security.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* Copyright(c) 2018 Intel Corporation. All rights reserved. */
  3. #include <linux/module.h>
  4. #include <linux/device.h>
  5. #include <linux/ndctl.h>
  6. #include <linux/slab.h>
  7. #include <linux/io.h>
  8. #include <linux/mm.h>
  9. #include <linux/cred.h>
  10. #include <linux/key.h>
  11. #include <linux/key-type.h>
  12. #include <keys/user-type.h>
  13. #include <keys/encrypted-type.h>
  14. #include "nd-core.h"
  15. #include "nd.h"
  16. #define NVDIMM_BASE_KEY 0
  17. #define NVDIMM_NEW_KEY 1
  18. static bool key_revalidate = true;
  19. module_param(key_revalidate, bool, 0444);
  20. MODULE_PARM_DESC(key_revalidate, "Require key validation at init.");
  21. static const char zero_key[NVDIMM_PASSPHRASE_LEN];
  22. static void *key_data(struct key *key)
  23. {
  24. struct encrypted_key_payload *epayload = dereference_key_locked(key);
  25. lockdep_assert_held_read(&key->sem);
  26. return epayload->decrypted_data;
  27. }
  28. static void nvdimm_put_key(struct key *key)
  29. {
  30. if (!key)
  31. return;
  32. up_read(&key->sem);
  33. key_put(key);
  34. }
  35. /*
  36. * Retrieve kernel key for DIMM and request from user space if
  37. * necessary. Returns a key held for read and must be put by
  38. * nvdimm_put_key() before the usage goes out of scope.
  39. */
  40. static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
  41. {
  42. struct key *key = NULL;
  43. static const char NVDIMM_PREFIX[] = "nvdimm:";
  44. char desc[NVDIMM_KEY_DESC_LEN + sizeof(NVDIMM_PREFIX)];
  45. struct device *dev = &nvdimm->dev;
  46. sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id);
  47. key = request_key(&key_type_encrypted, desc, "");
  48. if (IS_ERR(key)) {
  49. if (PTR_ERR(key) == -ENOKEY)
  50. dev_dbg(dev, "request_key() found no key\n");
  51. else
  52. dev_dbg(dev, "request_key() upcall failed\n");
  53. key = NULL;
  54. } else {
  55. struct encrypted_key_payload *epayload;
  56. down_read(&key->sem);
  57. epayload = dereference_key_locked(key);
  58. if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
  59. up_read(&key->sem);
  60. key_put(key);
  61. key = NULL;
  62. }
  63. }
  64. return key;
  65. }
  66. static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm,
  67. struct key **key)
  68. {
  69. *key = nvdimm_request_key(nvdimm);
  70. if (!*key)
  71. return zero_key;
  72. return key_data(*key);
  73. }
  74. static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
  75. key_serial_t id, int subclass)
  76. {
  77. key_ref_t keyref;
  78. struct key *key;
  79. struct encrypted_key_payload *epayload;
  80. struct device *dev = &nvdimm->dev;
  81. keyref = lookup_user_key(id, 0, KEY_NEED_SEARCH);
  82. if (IS_ERR(keyref))
  83. return NULL;
  84. key = key_ref_to_ptr(keyref);
  85. if (key->type != &key_type_encrypted) {
  86. key_put(key);
  87. return NULL;
  88. }
  89. dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key));
  90. down_read_nested(&key->sem, subclass);
  91. epayload = dereference_key_locked(key);
  92. if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
  93. up_read(&key->sem);
  94. key_put(key);
  95. key = NULL;
  96. }
  97. return key;
  98. }
  99. static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm,
  100. key_serial_t id, int subclass, struct key **key)
  101. {
  102. *key = NULL;
  103. if (id == 0) {
  104. if (subclass == NVDIMM_BASE_KEY)
  105. return zero_key;
  106. else
  107. return NULL;
  108. }
  109. *key = nvdimm_lookup_user_key(nvdimm, id, subclass);
  110. if (!*key)
  111. return NULL;
  112. return key_data(*key);
  113. }
  114. static int nvdimm_key_revalidate(struct nvdimm *nvdimm)
  115. {
  116. struct key *key;
  117. int rc;
  118. const void *data;
  119. if (!nvdimm->sec.ops->change_key)
  120. return -EOPNOTSUPP;
  121. data = nvdimm_get_key_payload(nvdimm, &key);
  122. /*
  123. * Send the same key to the hardware as new and old key to
  124. * verify that the key is good.
