From: Dave Jiang <dave.jiang@intel.com> To: dan.j.williams@intel.com Cc: dhowells@redhat.com, alison.schofield@intel.com, keyrings@vger.kernel.org, keescook@chromium.org, linux-nvdimm@lists.01.org Subject: [PATCH 06/11] nfit/libnvdimm: add disable passphrase support to Intel nvdimm. Date: Mon, 02 Jul 2018 16:39:40 -0700 [thread overview] Message-ID: <153057478052.38125.4677218866266067369.stgit@djiang5-desk3.ch.intel.com> (raw) In-Reply-To: <153057423804.38125.15912575101400055843.stgit@djiang5-desk3.ch.intel.com> Adding support to disable passphrase (security) for the Intel nvdimm. The passphrase used for disabling is pulled from userspace via the kernel key management. The action is triggered by writing "disable" to the sysfs attribute "security". libnvdimm will support the generic disable API call. Signed-off-by: Dave Jiang <dave.jiang@intel.com> --- drivers/acpi/nfit/intel.c | 51 ++++++++++++++++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 41 +++++++++++++++++++++++++++++++++++ include/linux/libnvdimm.h | 2 ++ 3 files changed, 94 insertions(+) diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c index 792a5c694a9e..6d73493f02cc 100644 --- a/drivers/acpi/nfit/intel.c +++ b/drivers/acpi/nfit/intel.c @@ -16,6 +16,56 @@ #include <acpi/nfit.h> #include "nfit.h" +static int intel_dimm_security_disable(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm, const char *pass) +{ + struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus); + int cmd_rc, rc = 0, pkg_size; + struct nd_intel_disable_passphrase *cmd; + struct nd_cmd_pkg *pkg; + struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm); + + if (!test_bit(NVDIMM_INTEL_DISABLE_PASSPHRASE, &nfit_mem->dsm_mask)) + return -ENOTTY; + + pkg_size = sizeof(*pkg) + sizeof(*cmd); + pkg = kzalloc(pkg_size, GFP_KERNEL); + if (!pkg) + return -ENOMEM; + + pkg->nd_command = NVDIMM_INTEL_DISABLE_PASSPHRASE; + pkg->nd_family = NVDIMM_FAMILY_INTEL; + pkg->nd_size_in = ND_INTEL_PASSPHRASE_SIZE; + pkg->nd_size_out = ND_INTEL_STATUS_SIZE; + pkg->nd_fw_size = pkg->nd_size_out; + cmd = (struct nd_intel_disable_passphrase *)&pkg->nd_payload; + memcpy(cmd->passphrase, pass, ND_INTEL_PASSPHRASE_SIZE); + rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_CALL, pkg, + sizeof(pkg_size), &cmd_rc); + if (rc < 0) + goto out; + if (cmd_rc < 0) { + rc = cmd_rc; + goto out; + } + + switch (cmd->status) { + case 0: + break; + case ND_INTEL_STATUS_INVALID_PASS: + rc = -EINVAL; + goto out; + case ND_INTEL_STATUS_INVALID_STATE: + default: + rc = -ENXIO; + goto out; + } + + out: + kfree(pkg); + return rc; +} + static int intel_dimm_security_update_passphrase( struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const char *old_pass, const char *new_pass) @@ -193,4 +243,5 @@ struct nvdimm_security_ops intel_security_ops = { .state = intel_dimm_security_state, .unlock = intel_dimm_security_unlock, .change_key = intel_dimm_security_update_passphrase, + .disable = intel_dimm_security_disable, }; diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c index d3d738c77adb..070811cb4cdc 100644 --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -85,6 +85,45 @@ int nvdimm_security_get_state(struct device *dev) &nvdimm->state); } +static int nvdimm_security_disable(struct device *dev) +{ + struct nvdimm *nvdimm = to_nvdimm(dev); + struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); + struct key *key; + int rc; + char *payload; + bool cached_key = false; + + if (!nvdimm->security_ops) + return 0; + + if (nvdimm->state == NVDIMM_SECURITY_UNSUPPORTED) + return 0; + + key = nvdimm_search_key(dev); + if (!key) + key = nvdimm_request_key(dev); + else + cached_key = true; + if (!key) + return -ENXIO; + + down_read(&key->sem); + payload = key->payload.data[0]; + rc = nvdimm->security_ops->disable(nvdimm_bus, nvdimm, payload); + up_read(&key->sem); + if (rc < 0) + goto out; + + /* If we succeed then remove the key */ + key_invalidate(key); + + out: + key_put(key); + nvdimm_security_get_state(dev); + return rc; +} + int nvdimm_security_unlock_dimm(struct device *dev) { struct nvdimm *nvdimm = to_nvdimm(dev); @@ -587,6 +626,8 @@ static ssize_t security_store(struct device *dev, if (strcmp(buf, "update") == 0 || strcmp(buf, "update\n") == 0) rc = nvdimm_security_change_key(dev); + else