1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright(c) 2018 Intel Corporation. All rights reserved. */ 3 4 #include <linux/module.h> 5 #include <linux/device.h> 6 #include <linux/ndctl.h> 7 #include <linux/slab.h> 8 #include <linux/io.h> 9 #include <linux/mm.h> 10 #include <linux/cred.h> 11 #include <linux/key.h> 12 #include <linux/key-type.h> 13 #include <keys/user-type.h> 14 #include <keys/encrypted-type.h> 15 #include "nd-core.h" 16 #include "nd.h" 17 18 #define NVDIMM_BASE_KEY 0 19 #define NVDIMM_NEW_KEY 1 20 21 static bool key_revalidate = true; 22 module_param(key_revalidate, bool, 0444); 23 MODULE_PARM_DESC(key_revalidate, "Require key validation at init."); 24 25 static void *key_data(struct key *key) 26 { 27 struct encrypted_key_payload *epayload = dereference_key_locked(key); 28 29 lockdep_assert_held_read(&key->sem); 30 31 return epayload->decrypted_data; 32 } 33 34 static void nvdimm_put_key(struct key *key) 35 { 36 if (!key) 37 return; 38 39 up_read(&key->sem); 40 key_put(key); 41 } 42 43 /* 44 * Retrieve kernel key for DIMM and request from user space if 45 * necessary. Returns a key held for read and must be put by 46 * nvdimm_put_key() before the usage goes out of scope. 47 */ 48 static struct key *nvdimm_request_key(struct nvdimm *nvdimm) 49 { 50 struct key *key = NULL; 51 static const char NVDIMM_PREFIX[] = "nvdimm:"; 52 char desc[NVDIMM_KEY_DESC_LEN + sizeof(NVDIMM_PREFIX)]; 53 struct device *dev = &nvdimm->dev; 54 55 sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id); 56 key = request_key(&key_type_encrypted, desc, ""); 57 if (IS_ERR(key)) { 58 if (PTR_ERR(key) == -ENOKEY) 59 dev_dbg(dev, "request_key() found no key\n"); 60 else 61 dev_dbg(dev, "request_key() upcall failed\n"); 62 key = NULL; 63 } else { 64 struct encrypted_key_payload *epayload; 65 66 down_read(&key->sem); 67 epayload = dereference_key_locked(key); 68 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 69 up_read(&key->sem); 70 key_put(key); 71 key = NULL; 72 } 73 } 74 75 return key; 76 } 77 78 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm, 79 key_serial_t id, int subclass) 80 { 81 key_ref_t keyref; 82 struct key *key; 83 struct encrypted_key_payload *epayload; 84 struct device *dev = &nvdimm->dev; 85 86 keyref = lookup_user_key(id, 0, 0); 87 if (IS_ERR(keyref)) 88 return NULL; 89 90 key = key_ref_to_ptr(keyref); 91 if (key->type != &key_type_encrypted) { 92 key_put(key); 93 return NULL; 94 } 95 96 dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key)); 97 98 down_read_nested(&key->sem, subclass); 99 epayload = dereference_key_locked(key); 100 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 101 up_read(&key->sem); 102 key_put(key); 103 key = NULL; 104 } 105 return key; 106 } 107 108 static struct key *nvdimm_key_revalidate(struct nvdimm *nvdimm) 109 { 110 struct key *key; 111 int rc; 112 113 if (!nvdimm->sec.ops->change_key) 114 return NULL; 115 116 key = nvdimm_request_key(nvdimm); 117 if (!key) 118 return NULL; 119 120 /* 121 * Send the same key to the hardware as new and old key to 122 * verify that the key is good. 123 */ 124 rc = nvdimm->sec.ops->change_key(nvdimm, key_data(key), 125 key_data(key), NVDIMM_USER); 126 if (rc < 0) { 127 nvdimm_put_key(key); 128 key = NULL; 129 } 130 return key; 131 } 132 133 static int __nvdimm_security_unlock(struct nvdimm *nvdimm) 134 { 135 struct device *dev = &nvdimm->dev; 136 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 137 struct key *key = NULL; 138 int rc; 139 140 /* The bus lock should be held at the top level of the call stack */ 141 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 142 143 if (!nvdimm->sec.ops || !nvdimm->sec.ops->unlock 144 || nvdimm->sec.state < 0) 145 return -EIO; 146 147 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 148 dev_dbg(dev, "Security operation in progress.