  125. */
  126. rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER);
  127. if (rc < 0) {
  128. nvdimm_put_key(key);
  129. return rc;
  130. }
  131. nvdimm_put_key(key);
  132. nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
  133. return 0;
  134. }
  135. static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
  136. {
  137. struct device *dev = &nvdimm->dev;
  138. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
  139. struct key *key;
  140. const void *data;
  141. int rc;
  142. /* The bus lock should be held at the top level of the call stack */
  143. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  144. if (!nvdimm->sec.ops || !nvdimm->sec.ops->unlock
  145. || !nvdimm->sec.flags)
  146. return -EIO;
  147. /* No need to go further if security is disabled */
  148. if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))
  149. return 0;
  150. if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) {
  151. dev_dbg(dev, "Security operation in progress.\n");
  152. return -EBUSY;
  153. }
  154. /*
  155. * If the pre-OS has unlocked the DIMM, attempt to send the key
  156. * from request_key() to the hardware for verification. Failure
  157. * to revalidate the key against the hardware results in a
  158. * freeze of the security configuration. I.e. if the OS does not
  159. * have the key, security is being managed pre-OS.
  160. */
  161. if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags)) {
  162. if (!key_revalidate)
  163. return 0;
  164. return nvdimm_key_revalidate(nvdimm);
  165. } else
  166. data = nvdimm_get_key_payload(nvdimm, &key);
  167. rc = nvdimm->sec.ops->unlock(nvdimm, data);
  168. dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key),
  169. rc == 0 ? "success" : "fail");
  170. nvdimm_put_key(key);
  171. nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
  172. return rc;
  173. }
  174. int nvdimm_security_unlock(struct device *dev)
  175. {
  176. struct nvdimm *nvdimm = to_nvdimm(dev);
  177. int rc;
  178. nvdimm_bus_lock(dev);
  179. rc = __nvdimm_security_unlock(nvdimm);
  180. nvdimm_bus_unlock(dev);
  181. return rc;
  182. }
  183. static int check_security_state(struct nvdimm *nvdimm)
  184. {
  185. struct device *dev = &nvdimm->dev;
  186. if (test_bit(NVDIMM_SECURITY_FROZEN, &nvdimm->sec.flags)) {
  187. dev_dbg(dev, "Incorrect security state: %#lx\n",
  188. nvdimm->sec.flags);
  189. return -EIO;
  190. }
  191. if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) {
  192. dev_dbg(dev, "Security operation in progress.\n");
  193. return -EBUSY;
  194. }
  195. return 0;
  196. }
  197. static int security_disable(struct nvdimm *nvdimm, unsigned int keyid)
  198. {
  199. struct device *dev = &nvdimm->dev;
  200. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
  201. struct key *key;
  202. int rc;
  203. const void *data;
  204. /* The bus lock should be held at the top level of the call stack */
  205. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  206. if (!nvdimm->sec.ops || !nvdimm->sec.ops->disable
  207. || !nvdimm->sec.flags)
  208. return -EOPNOTSUPP;
  209. rc = check_security_state(nvdimm);
  210. if (rc)
  211. return rc;
  212. data = nvdimm_get_user_key_payload(nvdimm, keyid,
  213. NVDIMM_BASE_KEY, &key);
  214. if (!data)
  215. return -ENOKEY;
  216. rc = nvdimm->sec.ops->disable(nvdimm, data);
  217. dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
  218. rc == 0 ? "success" : "fail");
  219. nvdimm_put_key(key);
  220. nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
  221. return rc;
  222. }
  223. static int security_update(struct nvdimm *nvdimm, unsigned int keyid,
  224. unsigned int new_keyid,
  225. enum nvdimm_passphrase_type pass_type)
  226. {
  227. struct device *dev = &nvdimm->dev;
  228. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
  229. struct key *key, *newkey;
  230. int rc;
  231. const void *data, *newdata;
  232. /* The bus lock should be held at the top level of the call stack */
  233. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  234. if (!nvdimm->sec.ops || !nvdimm->sec.ops->change_key
  235. || !nvdimm->sec.flags)
  236. return -EOPNOTSUPP;
  237. rc = check_security_state(nvdimm);
  238. if (rc)
  239. return rc;
  240. data = nvdimm_get_user_key_payload(nvdimm, keyid,
  241. NVDIMM_BASE_KEY, &key);
  242. if (!data)
  243. return -ENOKEY;
  244. newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid,
  245. NVDIMM_NEW_KEY, &newkey);
  246. if (!newdata) {
  247. nvdimm_put_key(key);
  248. return -ENOKEY;
  249. }
