security.c

  1// SPDX-License-Identifier: GPL-2.0
  2/* Copyright(c) 2018 Intel Corporation. All rights reserved. */
  3
  4#include <linux/module.h>
  5#include <linux/device.h>
  6#include <linux/ndctl.h>
  7#include <linux/slab.h>
  8#include <linux/io.h>
  9#include <linux/mm.h>
 10#include <linux/cred.h>
 11#include <linux/key.h>
 12#include <linux/key-type.h>
 13#include <keys/user-type.h>
 14#include <keys/encrypted-type.h>
 15#include "nd-core.h"
 16#include "nd.h"
 17
 18#define NVDIMM_BASE_KEY		0
 19#define NVDIMM_NEW_KEY		1
 20
 21static bool key_revalidate = true;
 22module_param(key_revalidate, bool, 0444);
 23MODULE_PARM_DESC(key_revalidate, "Require key validation at init.");
 24
 25static const char zero_key[NVDIMM_PASSPHRASE_LEN];
 26
 27static void *key_data(struct key *key)
 28{
 29	struct encrypted_key_payload *epayload = dereference_key_locked(key);
 30
 31	lockdep_assert_held_read(&key->sem);
 32
 33	return epayload->decrypted_data;
 34}
 35
 36static void nvdimm_put_key(struct key *key)
 37{
 38	if (!key)
 39		return;
 40
 41	up_read(&key->sem);
 42	key_put(key);
 43}
 44
 45/*
 46 * Retrieve kernel key for DIMM and request from user space if
 47 * necessary. Returns a key held for read and must be put by
 48 * nvdimm_put_key() before the usage goes out of scope.
 49 */
 50static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
 51{
 52	struct key *key = NULL;
 53	static const char NVDIMM_PREFIX[] = "nvdimm:";
 54	char desc[NVDIMM_KEY_DESC_LEN + sizeof(NVDIMM_PREFIX)];
 55	struct device *dev = &nvdimm->dev;
 56
 57	sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id);
 58	key = request_key(&key_type_encrypted, desc, "");
 59	if (IS_ERR(key)) {
 60		if (PTR_ERR(key) == -ENOKEY)
 61			dev_dbg(dev, "request_key() found no key\n");
 62		else
 63			dev_dbg(dev, "request_key() upcall failed\n");
 64		key = NULL;
 65	} else {
 66		struct encrypted_key_payload *epayload;
 67
 68		down_read(&key->sem);
 69		epayload = dereference_key_locked(key);
 70		if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
 71			up_read(&key->sem);
 72			key_put(key);
 73			key = NULL;
 74		}
 75	}
 76
 77	return key;
 78}
 79
 80static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm,
 81		struct key **key)
 82{
 83	*key = nvdimm_request_key(nvdimm);
 84	if (!*key)
 85		return zero_key;
 86
 87	return key_data(*key);
 88}
 89
 90static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
 91		key_serial_t id, int subclass)
 92{
 93	key_ref_t keyref;
 94	struct key *key;
 95	struct encrypted_key_payload *epayload;
 96	struct device *dev = &nvdimm->dev;
 97
 98	keyref = lookup_user_key(id, 0, KEY_NEED_SEARCH);
 99	if (IS_ERR(keyref))
100		return NULL;
101
102	key = key_ref_to_ptr(keyref);
103	if (key->type != &key_type_encrypted) {
104		key_put(key);
105		return NULL;
106	}
107
108	dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key));
109
110	down_read_nested(&key->sem, subclass);
111	epayload = dereference_key_locked(key);
112	if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
113		up_read(&key->sem);
114		key_put(key);
115		key = NULL;
116	}
117	return key;
118}
119
120static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm,
121		key_serial_t id, int subclass, struct key **key)
122{
123	*key = NULL;
124	if (id == 0) {
125		if (subclass == NVDIMM_BASE_KEY)
126			return zero_key;
127		else
128			return NULL;
129	}
130
131	*key = nvdimm_lookup_user_key(nvdimm, id, subclass);
132	if (!*key)
133		return NULL;
134
135	return key_data(*key);
136}
137
138
139static int nvdimm_key_revalidate(struct nvdimm *nvdimm)
140{
141	struct key *key;
142	int rc;
143	const void *data;
144
145	if (!nvdimm->sec.ops->change_key)
146		return -EOPNOTSUPP;
147
148	data = nvdimm_get_key_payload(nvdimm, &key);
149
150	/*
151	 * Send the same key to the hardware as new and old key to
152	 * verify that the key is good.