\n"); 149 return -EBUSY; 150 } 151 152 /* 153 * If the pre-OS has unlocked the DIMM, attempt to send the key 154 * from request_key() to the hardware for verification. Failure 155 * to revalidate the key against the hardware results in a 156 * freeze of the security configuration. I.e. if the OS does not 157 * have the key, security is being managed pre-OS. 158 */ 159 if (nvdimm->sec.state == NVDIMM_SECURITY_UNLOCKED) { 160 if (!key_revalidate) 161 return 0; 162 163 key = nvdimm_key_revalidate(nvdimm); 164 if (!key) 165 return nvdimm_security_freeze(nvdimm); 166 } else 167 key = nvdimm_request_key(nvdimm); 168 169 if (!key) 170 return -ENOKEY; 171 172 rc = nvdimm->sec.ops->unlock(nvdimm, key_data(key)); 173 dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key), 174 rc == 0 ? "success" : "fail"); 175 176 nvdimm_put_key(key); 177 nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER); 178 return rc; 179 } 180 181 int nvdimm_security_unlock(struct device *dev) 182 { 183 struct nvdimm *nvdimm = to_nvdimm(dev); 184 int rc; 185 186 nvdimm_bus_lock(dev); 187 rc = __nvdimm_security_unlock(nvdimm); 188 nvdimm_bus_unlock(dev); 189 return rc; 190 } 191 192 int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid) 193 { 194 struct device *dev = &nvdimm->dev; 195 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 196 struct key *key; 197 int rc; 198 199 /* The bus lock should be held at the top level of the call stack */ 200 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 201 202 if (!nvdimm->sec.ops || !nvdimm->sec.ops->disable 203 || nvdimm->sec.state < 0) 204 return -EOPNOTSUPP; 205 206 if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) { 207 dev_dbg(dev, "Incorrect security state: %d\n", 208 nvdimm->sec.state); 209 return -EIO; 210 } 211 212 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 213 dev_dbg(dev, "Security operation in progress.\n"); 214 return -EBUSY; 215 } 216 217 key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY); 218 if (!key) 219 return -ENOKEY; 220 221 rc = nvdimm->sec.ops->disable(nvdimm, key_data(key)); 222 dev_dbg(dev, "key: %d disable: %s\n", key_serial(key), 223 rc == 0 ? "success" : "fail"); 224 225 nvdimm_put_key(key); 226 nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER); 227 return rc; 228 } 229 230 int nvdimm_security_update(struct nvdimm *nvdimm, unsigned int keyid, 231 unsigned int new_keyid, 232 enum nvdimm_passphrase_type pass_type) 233 { 234 struct device *dev = &nvdimm->dev; 235 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 236 struct key *key, *newkey; 237 int rc; 238 239 /* The bus lock should be held at the top level of the call stack */ 240 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 241 242 if (!nvdimm->sec.ops || !nvdimm->sec.ops->change_key 243 || nvdimm->sec.state < 0) 244 return -EOPNOTSUPP; 245 246 if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) { 247 dev_dbg(dev, "Incorrect security state: %d\n", 248 nvdimm->sec.state); 249 return -EIO; 250 } 251 252 if (keyid == 0) 253 key = NULL; 254 else { 255 key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY); 256 if (!key) 257 return -ENOKEY; 258 } 259 260 newkey = nvdimm_lookup_user_key(nvdimm, new_keyid, NVDIMM_NEW_KEY); 261 if (!newkey) { 262 nvdimm_put_key(key); 263 return -ENOKEY; 264 } 265 266 rc = nvdimm->sec.ops->change_key(nvdimm, key ? key_data(key) : NULL, 267 key_data(newkey), pass_type); 268 dev_dbg(dev, "key: %d %d update%s: %s\n", 269 key_serial(key), key_serial(newkey), 270 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 271 rc == 0 ? "success" : "fail"); 272 273 nvdimm_put_key(newkey); 274 nvdimm_put_key(key); 275 if (pass_type == NVDIMM_MASTER) 276 nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, 277 NVDIMM_MASTER); 278 else 279 nvdimm->sec.state = nvdimm_security_state(nvdimm, 280 NVDIMM_USER); 281 return rc; 282 } 283 284 int nvdimm_security_erase(struct nvdimm *nvdimm, unsigned int keyid, 285 enum nvdimm_passphrase_type pass_type) 286 { 287 struct device *dev = &nvdimm->dev; 288 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 289 struct key *key; 290 int rc; 291 292 /* The bus lock should be held at the top level of the call stack */ 293 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 294 295 if (!nvdimm->sec.ops || !nvdimm->sec.ops->erase 296 || nvdimm->sec.state < 0) 297 return -EOPNOTSUPP; 298 299 if (atomic_read(&nvdimm->busy)) { 300 dev_dbg(dev, "Unable to secure erase while DIMM active.\n"); 301 return -EBUSY; 302 } 303 304 if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) { 305 dev_dbg(dev, "Incorrect security state: %d\n", 306 nvdimm->sec.state); 307 return -EIO; 308 } 309 310 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 311 dev_dbg(dev, "Security operation in progress.