  250. rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type);
  251. dev_dbg(dev, "key: %d %d update%s: %s\n",
  252. key_serial(key), key_serial(newkey),
  253. pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
  254. rc == 0 ? "success" : "fail");
  255. nvdimm_put_key(newkey);
  256. nvdimm_put_key(key);
  257. if (pass_type == NVDIMM_MASTER)
  258. nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm,
  259. NVDIMM_MASTER);
  260. else
  261. nvdimm->sec.flags = nvdimm_security_flags(nvdimm,
  262. NVDIMM_USER);
  263. return rc;
  264. }
  265. static int security_erase(struct nvdimm *nvdimm, unsigned int keyid,
  266. enum nvdimm_passphrase_type pass_type)
  267. {
  268. struct device *dev = &nvdimm->dev;
  269. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
  270. struct key *key = NULL;
  271. int rc;
  272. const void *data;
  273. /* The bus lock should be held at the top level of the call stack */
  274. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  275. if (!nvdimm->sec.ops || !nvdimm->sec.ops->erase
  276. || !nvdimm->sec.flags)
  277. return -EOPNOTSUPP;
  278. rc = check_security_state(nvdimm);
  279. if (rc)
  280. return rc;
  281. if (!test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.ext_flags)
  282. && pass_type == NVDIMM_MASTER) {
  283. dev_dbg(dev,
  284. "Attempt to secure erase in wrong master state.\n");
  285. return -EOPNOTSUPP;
  286. }
  287. data = nvdimm_get_user_key_payload(nvdimm, keyid,
  288. NVDIMM_BASE_KEY, &key);
  289. if (!data)
  290. return -ENOKEY;
  291. rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type);
  292. dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key),
  293. pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
  294. rc == 0 ? "success" : "fail");
  295. nvdimm_put_key(key);
  296. nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
  297. return rc;
  298. }
  299. static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
  300. {
  301. struct device *dev = &nvdimm->dev;
  302. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
  303. struct key *key = NULL;
  304. int rc;
  305. const void *data;
  306. /* The bus lock should be held at the top level of the call stack */
  307. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  308. if (!nvdimm->sec.ops || !nvdimm->sec.ops->overwrite
  309. || !nvdimm->sec.flags)
  310. return -EOPNOTSUPP;
  311. if (dev->driver == NULL) {
  312. dev_dbg(dev, "Unable to overwrite while DIMM active.\n");
  313. return -EINVAL;
  314. }
  315. rc = check_security_state(nvdimm);
  316. if (rc)
  317. return rc;
  318. data = nvdimm_get_user_key_payload(nvdimm, keyid,
  319. NVDIMM_BASE_KEY, &key);
  320. if (!data)
  321. return -ENOKEY;
  322. rc = nvdimm->sec.ops->overwrite(nvdimm, data);
  323. dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key),
  324. rc == 0 ? "success" : "fail");
  325. nvdimm_put_key(key);
  326. if (rc == 0) {
  327. set_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
  328. set_bit(NDD_WORK_PENDING, &nvdimm->flags);
  329. set_bit(NVDIMM_SECURITY_OVERWRITE, &nvdimm->sec.flags);
  330. /*
  331. * Make sure we don't lose device while doing overwrite
  332. * query.
  333. */
  334. get_device(dev);
  335. queue_delayed_work(system_wq, &nvdimm->dwork, 0);
  336. }
  337. return rc;
  338. }
  339. void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
  340. {
  341. struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nvdimm->dev);
  342. int rc;
  343. unsigned int tmo;
  344. /* The bus lock should be held at the top level of the call stack */
  345. lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
  346. /*
  347. * Abort and release device if we no longer have the overwrite
  348. * flag set. It means the work has been canceled.
  349. */
  350. if (!test_bit(NDD_WORK_PENDING, &nvdimm->flags))
  351. return;
  352. tmo = nvdimm->sec.overwrite_tmo;
  353. if (!nvdimm->sec.ops || !nvdimm->sec.ops->query_overwrite
  354. || !nvdimm->sec.flags)
  355. return;
  356. rc = nvdimm->sec.ops->query_overwrite(nvdimm);
  357. if (rc == -EBUSY) {
  358. /* setup delayed work again */
  359. tmo += 10;
  360. queue_delayed_work(system_wq, &nvdimm->dwork, tmo * HZ);
  361. nvdimm->sec.overwrite_tmo = min(15U * 60U, tmo);
  362. return;
  363. }
  364. if (rc < 0)
  365. dev_dbg(&nvdimm->dev, "overwrite failed\n");
  366. else
  367. dev_dbg(&nvdimm->dev, "overwrite completed\n");
  368. /*
  369. * Mark the overwrite work done and update dimm security flags,
  370. * then send a sysfs event notification to wake up userspace
  371. * poll threads to picked up the changed state.
