From patchwork Fri May 5 19:41:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Joyce X-Patchwork-Id: 680364 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CE0CC7EE2C for ; Fri, 5 May 2023 19:42:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233301AbjEETmS (ORCPT ); Fri, 5 May 2023 15:42:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232989AbjEETmQ (ORCPT ); Fri, 5 May 2023 15:42:16 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9281B1BE1; Fri, 5 May 2023 12:42:14 -0700 (PDT) Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 345J0Pt8024841; Fri, 5 May 2023 19:41:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=pp1; bh=GUM4DcUsz5eY5ZD2aKM+Vc4iNM+U1Q/kdOhLweccORM=; b=d5CRCy1o/bjErZ62Ak2Uv4mK+o8Jc0c3gmmcDRw44URpvX7gOpxPy90HOSRFWOj6X93p k1HV4HyQbppNVCRHlplvt3Uyzm134TpZzaoQIDoPoIdhWGGapRYWFVB+RG+rfZ+NKWQK XG1uIKq346YsSlOVbd0Hb0zNilltAhzkvDC+2NOCVQM7qNcU/VIqvHFhNt3U/xogCZmx +s16fnpAuFlKbbsM/RWAJfF7f00x3xKn0KNo4lG1CXVOjNh5LgJPeJsUJHrGveWMaa/t BeuWzLMbxgrlrGkokzY3BJz/hgtdAvRUQhkSTOsLkOp7FxDr0RCCzz15pMr8bvVzt883 gg== Received: from ppma02wdc.us.ibm.com (aa.5b.37a9.ip4.static.sl-reverse.com [169.55.91.170]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3qd658ugdu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 May 2023 19:41:56 +0000 Received: from pps.filterd (ppma02wdc.us.ibm.com [127.0.0.1]) by ppma02wdc.us.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 345GvsFr002611; Fri, 5 May 2023 19:41:56 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([9.208.130.99]) by ppma02wdc.us.ibm.com (PPS) with ESMTPS id 3q8tv8r9rv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 05 May 2023 19:41:56 +0000 Received: from smtpav02.dal12v.mail.ibm.com (smtpav02.dal12v.mail.ibm.com [10.241.53.101]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 345Jft1138404576 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 5 May 2023 19:41:55 GMT Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3733D5805E; Fri, 5 May 2023 19:41:55 +0000 (GMT) Received: from smtpav02.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D55D558051; Fri, 5 May 2023 19:41:53 +0000 (GMT) Received: from rhel-laptop.ibm.com.com (unknown [9.160.1.159]) by smtpav02.dal12v.mail.ibm.com (Postfix) with ESMTP; Fri, 5 May 2023 19:41:53 +0000 (GMT) From: gjoyce@linux.vnet.ibm.com To: linux-block@vger.kernel.org Cc: linuxppc-dev@lists.ozlabs.org, jonathan.derrick@linux.dev, brking@linux.vnet.ibm.com, msuchanek@suse.de, mpe@ellerman.id.au, axboe@kernel.dk, akpm@linux-foundation.org, gjoyce@linux.vnet.ibm.com, linux-efi@vger.kernel.org, keyrings@vger.kernel.org, me@benboeckel.net, elliott@hpe.com Subject: [PATCH v4 0/3] sed-opal: keyrings, discovery, revert, key store Date: Fri, 5 May 2023 14:41:48 -0500 Message-Id: <20230505194151.2078678-1-gjoyce@linux.vnet.ibm.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: Oz-m1uNz32E0zDYw4vXWfM-oJsxXpXhq X-Proofpoint-ORIG-GUID: Oz-m1uNz32E0zDYw4vXWfM-oJsxXpXhq X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-05-05_25,2023-05-05_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 suspectscore=0 lowpriorityscore=0 bulkscore=0 adultscore=0 spamscore=0 mlxscore=0 priorityscore=1501 phishscore=0 impostorscore=0 mlxlogscore=999 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000 definitions=main-2305050156 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org From: Greg Joyce TCG SED Opal is a specification from The Trusted Computing Group that allows self encrypting storage devices (SED) to be locked at power on and require an authentication key to unlock the drive. The current SED Opal implementation in the block driver requires that authentication keys be provided in an ioctl so that they can be presented to the underlying SED capable drive. Currently, the key is typically entered by a user with an application like sedutil or sedcli. While this process works, it does not lend itself to automation like unlock by a udev rule. The SED block driver has been extended so it can alternatively obtain a key from a sed-opal kernel keyring. The SED ioctls will indicate the source of the key, either directly in the ioctl data or from the keyring. Two new SED ioctls have also been added. These are: 1) IOC_OPAL_REVERT_LSP to revert LSP state 2) IOC_OPAL_DISCOVERY to discover drive capabilities/state change log v4: - rebase to 6.3-rc7 - replaced "255" magic number with U8_MAX change log: - rebase to 6.x - added latest reviews - removed platform functions for persistent key storage - replaced key update logic with key_create_or_update() - minor bracing and padding changes - add error returns - opal_key structure is application provided but kernel verified - added brief description of TCG SED Opal Greg Joyce (3): block: sed-opal: Implement IOC_OPAL_DISCOVERY block: sed-opal: Implement IOC_OPAL_REVERT_LSP block: sed-opal: keyring support for SED keys block/Kconfig | 2 + block/opal_proto.h | 4 + block/sed-opal.c | 252 +++++++++++++++++++++++++++++++++- include/linux/sed-opal.h | 5 + include/uapi/linux/sed-opal.h | 25 +++- 5 files changed, 282 insertions(+), 6 deletions(-) Signed-off-by: Greg Joyce base-commit: 6a8f57ae2eb07ab39a6f0ccad60c760743051026