1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright(c) 2018 Intel Corporation. All rights reserved. */ 3 4 #include <linux/module.h> 5 #include <linux/device.h> 6 #include <linux/ndctl.h> 7 #include <linux/slab.h> 8 #include <linux/io.h> 9 #include <linux/mm.h> 10 #include <linux/cred.h> 11 #include <linux/key.h> 12 #include <linux/key-type.h> 13 #include <keys/user-type.h> 14 #include <keys/encrypted-type.h> 15 #include "nd-core.h" 16 #include "nd.h" 17 18 #define NVDIMM_BASE_KEY 0 19 #define NVDIMM_NEW_KEY 1 20 21 static bool key_revalidate = true; 22 module_param(key_revalidate, bool, 0444); 23 MODULE_PARM_DESC(key_revalidate, "Require key validation at init."); 24 25 static const char zero_key[NVDIMM_PASSPHRASE_LEN]; 26 27 static void *key_data(struct key *key) 28 { 29 struct encrypted_key_payload *epayload = dereference_key_locked(key); 30 31 lockdep_assert_held_read(&key->sem); 32 33 return epayload->decrypted_data; 34 } 35 36 static void nvdimm_put_key(struct key *key) 37 { 38 if (!key) 39 return; 40 41 up_read(&key->sem); 42 key_put(key); 43 } 44 45 /* 46 * Retrieve kernel key for DIMM and request from user space if 47 * necessary. Returns a key held for read and must be put by 48 * nvdimm_put_key() before the usage goes out of scope. 49 */ 50 static struct key *nvdimm_request_key(struct nvdimm *nvdimm) 51 { 52 struct key *key = NULL; 53 static const char NVDIMM_PREFIX[] = "nvdimm:"; 54 char desc[NVDIMM_KEY_DESC_LEN + sizeof(NVDIMM_PREFIX)]; 55 struct device *dev = &nvdimm->dev; 56 57 sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id); 58 key = request_key(&key_type_encrypted, desc, ""); 59 if (IS_ERR(key)) { 60 if (PTR_ERR(key) == -ENOKEY) 61 dev_dbg(dev, "request_key() found no key\n"); 62 else 63 dev_dbg(dev, "request_key() upcall failed\n"); 64 key = NULL; 65 } else { 66 struct encrypted_key_payload *epayload; 67 68 down_read(&key->sem); 69 epayload = dereference_key_locked(key); 70 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 71 up_read(&key->sem); 72 key_put(key); 73 key = NULL; 74 } 75 } 76 77 return key; 78 } 79 80 static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm, 81 struct key **key) 82 { 83 *key = nvdimm_request_key(nvdimm); 84 if (!*key) 85 return zero_key; 86 87 return key_data(*key); 88 } 89 90 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm, 91 key_serial_t id, int subclass) 92 { 93 key_ref_t keyref; 94 struct key *key; 95 struct encrypted_key_payload *epayload; 96 struct device *dev = &nvdimm->dev; 97 98 keyref = lookup_user_key(id, 0, KEY_NEED_SEARCH); 99 if (IS_ERR(keyref)) 100 return NULL; 101 102 key = key_ref_to_ptr(keyref); 103 if (key->type != &key_type_encrypted) { 104 key_put(key); 105 return NULL; 106 } 107 108 dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key)); 109 110 down_read_nested(&key->sem, subclass); 111 epayload = dereference_key_locked(key); 112 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 113 up_read(&key->sem); 114 key_put(key); 115 key = NULL; 116 } 117 return key; 118 } 119 120 static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm, 121 key_serial_t id, int subclass, struct key **key) 122 { 123 *key = NULL; 124 if (id == 0) { 125 if (subclass == NVDIMM_BASE_KEY) 126 return zero_key; 127 else 128 return NULL; 129 } 130 131 *key = nvdimm_lookup_user_key(nvdimm, id, subclass); 132 if (!*key) 133 return NULL; 134 135 return key_data(*key); 136 } 137 138 139 static int nvdimm_key_revalidate(struct nvdimm *nvdimm) 140 { 141 struct key *key; 142 int rc; 143 const void *data; 144 145 if (!nvdimm->sec.ops->change_key) 146 return -EOPNOTSUPP; 147 148 data = nvdimm_get_key_payload(nvdimm, &key); 149 150 /* 151 * Send the same key to the hardware as new and old key to 152 * verify that the key is good. 153 */ 154 rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER); 155 if (rc < 0) { 156 nvdimm_put_key(key); 157 return rc; 158 } 159 160 nvdimm_put_key(key); 161 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 162 return 0; 163 } 164 165 static int __nvdimm_security_unlock(struct nvdimm *nvdimm) 166 { 167 struct device *dev = &nvdimm->dev; 168 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 169 struct key *key; 170 const void *data; 171 int rc; 172 173 /* The bus lock should be held at the top level of the call stack */ 174 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 175 176 if (!nvdimm->sec.ops || !nvdimm->sec.ops->unlock 177 || !nvdimm->sec.flags) 178 return -EIO; 179 180 /* cxl_test needs this to pre-populate the security state */ 181 if (IS_ENABLED(CONFIG_NVDIMM_SECURITY_TEST)) 182 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 183 184 /* No need to go further if security is disabled */ 185 if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags)) 186 return 0; 187 188 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 189 dev_dbg(dev, "Security operation in progress.\n"); 190 return -EBUSY; 191 } 192 193 /* 194 * If the pre-OS has unlocked the DIMM, attempt to send the key 195 * from request_key() to the hardware for verification. Failure 196 * to revalidate the key against the hardware results in a 197 * freeze of the security configuration. I.e. if the OS does not 198 * have the key, security is being managed pre-OS. 199 */ 200 if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags)) { 201 if (!key_revalidate) 202 return 0; 203 204 return nvdimm_key_revalidate(nvdimm); 205 } else 206 data = nvdimm_get_key_payload(nvdimm, &key); 207 208 rc = nvdimm->sec.ops->unlock(nvdimm, data); 209 dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key), 210 rc == 0 ? "success" : "fail"); 211 212 nvdimm_put_key(key); 213 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 214 return rc; 215 } 216 217 int nvdimm_security_unlock(struct device *dev) 218 { 219 struct nvdimm *nvdimm = to_nvdimm(dev); 220 int rc; 221 222 nvdimm_bus_lock(dev); 223 rc = __nvdimm_security_unlock(nvdimm); 224 nvdimm_bus_unlock(dev); 225 return rc; 226 } 227 228 static int check_security_state(struct nvdimm *nvdimm) 229 { 230 struct device *dev = &nvdimm->dev; 231 232 if (test_bit(NVDIMM_SECURITY_FROZEN, &nvdimm->sec.flags)) { 233 dev_dbg(dev, "Incorrect security state: %#lx\n", 234 nvdimm->sec.flags); 235 return -EIO; 236 } 237 238 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 239 dev_dbg(dev, "Security operation in progress.\n"); 240 return -EBUSY; 241 } 242 243 return 0; 244 } 245 246 static int security_disable(struct nvdimm *nvdimm, unsigned int keyid, 247 enum nvdimm_passphrase_type pass_type) 248 { 249 struct device *dev = &nvdimm->dev; 250 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 251 struct key *key; 252 int rc; 253 const void *data; 254 255 /* The bus lock should be held at the top level of the call stack */ 256 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 257 258 if (!nvdimm->sec.ops || !nvdimm->sec.flags) 259 return -EOPNOTSUPP; 260 261 if (pass_type == NVDIMM_USER && !nvdimm->sec.ops->disable) 262 return -EOPNOTSUPP; 263 264 if (pass_type == NVDIMM_MASTER && !nvdimm->sec.ops->disable_master) 265 return -EOPNOTSUPP; 266 267 rc = check_security_state(nvdimm); 268 if (rc) 269 return rc; 270 271 data = nvdimm_get_user_key_payload(nvdimm, keyid, 272 NVDIMM_BASE_KEY, &key); 273 if (!data) 274 return -ENOKEY; 275 276 if (pass_type == NVDIMM_MASTER) { 277 rc = nvdimm->sec.ops->disable_master(nvdimm, data); 278 dev_dbg(dev, "key: %d disable_master: %s\n", key_serial(key), 279 rc == 0 ? "success" : "fail"); 280 } else { 281 rc = nvdimm->sec.ops->disable(nvdimm, data); 282 dev_dbg(dev, "key: %d disable: %s\n", key_serial(key), 283 rc == 0 ? "success" : "fail"); 284 } 285 286 nvdimm_put_key(key); 287 if (pass_type == NVDIMM_MASTER) 288 nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); 289 else 290 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 291 return rc; 292 } 293 294 static int security_update(struct nvdimm *nvdimm, unsigned int keyid, 295 unsigned int new_keyid, 296 enum nvdimm_passphrase_type pass_type) 297 { 298 struct device *dev = &nvdimm->dev; 299 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 300 struct key *key, *newkey; 301 int rc; 302 const void *data, *newdata; 303 304 /* The bus lock should be held at the top level of the call stack */ 305 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 306 307 if (!nvdimm->sec.ops || !nvdimm->sec.ops->change_key 308 || !nvdimm->sec.flags) 309 return -EOPNOTSUPP; 310 311 rc = check_security_state(nvdimm); 312 if (rc) 313 return rc; 314 315 data = nvdimm_get_user_key_payload(nvdimm, keyid, 316 NVDIMM_BASE_KEY, &key); 317 if (!data) 318 return -ENOKEY; 319 320 newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid, 321 NVDIMM_NEW_KEY, &newkey); 322 if (!newdata) { 323 nvdimm_put_key(key); 324 return -ENOKEY; 325 } 326 327 rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type); 328 dev_dbg(dev, "key: %d %d update%s: %s\n", 329 key_serial(key), key_serial(newkey), 330 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 331 rc == 0 ? "success" : "fail"); 332 333 nvdimm_put_key(newkey); 334 nvdimm_put_key(key); 335 if (pass_type == NVDIMM_MASTER) 336 nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, 337 NVDIMM_MASTER); 338 else 339 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, 340 NVDIMM_USER); 341 return rc; 342 } 343 344 static int security_erase(struct nvdimm *nvdimm, unsigned int keyid, 345 enum nvdimm_passphrase_type pass_type) 346 { 347 struct device *dev = &nvdimm->dev; 348 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 349 struct key *key = NULL; 350 int rc; 351 const void *data; 352 353 /* The bus lock should be held at the top level of the call stack */ 354 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 355 356 if (!nvdimm->sec.ops || !nvdimm->sec.ops->erase 357 || !nvdimm->sec.flags) 358 return -EOPNOTSUPP; 359 360 rc = check_security_state(nvdimm); 361 if (rc) 362 return rc; 363 364 if (!test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.ext_flags) 365 && pass_type == NVDIMM_MASTER) { 366 dev_dbg(dev, 367 "Attempt to secure erase in wrong master state.\n"); 368 return -EOPNOTSUPP; 369 } 370 371 data = nvdimm_get_user_key_payload(nvdimm, keyid, 372 NVDIMM_BASE_KEY, &key); 373 if (!data) 374 return -ENOKEY; 375 376 rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type); 377 dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key), 378 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 379 rc == 0 ? "success" : "fail"); 380 381 nvdimm_put_key(key); 382 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 383 return rc; 384 } 385 386 static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid) 387 { 388 struct device *dev = &nvdimm->dev; 389 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 390 struct key *key = NULL; 391 int rc; 392 const void *data; 393 394 /* The bus lock should be held at the top level of the call stack */ 395 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 396 397 if (!nvdimm->sec.ops || !nvdimm->sec.ops->overwrite 398 || !nvdimm->sec.flags) 399 return -EOPNOTSUPP; 400 401 rc = check_security_state(nvdimm); 402 if (rc) 403 return rc; 404 405 data = nvdimm_get_user_key_payload(nvdimm, keyid, 406 NVDIMM_BASE_KEY, &key); 407 if (!data) 408 return -ENOKEY; 409 410 rc = nvdimm->sec.ops->overwrite(nvdimm, data); 411 dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key), 412 rc == 0 ? "success" : "fail"); 413 414 nvdimm_put_key(key); 415 if (rc == 0) { 416 set_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 417 set_bit(NDD_WORK_PENDING, &nvdimm->flags); 418 set_bit(NVDIMM_SECURITY_OVERWRITE, &nvdimm->sec.flags); 419 /* 420 * Make sure we don't lose device while doing overwrite 421 * query. 422 */ 423 get_device(dev); 424 queue_delayed_work(system_wq, &nvdimm->dwork, 0); 425 } 426 427 return rc; 428 } 429 430 static void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) 431 { 432 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nvdimm->dev); 433 int rc; 434 unsigned int tmo; 435 436 /* The bus lock should be held at the top level of the call stack */ 437 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 438 439 /* 440 * Abort and release device if we no longer have the overwrite 441 * flag set. It means the work has been canceled. 