1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright(c) 2018 Intel Corporation. All rights reserved. */ 3 4 #include <linux/module.h> 5 #include <linux/device.h> 6 #include <linux/ndctl.h> 7 #include <linux/slab.h> 8 #include <linux/io.h> 9 #include <linux/mm.h> 10 #include <linux/cred.h> 11 #include <linux/key.h> 12 #include <linux/key-type.h> 13 #include <keys/user-type.h> 14 #include <keys/encrypted-type.h> 15 #include "nd-core.h" 16 #include "nd.h" 17 18 #define NVDIMM_BASE_KEY 0 19 #define NVDIMM_NEW_KEY 1 20 21 static bool key_revalidate = true; 22 module_param(key_revalidate, bool, 0444); 23 MODULE_PARM_DESC(key_revalidate, "Require key validation at init."); 24 25 static const char zero_key[NVDIMM_PASSPHRASE_LEN]; 26 27 static void *key_data(struct key *key) 28 { 29 struct encrypted_key_payload *epayload = dereference_key_locked(key); 30 31 lockdep_assert_held_read(&key->sem); 32 33 return epayload->decrypted_data; 34 } 35 36 static void nvdimm_put_key(struct key *key) 37 { 38 if (!key) 39 return; 40 41 up_read(&key->sem); 42 key_put(key); 43 } 44 45 /* 46 * Retrieve kernel key for DIMM and request from user space if 47 * necessary. Returns a key held for read and must be put by 48 * nvdimm_put_key() before the usage goes out of scope. 49 */ 50 static struct key *nvdimm_request_key(struct nvdimm *nvdimm) 51 { 52 struct key *key = NULL; 53 static const char NVDIMM_PREFIX[] = "nvdimm:"; 54 char desc[NVDIMM_KEY_DESC_LEN + sizeof(NVDIMM_PREFIX)]; 55 struct device *dev = &nvdimm->dev; 56 57 sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id); 58 key = request_key(&key_type_encrypted, desc, ""); 59 if (IS_ERR(key)) { 60 if (PTR_ERR(key) == -ENOKEY) 61 dev_dbg(dev, "request_key() found no key\n"); 62 else 63 dev_dbg(dev, "request_key() upcall failed\n"); 64 key = NULL; 65 } else { 66 struct encrypted_key_payload *epayload; 67 68 down_read(&key->sem); 69 epayload = dereference_key_locked(key); 70 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 71 up_read(&key->sem); 72 key_put(key); 73 key = NULL; 74 } 75 } 76 77 return key; 78 } 79 80 static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm, 81 struct key **key) 82 { 83 *key = nvdimm_request_key(nvdimm); 84 if (!*key) 85 return zero_key; 86 87 return key_data(*key); 88 } 89 90 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm, 91 key_serial_t id, int subclass) 92 { 93 key_ref_t keyref; 94 struct key *key; 95 struct encrypted_key_payload *epayload; 96 struct device *dev = &nvdimm->dev; 97 98 keyref = lookup_user_key(id, 0, KEY_NEED_SEARCH); 99 if (IS_ERR(keyref)) 100 return NULL; 101 102 key = key_ref_to_ptr(keyref); 103 if (key->type != &key_type_encrypted) { 104 key_put(key); 105 return NULL; 106 } 107 108 dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key)); 109 110 down_read_nested(&key->sem, subclass); 111 epayload = dereference_key_locked(key); 112 if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) { 113 up_read(&key->sem); 114 key_put(key); 115 key = NULL; 116 } 117 return key; 118 } 119 120 static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm, 121 key_serial_t id, int subclass, struct key **key) 122 { 123 *key = NULL; 124 if (id == 0) { 125 if (subclass == NVDIMM_BASE_KEY) 126 return zero_key; 127 else 128 return NULL; 129 } 130 131 *key = nvdimm_lookup_user_key(nvdimm, id, subclass); 132 if (!