Locking table is put in SUM.
3444 */
3445 if (response_token_matches(tok, OPAL_STARTLIST)) {
3446 sranges->num_lrs = 0;
3447
3448 tok_n++;
3449 tok = response_get_token(&dev->parsed, tok_n);
3450 if (IS_ERR(tok))
3451 return PTR_ERR(tok);
3452
3453 while (!response_token_matches(tok, OPAL_ENDLIST)) {
3454 lr_uid_len = response_get_string(&dev->parsed, tok_n, &lr_uid);
3455 if (lr_uid_len != OPAL_UID_LENGTH) {
3456 pr_debug("Unexpected response token type %d.\n", tok_n);
3457 return OPAL_INVAL_PARAM;
3458 }
3459
3460 if (memcmp(lr_uid, opaluid[OPAL_LOCKINGRANGE_GLOBAL], OPAL_UID_LENGTH)) {
3461 if (lr_uid[5] != LOCKING_RANGE_NON_GLOBAL) {
3462 pr_debug("Unexpected byte %d at LR UUID position 5.\n",
3463 lr_uid[5]);
3464 return OPAL_INVAL_PARAM;
3465 }
3466 sranges->lr[sranges->num_lrs++] = lr_uid[7];
3467 } else
3468 sranges->lr[sranges->num_lrs++] = 0;
3469
3470 tok_n++;
3471 tok = response_get_token(&dev->parsed, tok_n);
3472 if (IS_ERR(tok))
3473 return PTR_ERR(tok);
3474 }
3475 } else {
3476 /* Only OPAL_LOCKING_TABLE UID is an alternative to OPAL_STARTLIST here. */
3477 lr_uid_len = response_get_string(&dev->parsed, tok_n, &lr_uid);
3478 if (lr_uid_len != OPAL_UID_LENGTH) {
3479 pr_debug("Unexpected response token type %d.\n", tok_n);
3480 return OPAL_INVAL_PARAM;
3481 }
3482
3483 if (memcmp(lr_uid, opaluid[OPAL_LOCKING_TABLE], OPAL_UID_LENGTH)) {
3484 pr_debug("Unexpected response UID.\n");
3485 return OPAL_INVAL_PARAM;
3486 }
3487
3488 /* sed-opal kernel API already provides following limit in Activate command */
3489 sranges->num_lrs = OPAL_MAX_LRS;
3490 memcpy(sranges->lr, lr_all, OPAL_MAX_LRS);
3491 }
3492 tok_n++;
3493
3494 tok = response_get_token(&dev->parsed, tok_n);
3495 if (IS_ERR(tok))
3496 return PTR_ERR(tok);
3497
3498 if (!response_token_matches(tok, OPAL_ENDNAME)) {
3499 pr_debug("Unexpected response token type %d.\n", tok_n);
3500 return OPAL_INVAL_PARAM;
3501 }
3502 tok_n++;
3503
3504 err = response_get_column(&dev->parsed, &tok_n, OPAL_SUM_RANGE_POLICY, &val);
3505 if (err)
3506 return err;
3507
3508 sranges->range_policy = val ? 1 : 0;
3509
3510 return 0;
3511}
3512
3513static int opal_get_sum_ranges(struct opal_dev *dev, struct opal_sum_ranges *opal_sum_rngs,
3514 void __user *data)
3515{
3516 const struct opal_step admin_steps[] = {
3517 { start_admin1LSP_opal_session, &opal_sum_rngs->key },
3518 { get_sum_ranges, opal_sum_rngs },
3519 { end_opal_session, }
3520 }, anybody_steps[] = {
3521 { start_anybodyLSP_opal_session, NULL },
3522 { get_sum_ranges, opal_sum_rngs },
3523 { end_opal_session, }
3524 };
3525 int ret;
3526
3527 mutex_lock(&dev->dev_lock);
3528 setup_opal_dev(dev);
3529 if (opal_sum_rngs->key.key_len)
3530 /* Use Admin1 session (authenticated by PIN) to retrieve LockingInfo columns */
3531 ret = execute_steps(dev, admin_steps, ARRAY_SIZE(admin_steps));
