1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Copyright 2019 Google LLC 4 */ 5 6 #ifndef __LINUX_KEYSLOT_MANAGER_H 7 #define __LINUX_KEYSLOT_MANAGER_H 8 9 #include <linux/bio.h> 10 #include <linux/blk-crypto.h> 11 12 /* Inline crypto feature bits. Must set at least one. */ 13 enum { 14 /* Support for standard software-specified keys */ 15 BLK_CRYPTO_FEATURE_STANDARD_KEYS = BIT(0), 16 17 /* Support for hardware-wrapped keys */ 18 BLK_CRYPTO_FEATURE_WRAPPED_KEYS = BIT(1), 19 }; 20 21 struct blk_keyslot_manager; 22 23 /** 24 * struct blk_ksm_ll_ops - functions to manage keyslots in hardware 25 * @keyslot_program: Program the specified key into the specified slot in the 26 * inline encryption hardware. 27 * @keyslot_evict: Evict key from the specified keyslot in the hardware. 28 * The key is provided so that e.g. dm layers can evict 29 * keys from the devices that they map over. 30 * Returns 0 on success, -errno otherwise. 31 * @derive_raw_secret: (Optional) Derive a software secret from a 32 * hardware-wrapped key. Returns 0 on success, -EOPNOTSUPP 33 * if unsupported on the hardware, or another -errno code. 34 * 35 * This structure should be provided by storage device drivers when they set up 36 * a keyslot manager - this structure holds the function ptrs that the keyslot 37 * manager will use to manipulate keyslots in the hardware. 38 */ 39 struct blk_ksm_ll_ops { 40 int (*keyslot_program)(struct blk_keyslot_manager *ksm, 41 const struct blk_crypto_key *key, 42 unsigned int slot); 43 int (*keyslot_evict)(struct blk_keyslot_manager *ksm, 44 const struct blk_crypto_key *key, 45 unsigned int slot); 46 int (*derive_raw_secret)(struct blk_keyslot_manager *ksm, 47 const u8 *wrapped_key, 48 unsigned int wrapped_key_size, 49 u8 *secret, unsigned int secret_size); 50 }; 51 52 struct blk_keyslot_manager { 53 /* 54 * The struct blk_ksm_ll_ops that this keyslot manager will use 55 * to perform operations like programming and evicting keys on the 56 * device 57 */ 58 struct blk_ksm_ll_ops ksm_ll_ops; 59 60 /* 61 * The maximum number of bytes supported for specifying the data unit 62 * number. 63 */ 64 unsigned int max_dun_bytes_supported; 65 66 /* 67 * The supported features as a bitmask of BLK_CRYPTO_FEATURE_* flags. 68 * Most drivers should set BLK_CRYPTO_FEATURE_STANDARD_KEYS here. 69 */ 70 unsigned int features; 71 72 /* 73 * Array of size BLK_ENCRYPTION_MODE_MAX of bitmasks that represents 74 * whether a crypto mode and data unit size are supported. The i'th 75 * bit of crypto_mode_supported[crypto_mode] is set iff a data unit 76 * size of (1 << i) is supported. We only support data unit sizes 77 * that are powers of 2. 78 */ 79 unsigned int crypto_modes_supported[BLK_ENCRYPTION_MODE_MAX]; 80 81 /* Device for runtime power management (NULL if none) */ 82 struct device *dev; 83 84 /* Here onwards are *private* fields for internal keyslot manager use */ 85 86 unsigned int num_slots; 87 88 /* Protects programming and evicting keys from the device */ 89 struct rw_semaphore lock; 90 91 /* List of idle slots, with least recently used slot at front */ 92 wait_queue_head_t idle_slots_wait_queue; 93 struct list_head idle_slots; 94 spinlock_t idle_slots_lock; 95 96 /* 97 * Hash table which maps struct *blk_crypto_key to keyslots, so that we 98 * can find a key's keyslot in O(1) time rather than O(num_slots). 99 * Protected by 'lock'. 100 */ 101 struct hlist_head *slot_hashtable; 102 unsigned int log_slot_ht_size; 103 104 /* Per-keyslot data */ 105 struct blk_ksm_keyslot *slots; 106 }; 107 108 int blk_ksm_init(struct blk_keyslot_manager *ksm, unsigned int num_slots); 109 110 int devm_blk_ksm_init(struct device *dev, struct blk_keyslot_manager *ksm, 111 unsigned int num_slots); 112 113 blk_status_t blk_ksm_get_slot_for_key(struct blk_keyslot_manager *ksm, 114 const struct blk_crypto_key *key, 115 struct blk_ksm_keyslot **slot_ptr); 116 117 unsigned int blk_ksm_get_slot_idx(struct blk_ksm_keyslot *slot); 118 119 void blk_ksm_put_slot(struct blk_ksm_keyslot *slot); 120 121 bool blk_ksm_crypto_cfg_supported(struct blk_keyslot_manager *ksm, 122 const struct blk_crypto_config *cfg); 123 124 int blk_ksm_evict_key(struct blk_keyslot_manager *ksm, 125 const struct blk_crypto_key *key); 126 127 void blk_ksm_reprogram_all_keys(struct blk_keyslot_manager *ksm); 128 129 void blk_ksm_destroy(struct blk_keyslot_manager *ksm); 130 131 int blk_ksm_derive_raw_secret(struct blk_keyslot_manager *ksm, 132 const u8 *wrapped_key, 133 unsigned int wrapped_key_size, 134 u8 *secret, unsigned int secret_size); 135 136 void blk_ksm_intersect_modes(struct blk_keyslot_manager *parent, 137 const struct blk_keyslot_manager *child); 138 139 void blk_ksm_init_passthrough(struct blk_keyslot_manager *ksm); 140 141 bool blk_ksm_is_superset(struct blk_keyslot_manager *ksm_superset, 142 struct blk_keyslot_manager *ksm_subset); 143 144 void blk_ksm_update_capabilities(struct blk_keyslot_manager *target_ksm, 145 struct blk_keyslot_manager *reference_ksm); 146 147 #endif /* __LINUX_KEYSLOT_MANAGER_H */ 148