*key) 133 return NULL; 134 135 return key_data(*key); 136 } 137 138 139 static int nvdimm_key_revalidate(struct nvdimm *nvdimm) 140 { 141 struct key *key; 142 int rc; 143 const void *data; 144 145 if (!nvdimm->sec.ops->change_key) 146 return -EOPNOTSUPP; 147 148 data = nvdimm_get_key_payload(nvdimm, &key); 149 150 /* 151 * Send the same key to the hardware as new and old key to 152 * verify that the key is good. 153 */ 154 rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER); 155 if (rc < 0) { 156 nvdimm_put_key(key); 157 return rc; 158 } 159 160 nvdimm_put_key(key); 161 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 162 return 0; 163 } 164 165 static int __nvdimm_security_unlock(struct nvdimm *nvdimm) 166 { 167 struct device *dev = &nvdimm->dev; 168 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 169 struct key *key; 170 const void *data; 171 int rc; 172 173 /* The bus lock should be held at the top level of the call stack */ 174 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 175 176 if (!nvdimm->sec.ops || !nvdimm->sec.ops->unlock 177 || !nvdimm->sec.flags) 178 return -EIO; 179 180 /* No need to go further if security is disabled */ 181 if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags)) 182 return 0; 183 184 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 185 dev_dbg(dev, "Security operation in progress.\n"); 186 return -EBUSY; 187 } 188 189 /* 190 * If the pre-OS has unlocked the DIMM, attempt to send the key 191 * from request_key() to the hardware for verification. Failure 192 * to revalidate the key against the hardware results in a 193 * freeze of the security configuration. I.e. if the OS does not 194 * have the key, security is being managed pre-OS. 195 */ 196 if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags)) { 197 if (!key_revalidate) 198 return 0; 199 200 return nvdimm_key_revalidate(nvdimm); 201 } else 202 data = nvdimm_get_key_payload(nvdimm, &key); 203 204 rc = nvdimm->sec.ops->unlock(nvdimm, data); 205 dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key), 206 rc == 0 ? "success" : "fail"); 207 208 nvdimm_put_key(key); 209 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 210 return rc; 211 } 212 213 int nvdimm_security_unlock(struct device *dev) 214 { 215 struct nvdimm *nvdimm = to_nvdimm(dev); 216 int rc; 217 218 nvdimm_bus_lock(dev); 219 rc = __nvdimm_security_unlock(nvdimm); 220 nvdimm_bus_unlock(dev); 221 return rc; 222 } 223 224 static int check_security_state(struct nvdimm *nvdimm) 225 { 226 struct device *dev = &nvdimm->dev; 227 228 if (test_bit(NVDIMM_SECURITY_FROZEN, &nvdimm->sec.flags)) { 229 dev_dbg(dev, "Incorrect security state: %#lx\n", 230 nvdimm->sec.flags); 231 return -EIO; 232 } 233 234 if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) { 235 dev_dbg(dev, "Security operation in progress.\n"); 236 return -EBUSY; 237 } 238 239 return 0; 240 } 241 242 static int security_disable(struct nvdimm *nvdimm, unsigned int keyid) 243 { 244 struct device *dev = &nvdimm->dev; 245 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 246 struct key *key; 247 int rc; 248 const void *data; 249 250 /* The bus lock should be held at the top level of the call stack */ 251 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 252 253 if (!nvdimm->sec.ops || !nvdimm->sec.ops->disable 254 || !nvdimm->sec.flags) 255 return -EOPNOTSUPP; 256 257 rc = check_security_state(nvdimm); 258 if (rc) 259 return rc; 260 261 data = nvdimm_get_user_key_payload(nvdimm, keyid, 262 NVDIMM_BASE_KEY, &key); 263 if (!data) 264 return -ENOKEY; 265 266 rc = nvdimm->sec.ops->disable(nvdimm, data); 267 dev_dbg(dev, "key: %d disable: %s\n", key_serial(key), 268 rc == 0 ? "success" : "fail"); 269 270 nvdimm_put_key(key); 271 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 272 return rc; 273 } 274 275 static int security_update(struct nvdimm *nvdimm, unsigned int keyid, 276 unsigned int new_keyid, 277 enum nvdimm_passphrase_type pass_type) 278 { 279 struct device *dev = &nvdimm->dev; 280 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 281 struct key *key, *newkey; 282 int rc; 283 const void *data, *newdata; 284 285 /* The bus lock should be held at the top level of the call stack */ 286 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 287 288 if (!nvdimm->sec.ops || !nvdimm->sec.ops->change_key 289 || !nvdimm->sec.flags) 290 return -EOPNOTSUPP; 291 292 rc = check_security_state(nvdimm); 293 if (rc) 294 return