drivers/nvdimm/security.c

11 #include <linux/key.h>
12 #include <linux/key-type.h>
23 MODULE_PARM_DESC(key_revalidate, "Require key validation at init.");
27 static void *key_data(struct key *key)
29 	struct encrypted_key_payload *epayload = dereference_key_locked(key);
31 	lockdep_assert_held_read(&key->sem);
36 static void nvdimm_put_key(struct key *key)
38 	if (!key)
41 	up_read(&key->sem);
42 	key_put(key);
46  * Retrieve kernel key for DIMM and request from user space if
47  * necessary. Returns a key held for read and must be put by
50 static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
52 	struct key *key = NULL;
58 	key = request_key(&key_type_encrypted, desc, "");
59 	if (IS_ERR(key)) {
60 		if (PTR_ERR(key) == -ENOKEY)
61 			dev_dbg(dev, "request_key() found no key\n");
64 		key = NULL;
68 		down_read(&key->sem);
69 		epayload = dereference_key_locked(key);
71 			up_read(&key->sem);
72 			key_put(key);
73 			key = NULL;
77 	return key;
81 		struct key **key)
83 	*key = nvdimm_request_key(nvdimm);
84 	if (!*key)
87 	return key_data(*key);
90 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
94 	struct key *key;
102 	key = key_ref_to_ptr(keyref);
103 	if (key->type != &key_type_encrypted) {
104 		key_put(key);
108 	dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key));
110 	down_read_nested(&key->sem, subclass);
111 	epayload = dereference_key_locked(key);
113 		up_read(&key->sem);
114 		key_put(key);
115 		key = NULL;
117 	return key;
121 		key_serial_t id, int subclass, struct key **key)
123 	*key = NULL;
131 	*key = nvdimm_lookup_user_key(nvdimm, id, subclass);
132 	if (!*key)
135 	return key_data(*key);
141 	struct key *key;
148 	data = nvdimm_get_key_payload(nvdimm, &key);
151 	 * Send the same key to the hardware as new and old key to
152 	 * verify that the key is good.
156 		nvdimm_put_key(key);
160 	nvdimm_put_key(key);
169 	struct key *key;
194 	 * If the pre-OS has unlocked the DIMM, attempt to send the key
196 	 * to revalidate the key against the hardware results in a
198 	 * have the key, security is being managed pre-OS.
206 		data = nvdimm_get_key_payload(nvdimm, &key);
209 	dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key),
214 	nvdimm_put_key(key);
253 	struct key *key;
274 			NVDIMM_BASE_KEY, &key);
280 		dev_dbg(dev, "key: %d disable_master: %s\n", key_serial(key),
284 		dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
288 	nvdimm_put_key(key);
302 	struct key *key, *newkey;
318 			NVDIMM_BASE_KEY, &key);
325 		nvdimm_put_key(key);
330 	dev_dbg(dev, "key: %d %d update%s: %s\n",
331 			key_serial(key), key_serial(newkey),
336 	nvdimm_put_key(key);
351 	struct key *key = NULL;
374 			NVDIMM_BASE_KEY, &key);
381 	dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key),
385 	nvdimm_put_key(key);
394 	struct key *key = NULL;
410 			NVDIMM_BASE_KEY, &key);
417 	dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key),
420 	nvdimm_put_key(key);
527 	unsigned int key, newkey;
542 		rc = kstrtouint(keystr, 0, &key);
552 		dev_dbg(dev, "disable %u\n", key);
553 		rc = security_disable(nvdimm, key, NVDIMM_USER);
555 		dev_dbg(dev, "disable_master %u\n", key);
556 		rc = security_disable(nvdimm, key, NVDIMM_MASTER);
558 		dev_dbg(dev, "%s %u %u\n", ops[i].name, key, newkey);
559 		rc = security_update(nvdimm, key, newkey, i == OP_UPDATE
562 		dev_dbg(dev, "%s %u\n", ops[i].name, key);
567 		rc = security_erase(nvdimm, key, i == OP_ERASE
570 		dev_dbg(dev, "overwrite %u\n", key);
575 		rc = security_overwrite(nvdimm, key);