From: Dave Jiang <dave.jiang@intel.com> To: dan.j.williams@intel.com Cc: alison.schofield@intel.com, keescook@chromium.org, linux-nvdimm@lists.01.org, ebiggers3@gmail.com, dhowells@redhat.com, keyrings@vger.kernel.org Subject: [PATCH v12 07/12] nfit/libnvdimm: add freeze security support to Intel nvdimm Date: Mon, 08 Oct 2018 16:56:08 -0700 [thread overview] Message-ID: <153904296848.60070.14021093483871071063.stgit@djiang5-desk3.ch.intel.com> (raw) In-Reply-To: <153904272246.60070.6230977215877367778.stgit@djiang5-desk3.ch.intel.com> Add support for freeze security on Intel nvdimm. This locks out any changes to security for the DIMM unless a reboot is done. This is triggered by writing "freeze" to the "security" sysfs attribute. libnvdimm will support the generic freeze_lock API call. Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- drivers/acpi/nfit/intel.c | 51 +++++++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 3 ++ drivers/nvdimm/dimm_devs_security.c | 20 ++++++++++++++ drivers/nvdimm/nd.h | 6 ++++ include/linux/libnvdimm.h | 2 + 5 files changed, 82 insertions(+) diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c index 21d30222371f..ba886f1f5399 100644 --- a/drivers/acpi/nfit/intel.c +++ b/drivers/acpi/nfit/intel.c @@ -18,6 +18,53 @@ #include "intel.h" #include "nfit.h" +static int intel_dimm_security_freeze_lock(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm) +{ + struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus); + int cmd_rc, rc = 0; + struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm); + struct { + struct nd_cmd_pkg pkg; + struct nd_intel_freeze_lock cmd; + } nd_cmd = { + .pkg = { + .nd_command = NVDIMM_INTEL_FREEZE_LOCK, + .nd_family = NVDIMM_FAMILY_INTEL, + .nd_size_in = 0, + .nd_size_out = ND_INTEL_STATUS_SIZE, + .nd_fw_size = ND_INTEL_STATUS_SIZE, + }, + .cmd = { + .status = 0, + }, + }; + + if (!test_bit(NVDIMM_INTEL_FREEZE_LOCK, &nfit_mem->dsm_mask)) + return -ENOTTY; + + rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_CALL, &nd_cmd, + sizeof(nd_cmd), &cmd_rc); + if (rc < 0) + goto out; + if (cmd_rc < 0) { + rc = cmd_rc; + goto out; + } + + switch (nd_cmd.cmd.status) { + case 0: + break; + case ND_INTEL_STATUS_INVALID_STATE: + default: + rc = -ENXIO; + goto out; + } + + out: + return rc; +} + static int intel_dimm_security_disable(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const struct nvdimm_key_data *nkey) { @@ -254,6 +301,9 @@ static int intel_dimm_security_state(struct nvdimm_bus *nvdimm_bus, else if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_ENABLED) { if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_LOCKED) *state = NVDIMM_SECURITY_LOCKED; + else if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_FROZEN || + nd_cmd.cmd.state & ND_INTEL_SEC_STATE_PLIMIT) + *state = NVDIMM_SECURITY_FROZEN; else *state = NVDIMM_SECURITY_UNLOCKED; } else @@ -270,4 +320,5 @@ const struct nvdimm_security_ops intel_security_ops = { .unlock = intel_dimm_security_unlock, .change_key = intel_dimm_security_update_passphrase, .disable = intel_dimm_security_disable, + .freeze_lock = intel_dimm_security_freeze_lock, }; diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c index ae0c3e02e4f5..a1c4c28d951f 100644 --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -442,6 +442,9 @@ static ssize_t security_store(struct device *dev, return -EINVAL; dev_dbg(dev, "disable %#x\n", old_key); rc = nvdimm_security_disable(dev, old_key); + } else if (sysfs_streq(buf, "freeze")) { + dev_dbg(dev, "freeze\n"); + rc = nvdimm_security_freeze_lock(dev); } else return -EINVAL; diff --git a/drivers/nvdimm/dimm_devs_security.c b/drivers/nvdimm/dimm_devs_security.c index 6f8b9021292c..767c5ae06cb5 100644 --- a/drivers/nvdimm/dimm_devs_security.c +++ b/drivers/nvdimm/dimm_devs_security.c @@ -164,6 +164,26 @@ int nvdimm_security_get_state(struct device *dev) &nvdimm->state); } +int nvdimm_security_freeze_lock(struct device *dev) +{ + struct nvdimm *nvdimm = to_nvdimm(dev); + struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); + int rc; + + if (!nvdimm->security_ops) + return -EOPNOTSUPP; + + if (nvdimm->state == NVDIMM_SECURITY_UNSUPPORTED) + return -EOPNOTSUPP; + + rc = nvdimm->security_ops->freeze_lock(nvdimm_bus, nvdimm); + if (rc < 0) + return rc; + + nvdimm_security_get_state(dev); + return 0; +} + int nvdimm_security_disable(struct device *dev, unsigned int keyid) { struct nvdimm *nvdimm = to_nvdimm(dev); diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h index b80cab3a12df..d89fe1423f9a 100644 --- a/drivers/nvdimm/nd.h +++ b/drivers/nvdimm/nd.h @@ -431,6 +431,7 @@ int nvdimm_security_get_state(struct device *dev); int nvdimm_security_change_key(struct device *dev, unsigned int old_keyid, unsigned int new_keyid); int nvdimm_security_disable(struct device *dev, unsigned int keyid); +int nvdimm_security_freeze_lock(struct device *dev); #else static inline struct key *nvdimm_get_key(struct device *dev) { @@ -458,5 +459,10 @@ static inline int nvdimm_security_disable(struct device *dev, { return -EOPNOTSUPP; } + +static inline int nvdimm_security_freeze_lock(struct device *dev) +{ + return -EOPNOTSUPP; +} #endif #endif /* __ND_H__ */ diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h index c60ab4b238f3..bcab42caa948 100644 --- a/include/linux/libnvdimm.h +++ b/include/linux/libnvdimm.h @@ -185,6 +185,8 @@ struct nvdimm_security_ops { int (*disable)(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const struct nvdimm_key_data *nkey); + int (*freeze_lock)(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm); }; void badrange_init(struct badrange *badrange); _______________________________________________ Linux-nvdimm mailing list Linux-nvdimm@lists.01.org https://lists.01.org/mailman/listinfo/linux-nvdimm
WARNING: multiple messages have this Message-ID (diff)
From: Dave Jiang <dave.jiang@intel.com> To: dan.j.williams@intel.com Cc: alison.schofield@intel.com, keescook@chromium.org, linux-nvdimm@lists.01.org, ebiggers3@gmail.com, dhowells@redhat.com, keyrings@vger.kernel.org Subject: [PATCH v12 07/12] nfit/libnvdimm: add freeze security support to Intel nvdimm Date: Mon, 08 Oct 2018 23:56:08 +0000 [thread overview] Message-ID: <153904296848.60070.14021093483871071063.stgit@djiang5-desk3.ch.intel.com> (raw) In-Reply-To: <153904272246.60070.6230977215877367778.stgit@djiang5-desk3.ch.intel.com> Add support for freeze security on Intel nvdimm. This locks out any changes to security for the DIMM unless a reboot is done. This is triggered by writing "freeze" to the "security" sysfs attribute. libnvdimm will support the generic freeze_lock API call. Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- drivers/acpi/nfit/intel.c | 51 +++++++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 3 ++ drivers/nvdimm/dimm_devs_security.c | 20 ++++++++++++++ drivers/nvdimm/nd.h | 6 ++++ include/linux/libnvdimm.h | 2 + 5 files changed, 82 insertions(+) diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c index 21d30222371f..ba886f1f5399 100644 --- a/drivers/acpi/nfit/intel.c +++ b/drivers/acpi/nfit/intel.c @@ -18,6 +18,53 @@ #include "intel.h" #include "nfit.h" +static int intel_dimm_security_freeze_lock(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm) +{ + struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus); + int cmd_rc, rc = 0; + struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm); + struct { + struct nd_cmd_pkg pkg; + struct nd_intel_freeze_lock cmd; + } nd_cmd = { + .pkg = { + .nd_command = NVDIMM_INTEL_FREEZE_LOCK, + .nd_family = NVDIMM_FAMILY_INTEL, + .nd_size_in = 0, + .nd_size_out = ND_INTEL_STATUS_SIZE, + .nd_fw_size = ND_INTEL_STATUS_SIZE, + }, + .cmd = { + .status = 0, + }, + }; + + if (!test_bit(NVDIMM_INTEL_FREEZE_LOCK, &nfit_mem->dsm_mask)) + return -ENOTTY; + + rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_CALL, &nd_cmd, + sizeof(nd_cmd), &cmd_rc); + if (rc < 0) + goto out; + if (cmd_rc < 0) { + rc = cmd_rc; + goto out; + } + + switch (nd_cmd.cmd.status) { + case 0: + break; + case ND_INTEL_STATUS_INVALID_STATE: + default: + rc = -ENXIO; + goto out; + } + + out: + return rc; +} + static int intel_dimm_security_disable(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const struct nvdimm_key_data *nkey) { @@ -254,6 +301,9 @@ static int intel_dimm_security_state(struct nvdimm_bus *nvdimm_bus, else if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_ENABLED) { if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_LOCKED) *state = NVDIMM_SECURITY_LOCKED; + else if (nd_cmd.cmd.state & ND_INTEL_SEC_STATE_FROZEN || + nd_cmd.cmd.state & ND_INTEL_SEC_STATE_PLIMIT) + *state = NVDIMM_SECURITY_FROZEN; else *state = NVDIMM_SECURITY_UNLOCKED; } else @@ -270,4 +320,5 @@ const struct nvdimm_security_ops intel_security_ops = { .unlock = intel_dimm_security_unlock, .change_key = intel_dimm_security_update_passphrase, .disable = intel_dimm_security_disable, + .freeze_lock = intel_dimm_security_freeze_lock, }; diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c index ae0c3e02e4f5..a1c4c28d951f 100644 --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -442,6 +442,9 @@ static ssize_t security_store(struct device *dev, return -EINVAL; dev_dbg(dev, "disable %#x\n", old_key); rc = nvdimm_security_disable(dev, old_key); + } else if (sysfs_streq(buf, "freeze")) { + dev_dbg(dev, "freeze\n"); + rc = nvdimm_security_freeze_lock(dev); } else return -EINVAL; diff --git a/drivers/nvdimm/dimm_devs_security.c b/drivers/nvdimm/dimm_devs_security.c index 6f8b9021292c..767c5ae06cb5 100644 --- a/drivers/nvdimm/dimm_devs_security.c +++ b/drivers/nvdimm/dimm_devs_security.c @@ -164,6 +164,26 @@ int nvdimm_security_get_state(struct device *dev) &nvdimm->state); } +int nvdimm_security_freeze_lock(struct device *dev) +{ + struct nvdimm *nvdimm = to_nvdimm(dev); + struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev); + int rc; + + if (!nvdimm->security_ops) + return -EOPNOTSUPP; + + if (nvdimm->state = NVDIMM_SECURITY_UNSUPPORTED) + return -EOPNOTSUPP; + + rc = nvdimm->security_ops->freeze_lock(nvdimm_bus, nvdimm); + if (rc < 0) + return rc; + + nvdimm_security_get_state(dev); + return 0; +} + int nvdimm_security_disable(struct device *dev, unsigned int keyid) { struct nvdimm *nvdimm = to_nvdimm(dev); diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h index b80cab3a12df..d89fe1423f9a 100644 --- a/drivers/nvdimm/nd.h +++ b/drivers/nvdimm/nd.h @@ -431,6 +431,7 @@ int nvdimm_security_get_state(struct device *dev); int nvdimm_security_change_key(struct device *dev, unsigned