rc; 295 296 data = nvdimm_get_user_key_payload(nvdimm, keyid, 297 NVDIMM_BASE_KEY, &key); 298 if (!data) 299 return -ENOKEY; 300 301 newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid, 302 NVDIMM_NEW_KEY, &newkey); 303 if (!newdata) { 304 nvdimm_put_key(key); 305 return -ENOKEY; 306 } 307 308 rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type); 309 dev_dbg(dev, "key: %d %d update%s: %s\n", 310 key_serial(key), key_serial(newkey), 311 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 312 rc == 0 ? "success" : "fail"); 313 314 nvdimm_put_key(newkey); 315 nvdimm_put_key(key); 316 if (pass_type == NVDIMM_MASTER) 317 nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, 318 NVDIMM_MASTER); 319 else 320 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, 321 NVDIMM_USER); 322 return rc; 323 } 324 325 static int security_erase(struct nvdimm *nvdimm, unsigned int keyid, 326 enum nvdimm_passphrase_type pass_type) 327 { 328 struct device *dev = &nvdimm->dev; 329 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 330 struct key *key = NULL; 331 int rc; 332 const void *data; 333 334 /* The bus lock should be held at the top level of the call stack */ 335 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 336 337 if (!nvdimm->sec.ops || !nvdimm->sec.ops->erase 338 || !nvdimm->sec.flags) 339 return -EOPNOTSUPP; 340 341 rc = check_security_state(nvdimm); 342 if (rc) 343 return rc; 344 345 if (!test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.ext_flags) 346 && pass_type == NVDIMM_MASTER) { 347 dev_dbg(dev, 348 "Attempt to secure erase in wrong master state.\n"); 349 return -EOPNOTSUPP; 350 } 351 352 data = nvdimm_get_user_key_payload(nvdimm, keyid, 353 NVDIMM_BASE_KEY, &key); 354 if (!data) 355 return -ENOKEY; 356 357 rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type); 358 dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key), 359 pass_type == NVDIMM_MASTER ? "(master)" : "(user)", 360 rc == 0 ? "success" : "fail"); 361 362 nvdimm_put_key(key); 363 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 364 return rc; 365 } 366 367 static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid) 368 { 369 struct device *dev = &nvdimm->dev; 370 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); 371 struct key *key = NULL; 372 int rc; 373 const void *data; 374 375 /* The bus lock should be held at the top level of the call stack */ 376 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 377 378 if (!nvdimm->sec.ops || !nvdimm->sec.ops->overwrite 379 || !nvdimm->sec.flags) 380 return -EOPNOTSUPP; 381 382 if (dev->driver == NULL) { 383 dev_dbg(dev, "Unable to overwrite while DIMM active.\n"); 384 return -EINVAL; 385 } 386 387 rc = check_security_state(nvdimm); 388 if (rc) 389 return rc; 390 391 data = nvdimm_get_user_key_payload(nvdimm, keyid, 392 NVDIMM_BASE_KEY, &key); 393 if (!data) 394 return -ENOKEY; 395 396 rc = nvdimm->sec.ops->overwrite(nvdimm, data); 397 dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key), 398 rc == 0 ? "success" : "fail"); 399 400 nvdimm_put_key(key); 401 if (rc == 0) { 402 set_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 403 set_bit(NDD_WORK_PENDING, &nvdimm->flags); 404 set_bit(NVDIMM_SECURITY_OVERWRITE, &nvdimm->sec.flags); 405 /* 406 * Make sure we don't lose device while doing overwrite 407 * query. 408 */ 409 get_device(dev); 410 queue_delayed_work(system_wq, &nvdimm->dwork, 0); 411 } 412 413 return rc; 414 } 415 416 void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) 417 { 418 struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nvdimm->dev); 419 int rc; 420 unsigned int tmo; 421 422 /* The bus lock should be held at the top level of the call stack */ 423 lockdep_assert_held(&nvdimm_bus->reconfig_mutex); 424 425 /* 426 * Abort and release device if we no longer have the overwrite 427 * flag set. It means the work has been canceled. 