153	 */
154	rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER);
155	if (rc < 0) {
156		nvdimm_put_key(key);
157		return rc;
158	}
159
160	nvdimm_put_key(key);
161	nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
162	return 0;
163}
164
165static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
166{
167	struct device *dev = &nvdimm->dev;
168	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
169	struct key *key;
170	const void *data;
171	int rc;
172
173	/* The bus lock should be held at the top level of the call stack */
174	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
175
176	if (!nvdimm->sec.ops || !nvdimm->sec.ops->unlock
177			|| !nvdimm->sec.flags)
178		return -EIO;
179
180	/* cxl_test needs this to pre-populate the security state */
181	if (IS_ENABLED(CONFIG_NVDIMM_SECURITY_TEST))
182		nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
183
184	/* No need to go further if security is disabled */
185	if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))
186		return 0;
187
188	if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) {
189		dev_dbg(dev, "Security operation in progress.\n");
190		return -EBUSY;
191	}
192
193	/*
194	 * If the pre-OS has unlocked the DIMM, attempt to send the key
195	 * from request_key() to the hardware for verification.  Failure
196	 * to revalidate the key against the hardware results in a
197	 * freeze of the security configuration. I.e. if the OS does not
198	 * have the key, security is being managed pre-OS.
199	 */
200	if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags)) {
201		if (!key_revalidate)
202			return 0;
203
204		return nvdimm_key_revalidate(nvdimm);
205	} else
206		data = nvdimm_get_key_payload(nvdimm, &key);
207
208	rc = nvdimm->sec.ops->unlock(nvdimm, data);
209	dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key),
210			rc == 0 ? "success" : "fail");
211	if (rc == 0)
212		set_bit(NDD_INCOHERENT, &nvdimm->flags);
213
214	nvdimm_put_key(key);
215	nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
216	return rc;
217}
218
219int nvdimm_security_unlock(struct device *dev)
220{
221	struct nvdimm *nvdimm = to_nvdimm(dev);
222
223	guard(nvdimm_bus)(dev);
224	return __nvdimm_security_unlock(nvdimm);
225}
226
227static int check_security_state(struct nvdimm *nvdimm)
228{
229	struct device *dev = &nvdimm->dev;
230
231	if (test_bit(NVDIMM_SECURITY_FROZEN, &nvdimm->sec.flags)) {
232		dev_dbg(dev, "Incorrect security state: %#lx\n",
233				nvdimm->sec.flags);
234		return -EIO;
235	}
236
237	if (test_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags)) {
238		dev_dbg(dev, "Security operation in progress.\n");
239		return -EBUSY;
240	}
241
242	return 0;
243}
244
245static int security_disable(struct nvdimm *nvdimm, unsigned int keyid,
246			    enum nvdimm_passphrase_type pass_type)
247{
248	struct device *dev = &nvdimm->dev;
249	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
250	struct key *key;
251	int rc;
252	const void *data;
253
254	/* The bus lock should be held at the top level of the call stack */
255	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
256
257	if (!nvdimm->sec.ops || !nvdimm->sec.flags)
258		return -EOPNOTSUPP;
259
260	if (pass_type == NVDIMM_USER && !nvdimm->sec.ops->disable)
261		return -EOPNOTSUPP;
262
263	if (pass_type == NVDIMM_MASTER && !nvdimm->sec.ops->disable_master)
264		return -EOPNOTSUPP;
265
266	rc = check_security_state(nvdimm);
267	if (rc)
268		return rc;
269
270	data = nvdimm_get_user_key_payload(nvdimm, keyid,
271			NVDIMM_BASE_KEY, &key);
272	if (!data)
273		return -ENOKEY;
274
275	if (pass_type == NVDIMM_MASTER) {
276		rc = nvdimm->sec.ops->disable_master(nvdimm, data);
277		dev_dbg(dev, "key: %d disable_master: %s\n", key_serial(key),
278			rc == 0 ? "success" : "fail");
279	} else {
280		rc = nvdimm->sec.ops->disable(nvdimm, data);
281		dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
282			rc == 0 ? "success" : "fail");
283	}
284
285	nvdimm_put_key(key);
286	if (pass_type == NVDIMM_MASTER)
287		nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
288	else
289		nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
290	return rc;
291}
292
293static int security_update(struct nvdimm *nvdimm, unsigned int keyid,
294		unsigned int new_keyid,
295		enum nvdimm_passphrase_type pass_type)
296{
297	struct device *dev = &nvdimm->dev;
298	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
299	struct key *key, *newkey;
300	int rc;
301	const void *data, *newdata;
302
303	/* The bus lock should be held at the top level of the call stack */
304	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
305
306	if (!nvdimm->sec.ops || !nvdimm->sec.ops->change_key
307			|| !nvdimm->sec.flags)
308		return -EOPNOTSUPP;
309
310	rc = check_security_state(nvdimm);
311	if (rc)
