summaryrefslogtreecommitdiff
path: root/drivers/nvdimm/security.c
diff options
context:
space:
mode:
authorDave Jiang <dave.jiang@intel.com>2018-12-07 20:33:30 +0300
committerDan Williams <dan.j.williams@intel.com>2018-12-21 23:44:41 +0300
commit03b65b22ada8115a7a7bfdf0789f6a94adfd6070 (patch)
treed8ac0a260db2dcac8b52ed36566bd9b89ab2d116 /drivers/nvdimm/security.c
parent4c6926a23b76ea23403976290cd45a7a143f6500 (diff)
downloadlinux-03b65b22ada8115a7a7bfdf0789f6a94adfd6070.tar.xz
acpi/nfit, libnvdimm: Add disable passphrase support to Intel nvdimm.
Add support to disable passphrase (security) for the Intel nvdimm. The passphrase used for disabling is pulled from an encrypted-key in the kernel user keyring. The action is triggered by writing "disable <keyid>" to the sysfs attribute "security". Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/nvdimm/security.c')
-rw-r--r--drivers/nvdimm/security.c63
1 files changed, 63 insertions, 0 deletions
diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
index 51d77a67a9fb..647a99dd3182 100644
--- a/drivers/nvdimm/security.c
+++ b/drivers/nvdimm/security.c
@@ -69,6 +69,36 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
return key;
}
+static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
+ key_serial_t id)
+{
+ key_ref_t keyref;
+ struct key *key;
+ struct encrypted_key_payload *epayload;
+ struct device *dev = &nvdimm->dev;
+
+ keyref = lookup_user_key(id, 0, 0);
+ if (IS_ERR(keyref))
+ return NULL;
+
+ key = key_ref_to_ptr(keyref);
+ if (key->type != &key_type_encrypted) {
+ key_put(key);
+ return NULL;
+ }
+ dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key));
+
+
+ down_read(&key->sem);
+ epayload = dereference_key_locked(key);
+ if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
+ up_read(&key->sem);
+ key_put(key);
+ key = NULL;
+ }
+ return key;
+}
+
static struct key *nvdimm_key_revalidate(struct nvdimm *nvdimm)
{
struct key *key;
@@ -146,3 +176,36 @@ int nvdimm_security_unlock(struct device *dev)
nvdimm_bus_unlock(dev);
return rc;
}
+
+int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
+{
+ struct device *dev = &nvdimm->dev;
+ struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
+ struct key *key;
+ int rc;
+
+ /* The bus lock should be held at the top level of the call stack */
+ lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
+
+ if (!nvdimm->sec.ops || !nvdimm->sec.ops->disable
+ || nvdimm->sec.state < 0)
+ return -EOPNOTSUPP;
+
+ if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) {
+ dev_warn(dev, "Incorrect security state: %d\n",
+ nvdimm->sec.state);
+ return -EIO;
+ }
+
+ key = nvdimm_lookup_user_key(nvdimm, keyid);
+ if (!key)
+ return -ENOKEY;
+
+ rc = nvdimm->sec.ops->disable(nvdimm, key_data(key));
+ dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
+ rc == 0 ? "success" : "fail");
+
+ nvdimm_put_key(key);
+ nvdimm->sec.state = nvdimm_security_state(nvdimm);
+ return rc;
+}