428 */ 429 if (!test_bit(NDD_WORK_PENDING, &nvdimm->flags)) 430 return; 431 432 tmo = nvdimm->sec.overwrite_tmo; 433 434 if (!nvdimm->sec.ops || !nvdimm->sec.ops->query_overwrite 435 || !nvdimm->sec.flags) 436 return; 437 438 rc = nvdimm->sec.ops->query_overwrite(nvdimm); 439 if (rc == -EBUSY) { 440 441 /* setup delayed work again */ 442 tmo += 10; 443 queue_delayed_work(system_wq, &nvdimm->dwork, tmo * HZ); 444 nvdimm->sec.overwrite_tmo = min(15U * 60U, tmo); 445 return; 446 } 447 448 if (rc < 0) 449 dev_dbg(&nvdimm->dev, "overwrite failed\n"); 450 else 451 dev_dbg(&nvdimm->dev, "overwrite completed\n"); 452 453 /* 454 * Mark the overwrite work done and update dimm security flags, 455 * then send a sysfs event notification to wake up userspace 456 * poll threads to picked up the changed state. 457 */ 458 nvdimm->sec.overwrite_tmo = 0; 459 clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); 460 clear_bit(NDD_WORK_PENDING, &nvdimm->flags); 461 nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); 462 nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); 463 if (nvdimm->sec.overwrite_state) 464 sysfs_notify_dirent(nvdimm->sec.overwrite_state); 465 put_device(&nvdimm->dev); 466 } 467 468 void nvdimm_security_overwrite_query(struct work_struct *work) 469 { 470 struct nvdimm *nvdimm = 471 container_of(work, typeof(*nvdimm), dwork.work); 472 473 nvdimm_bus_lock(&nvdimm->dev); 474 __nvdimm_security_overwrite_query(nvdimm); 475 nvdimm_bus_unlock(&nvdimm->dev); 476 } 477 478 #define OPS \ 479 C( OP_FREEZE, "freeze", 1), \ 480 C( OP_DISABLE, "disable", 2), \ 481 C( OP_UPDATE, "update", 3), \ 482 C( OP_ERASE, "erase", 2), \ 483 C( OP_OVERWRITE, "overwrite", 2), \ 484 C( OP_MASTER_UPDATE, "master_update", 3), \ 485 C( OP_MASTER_ERASE, "master_erase", 2) 486 #undef C 487 #define C(a, b, c) a 488 enum nvdimmsec_op_ids { OPS }; 489 #undef C 490 #define C(a, b, c) { b, c } 491 static struct { 492 const char *name; 493 int args; 494 } ops[] = { OPS }; 495 #undef C 496 497 #define SEC_CMD_SIZE 32 498 #define KEY_ID_SIZE 10 499 500 ssize_t nvdimm_security_store(struct device *dev, const char *buf, size_t len) 501 { 502 struct nvdimm *nvdimm = to_nvdimm(dev); 503 ssize_t rc; 504 char cmd[SEC_CMD_SIZE+1], keystr[KEY_ID_SIZE+1], 505 nkeystr[KEY_ID_SIZE+1]; 506 unsigned int key, newkey; 507 int i; 508 509 rc = sscanf(buf, "%"__stringify(SEC_CMD_SIZE)"s" 510 " %"__stringify(KEY_ID_SIZE)"s" 511 " %"__stringify(KEY_ID_SIZE)"s", 512 cmd, keystr, nkeystr); 513 if (rc < 1) 514 return -EINVAL; 515 for (i = 0; i < ARRAY_SIZE(ops); i++) 516 if (sysfs_streq(cmd, ops[i].name)) 517 break; 518 if (i >= ARRAY_SIZE(ops)) 519 return -EINVAL; 520 if (ops[i].args > 1) 521 rc = kstrtouint(keystr, 0, &key); 522 if (rc >= 0 && ops[i].args > 2) 523 rc = kstrtouint(nkeystr, 0, &newkey); 524 if (rc < 0) 525 return rc; 526 527 if (i == OP_FREEZE) { 528 dev_dbg(dev, "freeze\n"); 529 rc = nvdimm_security_freeze(nvdimm); 530 } else if (i == OP_DISABLE) { 531 dev_dbg(dev, "disable %u\n", key); 532 rc = security_disable(nvdimm, key); 533 } else if (i == OP_UPDATE || i == OP_MASTER_UPDATE) { 534 dev_dbg(dev, "%s %u %u\n", ops[i].name, key, newkey); 535 rc = security_update(nvdimm, key, newkey, i == OP_UPDATE 536 ? NVDIMM_USER : NVDIMM_MASTER); 537 } else if (i == OP_ERASE || i == OP_MASTER_ERASE) { 538 dev_dbg(dev, "%s %u\n", ops[i].name, key); 539 if (atomic_read(&nvdimm->busy)) { 540 dev_dbg(dev, "Unable to secure erase while DIMM active.\n"); 541 return -EBUSY; 542 } 543 rc = security_erase(nvdimm, key, i == OP_ERASE 544 ? NVDIMM_USER : NVDIMM_MASTER); 545 } else if (i == OP_OVERWRITE) { 546 dev_dbg(dev, "overwrite %u\n", key); 547 if (atomic_read(&nvdimm->busy)) { 548 dev_dbg(dev, "Unable to overwrite while DIMM active.\n"); 549 return -EBUSY; 550 } 551 rc = security_overwrite(nvdimm, key); 552 } else 553 return -EINVAL; 554 555 if (rc == 0) 556 rc = len; 557 return rc; 558 } 559