nvme-keyring: register '.nvme' keyring

Register a '.nvme' keyring to hold keys for TLS and DH-HMAC-CHAP and
add a new config option NVME_KEYRING.
We need a separate keyring for NVMe as the configuration is done
via individual commands (eg for configfs), and the usual per-session
or per-process keyrings can't be used.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/common/Kconfig b/drivers/nvme/common/Kconfig
index 4514f44362dd219048edd1728fa5147483cd595c..641b27adb047eebf35702471777c4d8c3d039223 100644 (file)
--- a/drivers/nvme/common/Kconfig
+++ b/drivers/nvme/common/Kconfig
@@ -2,3 +2,7 @@
 
 config NVME_COMMON
        tristate
+
+config NVME_KEYRING
+       bool
+       select KEYS

diff --git a/drivers/nvme/common/Makefile b/drivers/nvme/common/Makefile
index 720c625b8a522ca68bc02931d7eec9df862cb9a4..0cbd0b0b8d499864ae65db2b0406a6b6cfde5ec8 100644 (file)
--- a/drivers/nvme/common/Makefile
+++ b/drivers/nvme/common/Makefile
@@ -4,4 +4,5 @@ ccflags-y                       += -I$(src)
 
 obj-$(CONFIG_NVME_COMMON)      += nvme-common.o
 
-nvme-common-y                  += auth.o
+nvme-common-$(CONFIG_NVME_AUTH)        += auth.o
+nvme-common-$(CONFIG_NVME_KEYRING) += keyring.o

diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c
new file mode 100644 (file)
index 0000000..5cf64b2
--- /dev/null
+++ b/drivers/nvme/common/keyring.c
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2023 Hannes Reinecke, SUSE Labs
+ */
+
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/key-type.h>
+#include <keys/user-type.h>
+#include <linux/nvme.h>
+
+static struct key *nvme_keyring;
+
+key_serial_t nvme_keyring_id(void)
+{
+       return nvme_keyring->serial;
+}
+EXPORT_SYMBOL_GPL(nvme_keyring_id);
+
+int nvme_keyring_init(void)
+{
+       nvme_keyring = keyring_alloc(".nvme",
+                                    GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
+                                    current_cred(),
+                                    (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                    (KEY_USR_ALL & ~KEY_USR_SETATTR),
+                                    KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
+       if (IS_ERR(nvme_keyring))
+               return PTR_ERR(nvme_keyring);
+
+       return 0;
+}
+EXPORT_SYMBOL_GPL(nvme_keyring_init);
+
+void nvme_keyring_exit(void)
+{
+       key_revoke(nvme_keyring);
+       key_put(nvme_keyring);
+}
+EXPORT_SYMBOL_GPL(nvme_keyring_exit);

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 21783aa2ee8e18f64154f479a4b6800eccecde32..a49b65d34cda0388bcc467fdef862b02f3dc3f94 100644 (file)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -25,6 +25,7 @@
 #include "nvme.h"
 #include "fabrics.h"
 #include <linux/nvme-auth.h>
+#include <linux/nvme-keyring.h>
 
 #define CREATE_TRACE_POINTS
 #include "trace.h"
@@ -4723,12 +4724,16 @@ static int __init nvme_core_init(void)
                result = PTR_ERR(nvme_ns_chr_class);
                goto unregister_generic_ns;
        }
-
-       result = nvme_init_auth();
+       result = nvme_keyring_init();
        if (result)
                goto destroy_ns_chr;
+       result = nvme_init_auth();
+       if (result)
+               goto keyring_exit;
        return 0;
 
+keyring_exit:
+       nvme_keyring_exit();
 destroy_ns_chr:
        class_destroy(nvme_ns_chr_class);
 unregister_generic_ns:
@@ -4752,6 +4757,7 @@ out:
 static void __exit nvme_core_exit(void)
 {
        nvme_exit_auth();
+       nvme_keyring_exit();
        class_destroy(nvme_ns_chr_class);
        class_destroy(nvme_subsys_class);
        class_destroy(nvme_class);

diff --git a/include/linux/nvme-keyring.h b/include/linux/nvme-keyring.h
new file mode 100644 (file)
index 0000000..32bd264
--- /dev/null
+++ b/include/linux/nvme-keyring.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2023 Hannes Reinecke, SUSE Labs
+ */
+
+#ifndef _NVME_KEYRING_H
+#define _NVME_KEYRING_H
+
+#ifdef CONFIG_NVME_KEYRING
+
+key_serial_t nvme_keyring_id(void);
+int nvme_keyring_init(void);
+void nvme_keyring_exit(void);
+
+#else
+
+static inline key_serial_t nvme_keyring_id(void)
+{
+       return 0;
+}
+static inline int nvme_keyring_init(void)
+{
+       return 0;
+}
+static inline void nvme_keyring_exit(void) {}
+
+#endif /* !CONFIG_NVME_KEYRING */
+#endif /* _NVME_KEYRING_H */