\n"); 312 return -EBUSY; 313 } 314 315 if (nvdimm->sec.ext_state != NVDIMM_SECURITY_UNLOCKED 316 && pass_type == NVDIMM_MASTER) { 317 dev_dbg(dev, 318 "Attempt to secure erase in wrong master state.\n"); 319 return -EOPNOTSUPP; 320 } 321 322 key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY); 323 if (!key) 324 return -ENOKEY; 325 326 rc = nvdimm->sec.ops->erase(nvdimm, key_data(key), pass_type); 327 dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key), 328 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 329 rc == 0 ? "success" : "fail"); 330 331 nvdimm_put_key(key); 332 nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER); 333 return rc; 334 } 335 336 int nvdimm_security_overwrite(struct nvdimm *nvdimm, unsigned int keyid) 337 { 338 struct device *dev = &nvdimm->dev; 339 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 340 struct key *key; 341 int rc; 342 343 /* The bus lock should be held at the top level of the call stack */ 344 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 345 346 if (!nvdimm->sec.ops || !nvdimm->sec.ops->overwrite 347 || nvdimm->sec.state < 0) 348 return -EOPNOTSUPP; 349 350 if (atomic_read(&nvdimm->busy)) { 351 dev_dbg(dev, "Unable to overwrite while DIMM active.\n"); 352 return -EBUSY; 353 } 354 355 if (dev->driver == NULL) { 356 dev_dbg(dev, "Unable to overwrite while DIMM active.\n"); 357 return -EINVAL; 358 } 359 360 if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) { 361 dev_dbg(dev, "Incorrect security state: %d\n", 362 nvdimm->sec.state); 363 return -EIO; 364 } 365 366 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 367 dev_dbg(dev, "Security operation in progress.\n"); 368 return -EBUSY; 369 } 370 371 if (keyid == 0) 372 key = NULL; 373 else { 374 key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY); 375 if (!key) 376 return -ENOKEY; 377 } 378 379 rc = nvdimm->sec.ops->overwrite(nvdimm, key ? key_data(key) : NULL); 380 dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key), 381 rc == 0 ? "success" : "fail"); 382 383 nvdimm_put_key(key); 384 if (rc == 0) { 385 set_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 386 set_bit(NDD_WORK_PENDING, &nvdimm->flags); 387 nvdimm->sec.state = NVDIMM_SECURITY_OVERWRITE; 388 /* 389 * Make sure we don't lose device while doing overwrite 390 * query. 391 */ 392 get_device(dev); 393 queue_delayed_work(system_wq, &nvdimm->dwork, 0); 394 } 395 396 return rc; 397 } 398 399 void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) 400 { 401 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nvdimm->dev); 402 int rc; 403 unsigned int tmo; 404 405 /* The bus lock should be held at the top level of the call stack */ 406 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 407 408 /* 409 * Abort and release device if we no longer have the overwrite 410 * flag set. It means the work has been canceled. 411 */ 412 if (!test_bit(NDD_WORK_PENDING, &nvdimm->flags)) 413 return; 414 415 tmo = nvdimm->sec.overwrite_tmo; 416 417 if (!nvdimm->sec.ops || !nvdimm->sec.ops->query_overwrite 418 || nvdimm->sec.state < 0) 419 return; 420 421 rc = nvdimm->sec.ops->query_overwrite(nvdimm); 422 if (rc == -EBUSY) { 423 424 /* setup delayed work again */ 425 tmo += 10; 426 queue_delayed_work(system_wq, &nvdimm->dwork, tmo * HZ); 427 nvdimm->sec.overwrite_tmo = min(15U * 60U, tmo); 428 return; 429 } 430 431 if (rc < 0) 432 dev_dbg(&nvdimm->dev, "overwrite failed\n"); 433 else 434 dev_dbg(&nvdimm->dev, "overwrite completed\n"); 435 436 if (nvdimm->sec.overwrite_state) 437 sysfs_notify_dirent(nvdimm->sec.overwrite_state); 438 nvdimm->sec.overwrite_tmo = 0; 439 clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 440 clear_bit(NDD_WORK_PENDING, &nvdimm->flags); 441 put_device(&nvdimm->dev); 442 nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER); 443 nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, NVDIMM_MASTER); 444 } 445 446 void nvdimm_security_overwrite_query(struct work_struct *work) 447 { 448 struct nvdimm *nvdimm = 449 container_of(work, typeof(*nvdimm), dwork.work); 450 451 nvdimm_bus_lock(&nvdimm->dev); 452 __nvdimm_security_overwrite_query(nvdimm); 453 nvdimm_bus_unlock(&nvdimm->dev); 454 } 455