  372. */
  373. nvdimm->sec.overwrite_tmo = 0;
  374. clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
  375. clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
  376. nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
  377. nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
  378. if (nvdimm->sec.overwrite_state)
  379. sysfs_notify_dirent(nvdimm->sec.overwrite_state);
  380. put_device(&nvdimm->dev);
  381. }
  382. void nvdimm_security_overwrite_query(struct work_struct *work)
  383. {
  384. struct nvdimm *nvdimm =
  385. container_of(work, typeof(*nvdimm), dwork.work);
  386. nvdimm_bus_lock(&nvdimm->dev);
  387. __nvdimm_security_overwrite_query(nvdimm);
  388. nvdimm_bus_unlock(&nvdimm->dev);
  389. }
  390. #define OPS \
  391. C( OP_FREEZE, "freeze", 1), \
  392. C( OP_DISABLE, "disable", 2), \
  393. C( OP_UPDATE, "update", 3), \
  394. C( OP_ERASE, "erase", 2), \
  395. C( OP_OVERWRITE, "overwrite", 2), \
  396. C( OP_MASTER_UPDATE, "master_update", 3), \
  397. C( OP_MASTER_ERASE, "master_erase", 2)
  398. #undef C
  399. #define C(a, b, c) a
  400. enum nvdimmsec_op_ids { OPS };
  401. #undef C
  402. #define C(a, b, c) { b, c }
  403. static struct {
  404. const char *name;
  405. int args;
  406. } ops[] = { OPS };
  407. #undef C
  408. #define SEC_CMD_SIZE 32
  409. #define KEY_ID_SIZE 10
  410. ssize_t nvdimm_security_store(struct device *dev, const char *buf, size_t len)
  411. {
  412. struct nvdimm *nvdimm = to_nvdimm(dev);
  413. ssize_t rc;
  414. char cmd[SEC_CMD_SIZE+1], keystr[KEY_ID_SIZE+1],
  415. nkeystr[KEY_ID_SIZE+1];
  416. unsigned int key, newkey;
  417. int i;
  418. rc = sscanf(buf, "%"__stringify(SEC_CMD_SIZE)"s"
  419. " %"__stringify(KEY_ID_SIZE)"s"
  420. " %"__stringify(KEY_ID_SIZE)"s",
  421. cmd, keystr, nkeystr);
  422. if (rc < 1)
  423. return -EINVAL;
  424. for (i = 0; i < ARRAY_SIZE(ops); i++)
  425. if (sysfs_streq(cmd, ops[i].name))
  426. break;
  427. if (i >= ARRAY_SIZE(ops))
  428. return -EINVAL;
  429. if (ops[i].args > 1)
  430. rc = kstrtouint(keystr, 0, &key);
  431. if (rc >= 0 && ops[i].args > 2)
  432. rc = kstrtouint(nkeystr, 0, &newkey);
  433. if (rc < 0)
  434. return rc;
  435. if (i == OP_FREEZE) {
  436. dev_dbg(dev, "freeze\n");
  437. rc = nvdimm_security_freeze(nvdimm);
  438. } else if (i == OP_DISABLE) {
  439. dev_dbg(dev, "disable %u\n", key);
  440. rc = security_disable(nvdimm, key);
  441. } else if (i == OP_UPDATE || i == OP_MASTER_UPDATE) {
  442. dev_dbg(dev, "%s %u %u\n", ops[i].name, key, newkey);
  443. rc = security_update(nvdimm, key, newkey, i == OP_UPDATE
  444. ? NVDIMM_USER : NVDIMM_MASTER);
  445. } else if (i == OP_ERASE || i == OP_MASTER_ERASE) {
  446. dev_dbg(dev, "%s %u\n", ops[i].name, key);
  447. if (atomic_read(&nvdimm->busy)) {
  448. dev_dbg(dev, "Unable to secure erase while DIMM active.\n");
  449. return -EBUSY;
  450. }
  451. rc = security_erase(nvdimm, key, i == OP_ERASE
  452. ? NVDIMM_USER : NVDIMM_MASTER);
  453. } else if (i == OP_OVERWRITE) {
  454. dev_dbg(dev, "overwrite %u\n", key);
  455. if (atomic_read(&nvdimm->busy)) {
  456. dev_dbg(dev, "Unable to overwrite while DIMM active.\n");
  457. return -EBUSY;
  458. }
  459. rc = security_overwrite(nvdimm, key);
  460. } else
  461. return -EINVAL;
  462. if (rc == 0)
  463. rc = len;
  464. return rc;
  465. }