3532 else
3533 /* Use Anybody session (no key) to retrieve LockingInfo columns */
3534 ret = execute_steps(dev, anybody_steps, ARRAY_SIZE(anybody_steps));
3535 mutex_unlock(&dev->dev_lock);
3536
3537 /* skip session info when copying back to uspace */
3538 if (!ret && copy_to_user(data + offsetof(struct opal_sum_ranges, num_lrs),
3539 (void *)opal_sum_rngs + offsetof(struct opal_sum_ranges, num_lrs),
3540 sizeof(*opal_sum_rngs) - offsetof(struct opal_sum_ranges, num_lrs))) {
3541 pr_debug("Error copying SUM ranges info to userspace\n");
3542 return -EFAULT;
3543 }
3544
3545 return ret;
3546}
3547
3548static int opal_stack_reset(struct opal_dev *dev)
3549{
3550 struct opal_stack_reset *req;
3551 struct opal_stack_reset_response *resp;
3552 int ret;
3553
3554 mutex_lock(&dev->dev_lock);
3555
3556 memset(dev->cmd, 0, IO_BUFFER_LENGTH);
3557 req = (struct opal_stack_reset *)dev->cmd;
3558 req->extendedComID[0] = dev->comid >> 8;
3559 req->extendedComID[1] = dev->comid & 0xFF;
3560 req->request_code = cpu_to_be32(OPAL_STACK_RESET);
3561
3562 ret = dev->send_recv(dev->data, dev->comid, TCG_SECP_02,
3563 dev->cmd, IO_BUFFER_LENGTH, true);
3564 if (ret) {
3565 pr_debug("Error sending stack reset: %d\n", ret);
3566 goto out;
3567 }
3568
3569 memset(dev->resp, 0, IO_BUFFER_LENGTH);
3570 ret = dev->send_recv(dev->data, dev->comid, TCG_SECP_02,
3571 dev->resp, IO_BUFFER_LENGTH, false);
3572 if (ret) {
3573 pr_debug("Error receiving stack reset response: %d\n", ret);
3574 goto out;
3575 }
3576
3577 resp = (struct opal_stack_reset_response *)dev->resp;
3578 if (be16_to_cpu(resp->data_length) != 4) {
3579 pr_debug("Stack reset pending\n");
3580 ret = -EBUSY;
3581 goto out;
3582 }
3583 if (be32_to_cpu(resp->response) != 0) {
3584 pr_debug("Stack reset failed: %u\n", be32_to_cpu(resp->response));
3585 ret = -EIO;
3586 }
3587out:
3588 mutex_unlock(&dev->dev_lock);
3589 return ret;
3590}
3591
3592int sed_ioctl(struct opal_dev *dev, unsigned int cmd, void __user *arg)
3593{
3594 void *p;
3595 int ret = -ENOTTY;
3596
3597 if (!capable(CAP_SYS_ADMIN))
3598 return -EACCES;
3599 if (!dev)
3600 return -EOPNOTSUPP;
3601 if (!(dev->flags & OPAL_FL_SUPPORTED))
3602 return -EOPNOTSUPP;
3603
3604 if (cmd & IOC_IN) {
3605 p = memdup_user(arg, _IOC_SIZE(cmd));
3606 if (IS_ERR(p))
3607 return PTR_ERR(p);
3608 }
3609
3610 switch (cmd) {
3611 case IOC_OPAL_SAVE:
3612 ret = opal_save(dev, p);
3613 break;
3614 case IOC_OPAL_LOCK_UNLOCK:
3615 ret = opal_lock_unlock(dev, p);
3616 break;
3617 case IOC_OPAL_TAKE_OWNERSHIP:
3618 ret = opal_take_ownership(dev, p);
3619 break;
3620 case IOC_OPAL_ACTIVATE_LSP:
3621 ret = opal_activate_lsp(dev, p);
3622 break;
3623 case IOC_OPAL_SET_PW:
3624 ret = opal_set_new_pw(dev, p);
3625 break;
3626 case IOC_OPAL_ACTIVATE_USR:
3627 ret = opal_activate_user(dev, p);
