psp: add op for rotation of device key

Rotating the device key is a key part of the PSP protocol design.
Some external daemon needs to do it once a day, or so.
Add a netlink op to perform this operation.
Add a notification group for informing users that key has been
rotated and they should rekey (next rotation will cut them off).

Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250917000954.859376-6-daniel.zahka@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/Documentation/netlink/specs/psp.yaml b/Documentation/netlink/specs/psp.yaml
index 706f4baf8764d5615f7656719a26d06564a2264c..054cc02b65ad0da6733159badb85991a4e76a986 100644 (file)
--- a/Documentation/netlink/specs/psp.yaml
+++ b/Documentation/netlink/specs/psp.yaml
@@ -88,9 +88,30 @@ operations:
       notify: dev-get
       mcgrp: mgmt
 
+    -
+      name: key-rotate
+      doc: Rotate the device key.
+      attribute-set: dev
+      do:
+        request:
+          attributes:
+            - id
+        reply:
+          attributes:
+            - id
+        pre: psp-device-get-locked
+        post: psp-device-unlock
+    -
+      name: key-rotate-ntf
+      doc: Notification about device key getting rotated.
+      notify: key-rotate
+      mcgrp: use
+
 mcast-groups:
   list:
     -
       name: mgmt
+    -
+      name: use
 
 ...

diff --git a/include/net/psp/types.h b/include/net/psp/types.h
index 4922fc8d42fd8b39fdecd6c5af72ba2bee957261..66327fa80c92a47a497d80fec4f97251dce1ff84 100644 (file)
--- a/include/net/psp/types.h
+++ b/include/net/psp/types.h
@@ -102,6 +102,11 @@ struct psp_dev_ops {
         */
        int (*set_config)(struct psp_dev *psd, struct psp_dev_config *conf,
                          struct netlink_ext_ack *extack);
+
+       /**
+        * @key_rotate: rotate the device key
+        */
+       int (*key_rotate)(struct psp_dev *psd, struct netlink_ext_ack *extack);
 };
 
 #endif /* __NET_PSP_H */

diff --git a/include/uapi/linux/psp.h b/include/uapi/linux/psp.h
index 4a404f085190740fb7f8d0af6824bcc18eed0626..cbfbf3f0f364bd68d6f98caf245d05534b1fdc44 100644 (file)
--- a/include/uapi/linux/psp.h
+++ b/include/uapi/linux/psp.h
@@ -32,11 +32,14 @@ enum {
        PSP_CMD_DEV_DEL_NTF,
        PSP_CMD_DEV_SET,
        PSP_CMD_DEV_CHANGE_NTF,
+       PSP_CMD_KEY_ROTATE,
+       PSP_CMD_KEY_ROTATE_NTF,
 
        __PSP_CMD_MAX,
        PSP_CMD_MAX = (__PSP_CMD_MAX - 1)
 };
 
 #define PSP_MCGRP_MGMT "mgmt"
+#define PSP_MCGRP_USE  "use"
 
 #endif /* _UAPI_LINUX_PSP_H */

diff --git a/net/psp/psp-nl-gen.c b/net/psp/psp-nl-gen.c
index 859712e7c2c1534f866afc31c8d6f8eb4f3d99c5..7f49577ac72fcf7efd174b73118233e5d9ba1847 100644 (file)
--- a/net/psp/psp-nl-gen.c
+++ b/net/psp/psp-nl-gen.c
@@ -21,6 +21,11 @@ static const struct nla_policy psp_dev_set_nl_policy[PSP_A_DEV_PSP_VERSIONS_ENA
        [PSP_A_DEV_PSP_VERSIONS_ENA] = NLA_POLICY_MASK(NLA_U32, 0xf),
 };
 
