keyslot-manager.h 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /*
  3. * Copyright 2019 Google LLC
  4. */
  5. #ifndef __LINUX_KEYSLOT_MANAGER_H
  6. #define __LINUX_KEYSLOT_MANAGER_H
  7. #include <linux/bio.h>
  8. #include <linux/blk-crypto.h>
  9. /* Inline crypto feature bits. Must set at least one. */
  10. enum {
  11. /* Support for standard software-specified keys */
  12. BLK_CRYPTO_FEATURE_STANDARD_KEYS = BIT(0),
  13. /* Support for hardware-wrapped keys */
  14. BLK_CRYPTO_FEATURE_WRAPPED_KEYS = BIT(1),
  15. };
  16. struct blk_keyslot_manager;
  17. /**
  18. * struct blk_ksm_ll_ops - functions to manage keyslots in hardware
  19. * @keyslot_program: Program the specified key into the specified slot in the
  20. * inline encryption hardware.
  21. * @keyslot_evict: Evict key from the specified keyslot in the hardware.
  22. * The key is provided so that e.g. dm layers can evict
  23. * keys from the devices that they map over.
  24. * Returns 0 on success, -errno otherwise.
  25. * @derive_raw_secret: (Optional) Derive a software secret from a
  26. * hardware-wrapped key. Returns 0 on success, -EOPNOTSUPP
  27. * if unsupported on the hardware, or another -errno code.
  28. *
  29. * This structure should be provided by storage device drivers when they set up
  30. * a keyslot manager - this structure holds the function ptrs that the keyslot
  31. * manager will use to manipulate keyslots in the hardware.
  32. */
  33. struct blk_ksm_ll_ops {
  34. int (*keyslot_program)(struct blk_keyslot_manager *ksm,
  35. const struct blk_crypto_key *key,
  36. unsigned int slot);
  37. int (*keyslot_evict)(struct blk_keyslot_manager *ksm,
  38. const struct blk_crypto_key *key,
  39. unsigned int slot);
  40. int (*derive_raw_secret)(struct blk_keyslot_manager *ksm,
  41. const u8 *wrapped_key,
  42. unsigned int wrapped_key_size,
  43. u8 *secret, unsigned int secret_size);
  44. };
  45. struct blk_keyslot_manager {
  46. /*
  47. * The struct blk_ksm_ll_ops that this keyslot manager will use
  48. * to perform operations like programming and evicting keys on the
  49. * device
  50. */
  51. struct blk_ksm_ll_ops ksm_ll_ops;
  52. /*
  53. * The maximum number of bytes supported for specifying the data unit
  54. * number.
  55. */
  56. unsigned int max_dun_bytes_supported;
  57. /*
  58. * The supported features as a bitmask of BLK_CRYPTO_FEATURE_* flags.
  59. * Most drivers should set BLK_CRYPTO_FEATURE_STANDARD_KEYS here.
  60. */
  61. unsigned int features;
  62. /*
  63. * Array of size BLK_ENCRYPTION_MODE_MAX of bitmasks that represents
  64. * whether a crypto mode and data unit size are supported. The i'th
  65. * bit of crypto_mode_supported[crypto_mode] is set iff a data unit
  66. * size of (1 << i) is supported. We only support data unit sizes
  67. * that are powers of 2.
  68. */
  69. unsigned int crypto_modes_supported[BLK_ENCRYPTION_MODE_MAX];
  70. /* Device for runtime power management (NULL if none) */
  71. struct device *dev;
  72. /* Here onwards are *private* fields for internal keyslot manager use */
  73. unsigned int num_slots;
  74. /* Protects programming and evicting keys from the device */
  75. struct rw_semaphore lock;
  76. /* List of idle slots, with least recently used slot at front */
  77. wait_queue_head_t idle_slots_wait_queue;
  78. struct list_head idle_slots;
  79. spinlock_t idle_slots_lock;
  80. /*
  81. * Hash table which maps struct *blk_crypto_key to keyslots, so that we
  82. * can find a key's keyslot in O(1) time rather than O(num_slots).
  83. * Protected by 'lock'.
  84. */
  85. struct hlist_head *slot_hashtable;
  86. unsigned int log_slot_ht_size;
  87. /* Per-keyslot data */
  88. struct blk_ksm_keyslot *slots;
  89. };
  90. int blk_ksm_init(struct blk_keyslot_manager *ksm, unsigned int num_slots);
  91. int devm_blk_ksm_init(struct device *dev, struct blk_keyslot_manager *ksm,
  92. unsigned int num_slots);
  93. blk_status_t blk_ksm_get_slot_for_key(struct blk_keyslot_manager *ksm,
  94. const struct blk_crypto_key *key,
  95. struct blk_ksm_keyslot **slot_ptr);
  96. unsigned int blk_ksm_get_slot_idx(struct blk_ksm_keyslot *slot);
  97. void blk_ksm_put_slot(struct blk_ksm_keyslot *slot);
  98. bool blk_ksm_crypto_cfg_supported(struct blk_keyslot_manager *ksm,
  99. const struct blk_crypto_config *cfg);
  100. int blk_ksm_evict_key(struct blk_keyslot_manager *ksm,
  101. const struct blk_crypto_key *key);
  102. void blk_ksm_reprogram_all_keys(struct blk_keyslot_manager *ksm);
  103. void blk_ksm_destroy(struct blk_keyslot_manager *ksm);
  104. int blk_ksm_derive_raw_secret(struct blk_keyslot_manager *ksm,
  105. const u8 *wrapped_key,
  106. unsigned int wrapped_key_size,
  107. u8 *secret, unsigned int secret_size);
  108. void blk_ksm_intersect_modes(struct blk_keyslot_manager *parent,
  109. const struct blk_keyslot_manager *child);
  110. void blk_ksm_init_passthrough(struct blk_keyslot_manager *ksm);
  111. bool blk_ksm_is_superset(struct blk_keyslot_manager *ksm_superset,
  112. struct blk_keyslot_manager *ksm_subset);
  113. void blk_ksm_update_capabilities(struct blk_keyslot_manager *target_ksm,
  114. struct blk_keyslot_manager *reference_ksm);
  115. #endif /* __LINUX_KEYSLOT_MANAGER_H */