int old_keyid, unsigned int new_keyid); int nvdimm_security_disable(struct device *dev, unsigned int keyid); +int nvdimm_security_freeze_lock(struct device *dev); #else static inline struct key *nvdimm_get_key(struct device *dev) { @@ -458,5 +459,10 @@ static inline int nvdimm_security_disable(struct device *dev, { return -EOPNOTSUPP; } + +static inline int nvdimm_security_freeze_lock(struct device *dev) +{ + return -EOPNOTSUPP; +} #endif #endif /* __ND_H__ */ diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h index c60ab4b238f3..bcab42caa948 100644 --- a/include/linux/libnvdimm.h +++ b/include/linux/libnvdimm.h @@ -185,6 +185,8 @@ struct nvdimm_security_ops { int (*disable)(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, const struct nvdimm_key_data *nkey); + int (*freeze_lock)(struct nvdimm_bus *nvdimm_bus, + struct nvdimm *nvdimm); }; void badrange_init(struct badrange *badrange);
next prev parent reply other threads:[~2018-10-08 23:56 UTC|newest] Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-10-08 23:55 [PATCH v12 00/12] Adding security support for nvdimm Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-08 23:55 ` [PATCH v12 01/12] nfit: add support for Intel DSM 1.7 commands Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-08 23:55 ` [PATCH v12 02/12] nfit/libnvdimm: store dimm id as a member to struct nvdimm Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-08 23:55 ` [PATCH v12 03/12] keys: export lookup_user_key to external users Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-08 23:55 ` [PATCH v12 04/12] nfit/libnvdimm: add unlock of nvdimm support for Intel DIMMs Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-09 19:07 ` Dan Williams 2018-10-09 19:07 ` Dan Williams 2018-10-09 19:45 ` Dave Jiang 2018-10-09 19:45 ` Dave Jiang 2018-10-08 23:55 ` [PATCH v12 05/12] nfit/libnvdimm: add set passphrase support for Intel nvdimms Dave Jiang 2018-10-08 23:55 ` Dave Jiang 2018-10-08 23:56 ` [PATCH v12 06/12] nfit/libnvdimm: add disable passphrase support to Intel nvdimm Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-08 23:56 ` Dave Jiang [this message] 2018-10-08 23:56 ` [PATCH v12 07/12] nfit/libnvdimm: add freeze security " Dave Jiang 2018-10-08 23:56 ` [PATCH v12 08/12] nfit/libnvdimm: add support for issue secure erase DSM " Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-08 23:56 ` [PATCH v12 09/12] nfit_test: add test support for Intel nvdimm security DSMs Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-08 23:56 ` [PATCH v12 10/12] libnvdimm: add documentation for nvdimm security support Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-08 23:56 ` [PATCH v12 11/12] libnvdimm: Drop nvdimm_bus from security_ops interface Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-08 23:56 ` [PATCH v12 12/12] acpi, nfit: Move acpi_nfit_get_security_ops() to generic location Dave Jiang 2018-10-08 23:56 ` Dave Jiang 2018-10-10 1:35 ` [PATCH v12 00/12] Adding security support for nvdimm Williams, Dan J 2018-10-10 1:35 ` Williams, Dan J 2018-10-10 16:13 ` Dave Jiang 2018-10-10 16:13 ` Dave Jiang
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=153904296848.60070.14021093483871071063.stgit@djiang5-desk3.ch.intel.com \ --to=dave.jiang@intel.com \ --cc=alison.schofield@intel.com \ --cc=dan.j.williams@intel.com \ --cc=dhowells@redhat.com \ --cc=ebiggers3@gmail.com \ --cc=keescook@chromium.org \ --cc=keyrings@vger.kernel.org \ --cc=linux-nvdimm@lists.01.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.