if (strcmp(buf, "disable") == 0 || strcmp(buf, "disable\n") == 0) + rc = nvdimm_security_disable(dev); else return -EINVAL; diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h index 7b609409042c..0990dfd5a0a3 100644 --- a/include/linux/libnvdimm.h +++ b/include/linux/libnvdimm.h @@ -177,6 +177,8 @@ struct nvdimm_security_ops { int (*change_key)(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const char *old_pass, const char *new_pass); + int (*disable)(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm, const char *pass); }; void badrange_init(struct badrange *badrange); _______________________________________________ Linux-nvdimm mailing list Linux-nvdimm@lists.01.org https://lists.01.org/mailman/listinfo/linux-nvdimm
WARNING: multiple messages have this Message-ID (diff)
From: Dave Jiang <dave.jiang@intel.com> To: dan.j.williams@intel.com Cc: dhowells@redhat.com, alison.schofield@intel.com, keyrings@vger.kernel.org, keescook@chromium.org, linux-nvdimm@lists.01.org Subject: [PATCH 06/11] nfit/libnvdimm: add disable passphrase support to Intel nvdimm. Date: Mon, 02 Jul 2018 23:39:40 +0000 [thread overview] Message-ID: <153057478052.38125.4677218866266067369.stgit@djiang5-desk3.ch.intel.com> (raw) In-Reply-To: <153057423804.38125.15912575101400055843.stgit@djiang5-desk3.ch.intel.com> Adding support to disable passphrase (security) for the Intel nvdimm. The passphrase used for disabling is pulled from userspace via the kernel key management. The action is triggered by writing "disable" to the sysfs attribute "security". libnvdimm will support the generic disable API call. Signed-off-by: Dave Jiang <dave.jiang@intel.com> --- drivers/acpi/nfit/intel.c | 51 ++++++++++++++++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 41 +++++++++++++++++++++++++++++++++++ include/linux/libnvdimm.h | 2 ++ 3 files changed, 94 insertions(+) diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c index 792a5c694a9e..6d73493f02cc 100644 --- a/drivers/acpi/nfit/intel.c +++ b/drivers/acpi/nfit/intel.c @@ -16,6 +16,56 @@ #include <acpi/nfit.h> #include "nfit.h" +static int intel_dimm_security_disable(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm, const char *pass) +{ + struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus); + int cmd_rc, rc = 0, pkg_size; + struct nd_intel_disable_passphrase *cmd; + struct nd_cmd_pkg *pkg; + struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm); + + if (!test_bit(NVDIMM_INTEL_DISABLE_PASSPHRASE, &nfit_mem->dsm_mask)) + return -ENOTTY; + + pkg_size = sizeof(*pkg) + sizeof(*cmd); + pkg = kzalloc(pkg_size, GFP_KERNEL); + if (!pkg) + return -ENOMEM; + + pkg->nd_command = NVDIMM_INTEL_DISABLE_PASSPHRASE; + pkg->nd_family = NVDIMM_FAMILY_INTEL; + pkg->nd_size_in = ND_INTEL_PASSPHRASE_SIZE; + pkg->nd_size_out = ND_INTEL_STATUS_SIZE; + pkg->nd_fw_size = pkg->nd_size_out; + cmd = (struct nd_intel_disable_passphrase *)&pkg->nd_payload; + memcpy(cmd->passphrase, pass, ND_INTEL_PASSPHRASE_SIZE); + rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_CALL, pkg, + sizeof(pkg_size), &cmd_rc); + if (rc < 0) + goto out; + if (cmd_rc < 0) { + rc = cmd_rc; + goto out; + } + + switch (cmd->status) { + case 0: + break; + case ND_INTEL_STATUS_INVALID_PASS: + rc = -EINVAL; + goto out; + case ND_INTEL_STATUS_INVALID_STATE: + default: + rc = -ENXIO; + goto out; + } + + out: + kfree(pkg); + return rc; +} + static int intel_dimm_security_update_passphrase( struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const char *old_pass, const char *new_pass) @@ -193,4 +243,5 @@ struct nvdimm_security_ops intel_security_ops = { .state = intel_dimm_security_state, .unlock = intel_dimm_security_unlock, .change_key = intel_dimm_security_update_passphrase, + .disable = intel_dimm_security_disable, }; diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c index d3d738c77adb..070811cb4cdc 100644 --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -85,6 +85,45 @@ int nvdimm_security_get_state(struct device *dev) &nvdimm->state); } +static int nvdimm_security_disable(struct device *dev) +{ + struct nvdimm *nvdimm = to_nvdimm(dev); + struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); + struct key *key; + int rc; + char *payload; + bool cached_key = false; + + if (!nvdimm->security_ops) + return 0; + + if (nvdimm->state = NVDIMM_SECURITY_UNSUPPORTED) + return 0; + + key = nvdimm_search_key(dev); + if (!key) + key = nvdimm_request_key(dev); + else + cached_key = true; + if (!key) + return -ENXIO; + + down_read(&key->sem); + payload = key->payload.data[0]; + rc = nvdimm->security_ops->disable(nvdimm_bus, nvdimm, payload); + up_read(&key->sem); + if (rc < 0) + goto out; + + /* If we succeed then remove the key */ + key_invalidate(key); + + out: + key_put(key); + nvdimm_security_get_state(dev); + return rc; +} + int nvdimm_security_unlock_dimm(struct device *dev) { struct nvdimm *nvdimm = to_nvdimm(dev); @@ -587,6 +626,8 @@ static ssize_t security_store(struct device *dev, if (strcmp(buf, "update") = 0 || strcmp(buf, "update\n") = 0) rc = nvdimm_security_change_key(dev); + else if (strcmp(buf, "disable") = 0 || strcmp(buf, "disable\n") = 0) + rc = nvdimm_security_disable(dev); else return -EINVAL; diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h index 7b609409042c..0990dfd5a0a3 100644 --- a/include/linux/libnvdimm.h +++ b/include/linux/libnvdimm.h @@ -177,6 +177,8 @@ struct nvdimm_security_ops { int (*change_key)(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const char *old_pass, const char *new_pass); + int (*disable)(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm, const char *pass); }; void badrange_init(struct badrange *badrange);
next prev parent reply other threads:[~2018-07-02 23:39 UTC|newest] Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-07-02 23:39 [PATCH 00/11] Adding security support for nvdimm Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-02 23:39 ` [PATCH 01/11] nfit: adding support for Intel DSM 1.7 commands Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-02 23:49 ` Dan Williams 2018-07-02 23:49 ` Dan Williams 2018-07-02 23:39 ` [PATCH 02/11] libnvdimm: create keyring to store security keys Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-03 22:16 ` Dan Williams 2018-07-03 22:16 ` Dan Williams 2018-07-02 23:39 ` [PATCH 03/11] nfit/libnvdimm: store dimm id as a member to struct nvdimm Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-03 1:04 ` Dan Williams 2018-07-03 1:04 ` Dan Williams 2018-07-02 23:39 ` [PATCH 04/11] nfit/libnvdimm: add unlock of nvdimm support for Intel DIMMs Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-03 1:45 ` Elliott, Robert (Persistent Memory) 2018-07-03 1:45 ` Elliott, Robert (Persistent Memory) 2018-07-03 3:46 ` Dan Williams 2018-07-03 3:46 ` Dan Williams 2018-07-03 4:58 ` Elliott, Robert (Persistent Memory) 2018-07-03 4:58 ` Elliott, Robert (Persistent Memory) 2018-07-03 5:03 ` Dan Williams 2018-07-03 5:03 ` Dan Williams 2018-07-03 18:00 ` James Morris 2018-07-03 18:00 ` James Morris 2018-07-03 19:21 ` Dan Williams 2018-07-03 19:21 ` Dan Williams 2018-07-03 3:48 ` Dan Williams 2018-07-03 3:48 ` Dan Williams 2018-07-02 23:39 ` [PATCH 05/11] nfit/libnvdimm: add set passphrase support for Intel nvdimms Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-03 22:48 ` Dan Williams 2018-07-03 22:48 ` Dan Williams 2018-07-02 23:39 ` Dave Jiang [this message] 2018-07-02 23:39 ` [PATCH 06/11] nfit/libnvdimm: add disable passphrase support to Intel nvdimm Dave Jiang 2018-07-02 23:39 ` [PATCH 07/11] nfit/libnvdimm: add freeze security " Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-02 23:39 ` [PATCH 08/11] nfit/libnvdimm: add support for issue secure erase DSM " Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-02 23:39 ` [PATCH 09/11] nfit_test: adding context to dimm_dev for nfit_test Dave Jiang 2018-07-02 23:39 ` Dave Jiang 2018-07-02 23:40 ` [PATCH 10/11] nfit_test: adding test support for Intel nvdimm security DSMs Dave Jiang 2018-07-02 23:40 ` Dave Jiang 2018-07-02 23:40 ` [PATCH 11/11] libnvdimm: adding documentation for nvdimm security support Dave Jiang 2018-07-02 23:40 ` Dave Jiang
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=153057478052.38125.4677218866266067369.stgit@djiang5-desk3.ch.intel.com \ --to=dave.jiang@intel.com \ --cc=alison.schofield@intel.com \ --cc=dan.j.williams@intel.com \ --cc=dhowells@redhat.com \ --cc=keescook@chromium.org \ --cc=keyrings@vger.kernel.org \ --cc=linux-nvdimm@lists.01.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.