// SPDX-License-Identifier: GPL-2.0-only
/* Copyright(c) 2022 Intel Corporation. All rights reserved. */
#include <linux/libnvdimm.h>
#include <linux/unaligned.h>
#include <linux/module.h>
#include <linux/async.h>
#include <linux/slab.h>
#include <linux/memregion.h>
#include "cxlmem.h"
#include "cxl.h"

static unsigned long cxl_pmem_get_security_flags(struct nvdimm *nvdimm,
                                                 enum nvdimm_passphrase_type ptype)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
        unsigned long security_flags = 0;
        struct cxl_get_security_output {
                __le32 flags;
        } out;
        struct cxl_mbox_cmd mbox_cmd;
        u32 sec_out;
        int rc;

        mbox_cmd = (struct cxl_mbox_cmd) {
                .opcode = CXL_MBOX_OP_GET_SECURITY_STATE,
                .size_out = sizeof(out),
                .payload_out = &out,
        };

        rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
        if (rc < 0)
                return 0;

        sec_out = le32_to_cpu(out.flags);
        /* cache security state */
        mds->security.state = sec_out;

        if (ptype == NVDIMM_MASTER) {
                if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PASS_SET)
                        set_bit(NVDIMM_SECURITY_UNLOCKED, &security_flags);
                else
                        set_bit(NVDIMM_SECURITY_DISABLED, &security_flags);
                if (sec_out & CXL_PMEM_SEC_STATE_MASTER_PLIMIT)
                        set_bit(NVDIMM_SECURITY_FROZEN, &security_flags);
                return security_flags;
        }

        if (sec_out & CXL_PMEM_SEC_STATE_USER_PASS_SET) {
                if (sec_out & CXL_PMEM_SEC_STATE_FROZEN ||
                    sec_out & CXL_PMEM_SEC_STATE_USER_PLIMIT)
                        set_bit(NVDIMM_SECURITY_FROZEN, &security_flags);

                if (sec_out & CXL_PMEM_SEC_STATE_LOCKED)
                        set_bit(NVDIMM_SECURITY_LOCKED, &security_flags);
                else
                        set_bit(NVDIMM_SECURITY_UNLOCKED, &security_flags);
        } else {
                set_bit(NVDIMM_SECURITY_DISABLED, &security_flags);
        }

        return security_flags;
}

static int cxl_pmem_security_change_key(struct nvdimm *nvdimm,
                                        const struct nvdimm_key_data *old_data,
                                        const struct nvdimm_key_data *new_data,
                                        enum nvdimm_passphrase_type ptype)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        struct cxl_mbox_cmd mbox_cmd;
        struct cxl_set_pass set_pass;

        set_pass = (struct cxl_set_pass) {
                .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
                                                 CXL_PMEM_SEC_PASS_USER,
        };
        memcpy(set_pass.old_pass, old_data->data, NVDIMM_PASSPHRASE_LEN);
        memcpy(set_pass.new_pass, new_data->data, NVDIMM_PASSPHRASE_LEN);

        mbox_cmd = (struct cxl_mbox_cmd) {
                .opcode = CXL_MBOX_OP_SET_PASSPHRASE,
                .size_in = sizeof(set_pass),
                .payload_in = &set_pass,
        };

        return cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
}

static int __cxl_pmem_security_disable(struct nvdimm *nvdimm,
                                       const struct nvdimm_key_data *key_data,
                                       enum nvdimm_passphrase_type ptype)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        struct cxl_disable_pass dis_pass;
        struct cxl_mbox_cmd mbox_cmd;

        dis_pass = (struct cxl_disable_pass) {
                .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
                                                 CXL_PMEM_SEC_PASS_USER,
        };
        memcpy(dis_pass.pass, key_data->data, NVDIMM_PASSPHRASE_LEN);

        mbox_cmd = (struct cxl_mbox_cmd) {
                .opcode = CXL_MBOX_OP_DISABLE_PASSPHRASE,
                .size_in = sizeof(dis_pass),
                .payload_in = &dis_pass,
        };

        return cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
}

static int cxl_pmem_security_disable(struct nvdimm *nvdimm,
                                     const struct nvdimm_key_data *key_data)
{
        return __cxl_pmem_security_disable(nvdimm, key_data, NVDIMM_USER);
}

static int cxl_pmem_security_disable_master(struct nvdimm *nvdimm,
                                            const struct nvdimm_key_data *key_data)
{
        return __cxl_pmem_security_disable(nvdimm, key_data, NVDIMM_MASTER);
}

static int cxl_pmem_security_freeze(struct nvdimm *nvdimm)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        struct cxl_mbox_cmd mbox_cmd = {
                .opcode = CXL_MBOX_OP_FREEZE_SECURITY,
        };

        return cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
}

static int cxl_pmem_security_unlock(struct nvdimm *nvdimm,
                                    const struct nvdimm_key_data *key_data)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        u8 pass[NVDIMM_PASSPHRASE_LEN];
        struct cxl_mbox_cmd mbox_cmd;
        int rc;

        memcpy(pass, key_data->data, NVDIMM_PASSPHRASE_LEN);
        mbox_cmd = (struct cxl_mbox_cmd) {
                .opcode = CXL_MBOX_OP_UNLOCK,
                .size_in = NVDIMM_PASSPHRASE_LEN,
                .payload_in = pass,
        };

        rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
        if (rc < 0)
                return rc;

        return 0;
}

static int cxl_pmem_security_passphrase_erase(struct nvdimm *nvdimm,
                                              const struct nvdimm_key_data *key,
                                              enum nvdimm_passphrase_type ptype)
{
        struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
        struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
        struct cxl_mailbox *cxl_mbox = &cxlmd->cxlds->cxl_mbox;
        struct cxl_mbox_cmd mbox_cmd;
        struct cxl_pass_erase erase;
        int rc;

        erase = (struct cxl_pass_erase) {
                .type = ptype == NVDIMM_MASTER ? CXL_PMEM_SEC_PASS_MASTER :
                                                 CXL_PMEM_SEC_PASS_USER,
        };
        memcpy(erase.pass, key->data, NVDIMM_PASSPHRASE_LEN);
        mbox_cmd = (struct cxl_mbox_cmd) {
                .opcode = CXL_MBOX_OP_PASSPHRASE_SECURE_ERASE,
                .size_in = sizeof(erase),
                .payload_in = &erase,
        };

        rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
        if (rc < 0)
                return rc;

        return 0;
}

static const struct nvdimm_security_ops __cxl_security_ops = {
        .get_flags = cxl_pmem_get_security_flags,
        .change_key = cxl_pmem_security_change_key,
        .disable = cxl_pmem_security_disable,
        .freeze = cxl_pmem_security_freeze,
        .unlock = cxl_pmem_security_unlock,
        .erase = cxl_pmem_security_passphrase_erase,
        .disable_master = cxl_pmem_security_disable_master,
};

const struct nvdimm_security_ops *cxl_security_ops = &__cxl_security_ops;