312		return rc;
313
314	data = nvdimm_get_user_key_payload(nvdimm, keyid,
315			NVDIMM_BASE_KEY, &key);
316	if (!data)
317		return -ENOKEY;
318
319	newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid,
320			NVDIMM_NEW_KEY, &newkey);
321	if (!newdata) {
322		nvdimm_put_key(key);
323		return -ENOKEY;
324	}
325
326	rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type);
327	dev_dbg(dev, "key: %d %d update%s: %s\n",
328			key_serial(key), key_serial(newkey),
329			pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
330			rc == 0 ? "success" : "fail");
331
332	nvdimm_put_key(newkey);
333	nvdimm_put_key(key);
334	if (pass_type == NVDIMM_MASTER)
335		nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm,
336				NVDIMM_MASTER);
337	else
338		nvdimm->sec.flags = nvdimm_security_flags(nvdimm,
339				NVDIMM_USER);
340	return rc;
341}
342
343static int security_erase(struct nvdimm *nvdimm, unsigned int keyid,
344		enum nvdimm_passphrase_type pass_type)
345{
346	struct device *dev = &nvdimm->dev;
347	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
348	struct key *key = NULL;
349	int rc;
350	const void *data;
351
352	/* The bus lock should be held at the top level of the call stack */
353	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
354
355	if (!nvdimm->sec.ops || !nvdimm->sec.ops->erase
356			|| !nvdimm->sec.flags)
357		return -EOPNOTSUPP;
358
359	rc = check_security_state(nvdimm);
360	if (rc)
361		return rc;
362
363	if (!test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.ext_flags)
364			&& pass_type == NVDIMM_MASTER) {
365		dev_dbg(dev,
366			"Attempt to secure erase in wrong master state.\n");
367		return -EOPNOTSUPP;
368	}
369
370	data = nvdimm_get_user_key_payload(nvdimm, keyid,
371			NVDIMM_BASE_KEY, &key);
372	if (!data)
373		return -ENOKEY;
374
375	rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type);
376	if (rc == 0)
377		set_bit(NDD_INCOHERENT, &nvdimm->flags);
378	dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key),
379			pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
380			rc == 0 ? "success" : "fail");
381
382	nvdimm_put_key(key);
383	nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
384	return rc;
385}
386
387static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
388{
389	struct device *dev = &nvdimm->dev;
390	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
391	struct key *key = NULL;
392	int rc;
393	const void *data;
394
395	/* The bus lock should be held at the top level of the call stack */
396	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
397
398	if (!nvdimm->sec.ops || !nvdimm->sec.ops->overwrite
399			|| !nvdimm->sec.flags)
400		return -EOPNOTSUPP;
401
402	rc = check_security_state(nvdimm);
403	if (rc)
404		return rc;
405
406	data = nvdimm_get_user_key_payload(nvdimm, keyid,
407			NVDIMM_BASE_KEY, &key);
408	if (!data)
409		return -ENOKEY;
410
411	rc = nvdimm->sec.ops->overwrite(nvdimm, data);
412	if (rc == 0)
413		set_bit(NDD_INCOHERENT, &nvdimm->flags);
414	dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key),
415			rc == 0 ? "success" : "fail");
416
417	nvdimm_put_key(key);
418	if (rc == 0) {
419		set_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
420		set_bit(NDD_WORK_PENDING, &nvdimm->flags);
421		set_bit(NVDIMM_SECURITY_OVERWRITE, &nvdimm->sec.flags);
422		/*
423		 * Make sure we don't lose device while doing overwrite
424		 * query.
425		 */
426		get_device(dev);
427		queue_delayed_work(system_percpu_wq, &nvdimm->dwork, 0);
428	}
429
430	return rc;
431}
432
433static void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
434{
435	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nvdimm->dev);
436	int rc;
437	unsigned int tmo;
438
439	/* The bus lock should be held at the top level of the call stack */
440	lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
441
442	/*
443	 * Abort and release device if we no longer have the overwrite
444	 * flag set. It means the work has been canceled.
445	 */
446	if (!test_bit(NDD_WORK_PENDING, &nvdimm->flags))
447		return;
448
449	tmo = nvdimm->sec.overwrite_tmo;
450
451	if (!nvdimm->sec.ops || !nvdimm->sec.ops->query_overwrite
452			|| !nvdimm->sec.flags)
453		return;
454
455	rc = nvdimm->sec.ops->query_overwrite(nvdimm);
456	if (rc == -EBUSY) {
457
458		/* setup delayed work again */
459		tmo += 10;
460		queue_delayed_work(system_percpu_wq, &nvdimm->dwork, tmo * HZ);
461		nvdimm->sec.overwrite_tmo = min(15U * 60U, tmo);
462		return;
463	}
464
465	if (rc < 0)
466		dev_dbg(&nvdimm->dev, "overwrite failed\n");
467	else
468		dev_dbg(&nvdimm->dev, "overwrite completed\n");
469
470	/*
471	 * Mark the overwrite work done and update dimm security flags,
472	 * then send a sysfs event notification to wake up userspace
473	 * poll threads to picked up the changed state.
