Commit 9d77eb52 authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Keith Busch
Browse files

nvme-keyring: register '.nvme' keyring 



Register a '.nvme' keyring to hold keys for TLS and DH-HMAC-CHAP and
add a new config option NVME_KEYRING.
We need a separate keyring for NVMe as the configuration is done
via individual commands (eg for configfs), and the usual per-session
or per-process keyrings can't be used.

Signed-off-by: default avatarHannes Reinecke <hare@suse.de>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent ccd3129a

drivers/nvme/common/Kconfig

+4 −0
Original line number Diff line number Diff line
@@ -2,3 +2,7 @@ 


config NVME_COMMON

       tristate



config NVME_KEYRING

       bool

       select KEYS

drivers/nvme/common/Makefile

+2 −1
Original line number Diff line number Diff line
@@ -4,4 +4,5 @@ ccflags-y += -I$(src) 


obj-$(CONFIG_NVME_COMMON)	+= nvme-common.o



nvme-common-y			+= auth.o
 
nvme-common-$(CONFIG_NVME_AUTH)	+= auth.o

nvme-common-$(CONFIG_NVME_KEYRING) += keyring.o

drivers/nvme/common/keyring.c

0 → 100644
+40 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright (c) 2023 Hannes Reinecke, SUSE Labs

 */



#include <linux/module.h>

#include <linux/seq_file.h>

#include <linux/key-type.h>

#include <keys/user-type.h>

#include <linux/nvme.h>



static struct key *nvme_keyring;



key_serial_t nvme_keyring_id(void)

{

	return nvme_keyring->serial;

}

EXPORT_SYMBOL_GPL(nvme_keyring_id);



int nvme_keyring_init(void)

{

	nvme_keyring = keyring_alloc(".nvme",

				     GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,

				     current_cred(),

				     (KEY_POS_ALL & ~KEY_POS_SETATTR) |

				     (KEY_USR_ALL & ~KEY_USR_SETATTR),

				     KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);

	if (IS_ERR(nvme_keyring))

		return PTR_ERR(nvme_keyring);



	return 0;

}

EXPORT_SYMBOL_GPL(nvme_keyring_init);



void nvme_keyring_exit(void)

{

	key_revoke(nvme_keyring);

	key_put(nvme_keyring);

}

EXPORT_SYMBOL_GPL(nvme_keyring_exit);

drivers/nvme/host/core.c

+8 −2
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include "nvme.h"

#include "fabrics.h"

#include <linux/nvme-auth.h>

#include <linux/nvme-keyring.h>



#define CREATE_TRACE_POINTS

#include "trace.h"
@@ -4723,12 +4724,16 @@ static int __init nvme_core_init(void) 
		result = PTR_ERR(nvme_ns_chr_class);

		goto unregister_generic_ns;

	}



	result = nvme_init_auth();

	result = nvme_keyring_init();

	if (result)

		goto destroy_ns_chr;

	result = nvme_init_auth();

	if (result)

		goto keyring_exit;

	return 0;



keyring_exit:

	nvme_keyring_exit();

destroy_ns_chr:

	class_destroy(nvme_ns_chr_class);

unregister_generic_ns:
@@ -4752,6 +4757,7 @@ static int __init nvme_core_init(void) 
static void __exit nvme_core_exit(void)

{

	nvme_exit_auth();

	nvme_keyring_exit();

	class_destroy(nvme_ns_chr_class);

	class_destroy(nvme_subsys_class);

	class_destroy(nvme_class);

include/linux/nvme-keyring.h

0 → 100644
+28 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Copyright (c) 2023 Hannes Reinecke, SUSE Labs

 */



#ifndef _NVME_KEYRING_H

#define _NVME_KEYRING_H



#ifdef CONFIG_NVME_KEYRING



key_serial_t nvme_keyring_id(void);

int nvme_keyring_init(void);

void nvme_keyring_exit(void);



#else



static inline key_serial_t nvme_keyring_id(void)

{

	return 0;

}

static inline int nvme_keyring_init(void)

{

	return 0;

}

static inline void nvme_keyring_exit(void) {}



#endif /* !CONFIG_NVME_KEYRING */

#endif /* _NVME_KEYRING_H */