442 */ 443 if (!test_bit(NDD_WORK_PENDING, &nvdimm->flags)) 444 return; 445 446 tmo = nvdimm->sec.overwrite_tmo; 447 448 if (!nvdimm->sec.ops || !nvdimm->sec.ops->query_overwrite 449 || !nvdimm->sec.flags) 450 return; 451 452 rc = nvdimm->sec.ops->query_overwrite(nvdimm); 453 if (rc == -EBUSY) { 454 455 /* setup delayed work again */ 456 tmo += 10; 457 queue_delayed_work(system_wq, &nvdimm->dwork, tmo * HZ); 458 nvdimm->sec.overwrite_tmo = min(15U * 60U, tmo); 459 return; 460 } 461 462 if (rc < 0) 463 dev_dbg(&nvdimm->dev, "overwrite failed\n"); 464 else 465 dev_dbg(&nvdimm->dev, "overwrite completed\n"); 466 467 /* 468 * Mark the overwrite work done and update dimm security flags, 469 * then send a sysfs event notification to wake up userspace 470 * poll threads to picked up the changed state. 471 */ 472 nvdimm->sec.overwrite_tmo = 0; 473 clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 474 clear_bit(NDD_WORK_PENDING, &nvdimm->flags); 475 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 476 nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); 477 if (nvdimm->sec.overwrite_state) 478 sysfs_notify_dirent(nvdimm->sec.overwrite_state); 479 put_device(&nvdimm->dev); 480 } 481 482 void nvdimm_security_overwrite_query(struct work_struct *work) 483 { 484 struct nvdimm *nvdimm = 485 container_of(work, typeof(*nvdimm), dwork.work); 486 487 nvdimm_bus_lock(&nvdimm->dev); 488 __nvdimm_security_overwrite_query(nvdimm); 489 nvdimm_bus_unlock(&nvdimm->dev); 490 } 491 492 #define OPS \ 493 C( OP_FREEZE, "freeze", 1), \ 494 C( OP_DISABLE, "disable", 2), \ 495 C( OP_DISABLE_MASTER, "disable_master", 2), \ 496 C( OP_UPDATE, "update", 3), \ 497 C( OP_ERASE, "erase", 2), \ 498 C( OP_OVERWRITE, "overwrite", 2), \ 499 C( OP_MASTER_UPDATE, "master_update", 3), \ 500 C( OP_MASTER_ERASE, "master_erase", 2) 501 #undef C 502 #define C(a, b, c) a 503 enum nvdimmsec_op_ids { OPS }; 504 #undef C 505 #define C(a, b, c) { b, c } 506 static struct { 507 const char *name; 508 int args; 509 } ops[] = { OPS }; 510 #undef C 511 512 #define SEC_CMD_SIZE 32 513 #define KEY_ID_SIZE 10 514 515 ssize_t nvdimm_security_store(struct device *dev, const char *buf, size_t len) 516 { 517 struct nvdimm *nvdimm = to_nvdimm(dev); 518 ssize_t rc; 519 char cmd[SEC_CMD_SIZE+1], keystr[KEY_ID_SIZE+1], 520 nkeystr[KEY_ID_SIZE+1]; 521 unsigned int key, newkey; 522 int i; 523 524 rc = sscanf(buf, "%"__stringify(SEC_CMD_SIZE)"s" 525 " %"__stringify(KEY_ID_SIZE)"s" 526 " %"__stringify(KEY_ID_SIZE)"s", 527 cmd, keystr, nkeystr); 528 if (rc < 1) 529 return -EINVAL; 530 for (i = 0; i < ARRAY_SIZE(ops); i++) 531 if (sysfs_streq(cmd, ops[i].name)) 532 break; 533 if (i >= ARRAY_SIZE(ops)) 534 return -EINVAL; 535 if (ops[i].args > 1) 536 rc = kstrtouint(keystr, 0, &key); 537 if (rc >= 0 && ops[i].args > 2) 538 rc = kstrtouint(nkeystr, 0, &newkey); 539 if (rc < 0) 540 return rc; 541 542 if (i == OP_FREEZE) { 543 dev_dbg(dev, "freeze\n"); 544 rc = nvdimm_security_freeze(nvdimm); 545 } else if (i == OP_DISABLE) { 546 dev_dbg(dev, "disable %u\n", key); 547 rc = security_disable(nvdimm, key, NVDIMM_USER); 548 } else if (i == OP_DISABLE_MASTER) { 549 dev_dbg(dev, "disable_master %u\n", key); 550 rc = security_disable(nvdimm, key, NVDIMM_MASTER); 551 } else if (i == OP_UPDATE || i == OP_MASTER_UPDATE) { 552 dev_dbg(dev, "%s %u %u\n", ops[i].name, key, newkey); 553 rc = security_update(nvdimm, key, newkey, i == OP_UPDATE 554 ? NVDIMM_USER : NVDIMM_MASTER); 555 } else if (i == OP_ERASE || i == OP_MASTER_ERASE) { 556 dev_dbg(dev, "%s %u\n", ops[i].name, key); 557 if (atomic_read(&nvdimm->busy)) { 558 dev_dbg(dev, "Unable to secure erase while DIMM active.\n"); 559 return -EBUSY; 560 } 561 rc = security_erase(nvdimm, key, i == OP_ERASE 562 ? NVDIMM_USER : NVDIMM_MASTER); 563 } else if (i == OP_OVERWRITE) { 564 dev_dbg(dev, "overwrite %u\n", key); 565 if (atomic_read(&nvdimm->busy)) { 566 dev_dbg(dev, "Unable to overwrite while DIMM active.\n"); 567 return -EBUSY; 568 } 569 rc = security_overwrite(nvdimm, key); 570 } else 571 return -EINVAL; 572 573 if (rc == 0) 574 rc = len; 575 return rc; 576 } 577