474	 */
475	nvdimm->sec.overwrite_tmo = 0;
476	clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
477	clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
478	nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
479	nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
480	if (nvdimm->sec.overwrite_state)
481		sysfs_notify_dirent(nvdimm->sec.overwrite_state);
482	put_device(&nvdimm->dev);
483}
484
485void nvdimm_security_overwrite_query(struct work_struct *work)
486{
487	struct nvdimm *nvdimm =
488		container_of(work, typeof(*nvdimm), dwork.work);
489
490	guard(nvdimm_bus)(&nvdimm->dev);
491	__nvdimm_security_overwrite_query(nvdimm);
492}
493
494#define OPS							\
495	C( OP_FREEZE,		"freeze",		1),	\
496	C( OP_DISABLE,		"disable",		2),	\
497	C( OP_DISABLE_MASTER,	"disable_master",	2),	\
498	C( OP_UPDATE,		"update",		3),	\
499	C( OP_ERASE,		"erase",		2),	\
500	C( OP_OVERWRITE,	"overwrite",		2),	\
501	C( OP_MASTER_UPDATE,	"master_update",	3),	\
502	C( OP_MASTER_ERASE,	"master_erase",		2)
503#undef C
504#define C(a, b, c) a
505enum nvdimmsec_op_ids { OPS };
506#undef C
507#define C(a, b, c) { b, c }
508static struct {
509	const char *name;
510	int args;
511} ops[] = { OPS };
512#undef C
513
514#define SEC_CMD_SIZE 32
515#define KEY_ID_SIZE 10
516
517ssize_t nvdimm_security_store(struct device *dev, const char *buf, size_t len)
518{
519	struct nvdimm *nvdimm = to_nvdimm(dev);
520	ssize_t rc;
521	char cmd[SEC_CMD_SIZE+1], keystr[KEY_ID_SIZE+1],
522		nkeystr[KEY_ID_SIZE+1];
523	unsigned int key, newkey;
524	int i;
525
526	rc = sscanf(buf, "%"__stringify(SEC_CMD_SIZE)"s"
527			" %"__stringify(KEY_ID_SIZE)"s"
528			" %"__stringify(KEY_ID_SIZE)"s",
529			cmd, keystr, nkeystr);
530	if (rc < 1)
531		return -EINVAL;
532	for (i = 0; i < ARRAY_SIZE(ops); i++)
533		if (sysfs_streq(cmd, ops[i].name))
534			break;
535	if (i >= ARRAY_SIZE(ops))
536		return -EINVAL;
537	if (ops[i].args > 1)
538		rc = kstrtouint(keystr, 0, &key);
539	if (rc >= 0 && ops[i].args > 2)
540		rc = kstrtouint(nkeystr, 0, &newkey);
541	if (rc < 0)
542		return rc;
543
544	if (i == OP_FREEZE) {
545		dev_dbg(dev, "freeze\n");
546		rc = nvdimm_security_freeze(nvdimm);
547	} else if (i == OP_DISABLE) {
548		dev_dbg(dev, "disable %u\n", key);
549		rc = security_disable(nvdimm, key, NVDIMM_USER);
550	} else if (i == OP_DISABLE_MASTER) {
551		dev_dbg(dev, "disable_master %u\n", key);
552		rc = security_disable(nvdimm, key, NVDIMM_MASTER);
553	} else if (i == OP_UPDATE || i == OP_MASTER_UPDATE) {
554		dev_dbg(dev, "%s %u %u\n", ops[i].name, key, newkey);
555		rc = security_update(nvdimm, key, newkey, i == OP_UPDATE
556				? NVDIMM_USER : NVDIMM_MASTER);
557	} else if (i == OP_ERASE || i == OP_MASTER_ERASE) {
558		dev_dbg(dev, "%s %u\n", ops[i].name, key);
559		if (atomic_read(&nvdimm->busy)) {
560			dev_dbg(dev, "Unable to secure erase while DIMM active.\n");
561			return -EBUSY;
562		}
563		rc = security_erase(nvdimm, key, i == OP_ERASE
564				? NVDIMM_USER : NVDIMM_MASTER);
565	} else if (i == OP_OVERWRITE) {
566		dev_dbg(dev, "overwrite %u\n", key);
567		if (atomic_read(&nvdimm->busy)) {
568			dev_dbg(dev, "Unable to overwrite while DIMM active.\n");
569			return -EBUSY;
570		}
571		rc = security_overwrite(nvdimm, key);
572	} else
573		return -EINVAL;
574
575	if (rc == 0)
576		rc = len;
577	return rc;
578}