3628 break;
3629 case IOC_OPAL_REVERT_TPR:
3630 ret = opal_reverttper(dev, p, false);
3631 break;
3632 case IOC_OPAL_LR_SETUP:
3633 ret = opal_setup_locking_range(dev, p);
3634 break;
3635 case IOC_OPAL_ADD_USR_TO_LR:
3636 ret = opal_add_user_to_lr(dev, p);
3637 break;
3638 case IOC_OPAL_ENABLE_DISABLE_MBR:
3639 ret = opal_enable_disable_shadow_mbr(dev, p);
3640 break;
3641 case IOC_OPAL_MBR_DONE:
3642 ret = opal_set_mbr_done(dev, p);
3643 break;
3644 case IOC_OPAL_WRITE_SHADOW_MBR:
3645 ret = opal_write_shadow_mbr(dev, p);
3646 break;
3647 case IOC_OPAL_ERASE_LR:
3648 ret = opal_erase_locking_range(dev, p);
3649 break;
3650 case IOC_OPAL_SECURE_ERASE_LR:
3651 ret = opal_secure_erase_locking_range(dev, p);
3652 break;
3653 case IOC_OPAL_PSID_REVERT_TPR:
3654 ret = opal_reverttper(dev, p, true);
3655 break;
3656 case IOC_OPAL_GENERIC_TABLE_RW:
3657 ret = opal_generic_read_write_table(dev, p);
3658 break;
3659 case IOC_OPAL_GET_STATUS:
3660 ret = opal_get_status(dev, arg);
3661 break;
3662 case IOC_OPAL_GET_LR_STATUS:
3663 ret = opal_locking_range_status(dev, p, arg);
3664 break;
3665 case IOC_OPAL_GET_GEOMETRY:
3666 ret = opal_get_geometry(dev, arg);
3667 break;
3668 case IOC_OPAL_REVERT_LSP:
3669 ret = opal_revertlsp(dev, p);
3670 break;
3671 case IOC_OPAL_DISCOVERY:
3672 ret = opal_get_discv(dev, p);
3673 break;
3674 case IOC_OPAL_SET_SID_PW:
3675 ret = opal_set_new_sid_pw(dev, p);
3676 break;
3677 case IOC_OPAL_REACTIVATE_LSP:
3678 ret = opal_reactivate_lsp(dev, p);
3679 break;
3680 case IOC_OPAL_LR_SET_START_LEN:
3681 ret = opal_setup_locking_range_start_length(dev, p);
3682 break;
3683 case IOC_OPAL_ENABLE_DISABLE_LR:
3684 ret = opal_enable_disable_range(dev, p);
3685 break;
3686 case IOC_OPAL_GET_SUM_STATUS:
3687 ret = opal_get_sum_ranges(dev, p, arg);
3688 break;
3689 case IOC_OPAL_STACK_RESET:
3690 ret = opal_stack_reset(dev);
3691 break;
3692
3693 default:
3694 break;
3695 }
3696
3697 if (cmd & IOC_IN)
3698 kfree(p);
3699 return ret;
3700}
3701EXPORT_SYMBOL_GPL(sed_ioctl);
3702
3703static int __init sed_opal_init(void)
3704{
3705 struct key *kr;
3706 char init_sed_key[OPAL_KEY_MAX];
3707 int keylen = OPAL_KEY_MAX - 1;
3708
3709 kr = keyring_alloc(".sed_opal",
3710 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(),
3711 (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW |
3712 KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE,
3713 KEY_ALLOC_NOT_IN_QUOTA,
3714 NULL, NULL);
3715 if (IS_ERR(kr))
3716 return PTR_ERR(kr);
3717
3718 sed_opal_keyring = kr;
3719
3720 if (sed_read_key(OPAL_AUTH_KEY, init_sed_key, &keylen) < 0) {
3721 memset(init_sed_key, '\0', sizeof(init_sed_key));
3722 keylen = OPAL_KEY_MAX - 1;
3723 }
3724
3725 return update_sed_opal_key(OPAL_AUTH_KEY, init_sed_key, keylen);
3726}
3727late_initcall(sed_opal_init);