+/* PSP_CMD_KEY_ROTATE - do */
+static const struct nla_policy psp_key_rotate_nl_policy[PSP_A_DEV_ID + 1] = {
+       [PSP_A_DEV_ID] = NLA_POLICY_MIN(NLA_U32, 1),
+};
+
 /* Ops table for psp */
 static const struct genl_split_ops psp_nl_ops[] = {
        {
@@ -46,10 +51,20 @@ static const struct genl_split_ops psp_nl_ops[] = {
                .maxattr        = PSP_A_DEV_PSP_VERSIONS_ENA,
                .flags          = GENL_CMD_CAP_DO,
        },
+       {
+               .cmd            = PSP_CMD_KEY_ROTATE,
+               .pre_doit       = psp_device_get_locked,
+               .doit           = psp_nl_key_rotate_doit,
+               .post_doit      = psp_device_unlock,
+               .policy         = psp_key_rotate_nl_policy,
+               .maxattr        = PSP_A_DEV_ID,
+               .flags          = GENL_CMD_CAP_DO,
+       },
 };
 
 static const struct genl_multicast_group psp_nl_mcgrps[] = {
        [PSP_NLGRP_MGMT] = { "mgmt", },
+       [PSP_NLGRP_USE] = { "use", },
 };
 
 struct genl_family psp_nl_family __ro_after_init = {

diff --git a/net/psp/psp-nl-gen.h b/net/psp/psp-nl-gen.h
index a099686cab5d7ae4d462df3dd04f4a3712975a47..00a2d4ec59e4d041a34afe03e914608b0bf2fedd 100644 (file)
--- a/net/psp/psp-nl-gen.h
+++ b/net/psp/psp-nl-gen.h
@@ -20,9 +20,11 @@ psp_device_unlock(const struct genl_split_ops *ops, struct sk_buff *skb,
 int psp_nl_dev_get_doit(struct sk_buff *skb, struct genl_info *info);
 int psp_nl_dev_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb);
 int psp_nl_dev_set_doit(struct sk_buff *skb, struct genl_info *info);
+int psp_nl_key_rotate_doit(struct sk_buff *skb, struct genl_info *info);
 
 enum {
        PSP_NLGRP_MGMT,
+       PSP_NLGRP_USE,
 };
 
 extern struct genl_family psp_nl_family;

diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index e09499b7b14aec37c9dcfa273d31b84a2f30c7ae..f60155493afcba1195f5ef715b48bf7f6f1b67c6 100644 (file)
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -54,7 +54,8 @@ psp_dev_create(struct net_device *netdev,
        int err;
 
        if (WARN_ON(!psd_caps->versions ||
-                   !psd_ops->set_config))
+                   !psd_ops->set_config ||
+                   !psd_ops->key_rotate))
                return ERR_PTR(-EINVAL);
 
        psd = kzalloc(sizeof(*psd), GFP_KERNEL);

diff --git a/net/psp/psp_nl.c b/net/psp/psp_nl.c
index fda5ce800f820f9c69403574296cfad5d30be039..75f2702c102912492094299a0aa68674696ae0b8 100644 (file)
--- a/net/psp/psp_nl.c
+++ b/net/psp/psp_nl.c
@@ -221,3 +221,43 @@ err_free_rsp:
        nlmsg_free(rsp);
        return err;
 }
+
+int psp_nl_key_rotate_doit(struct sk_buff *skb, struct genl_info *info)
+{
+       struct psp_dev *psd = info->user_ptr[0];
+       struct genl_info ntf_info;
+       struct sk_buff *ntf, *rsp;
+       int err;
+
+       rsp = psp_nl_reply_new(info);
+       if (!rsp)
+               return -ENOMEM;
+
+       genl_info_init_ntf(&ntf_info, &psp_nl_family, PSP_CMD_KEY_ROTATE_NTF);
+       ntf = psp_nl_reply_new(&ntf_info);
+       if (!ntf) {
+               err = -ENOMEM;
+               goto err_free_rsp;
+       }
+
+       if (nla_put_u32(rsp, PSP_A_DEV_ID, psd->id) ||
+           nla_put_u32(ntf, PSP_A_DEV_ID, psd->id)) {
+               err = -EMSGSIZE;
+               goto err_free_ntf;
+       }
+
+       err = psd->ops->key_rotate(psd, info->extack);
+       if (err)
+               goto err_free_ntf;
+
+       nlmsg_end(ntf, (struct nlmsghdr *)ntf->data);
+       genlmsg_multicast_netns(&psp_nl_family, dev_net(psd->main_netdev), ntf,
+                               0, PSP_NLGRP_USE, GFP_KERNEL);
+       return psp_nl_reply_send(rsp, info);
+
+err_free_ntf:
+       nlmsg_free(ntf);
+err_free_rsp:
+       nlmsg_free(rsp);
+       return err;
+}