xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

acpi/nfit, libnvdimm: Add disable passphrase support to Intel nvdimm.

Browse Source 
Add support to disable passphrase (security) for the Intel nvdimm. The
passphrase used for disabling is pulled from an encrypted-key in the kernel
user keyring. The action is triggered by writing "disable <keyid>" to the
sysfs attribute "security".

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Dave Jiang
2018-12-07 10:33:30 -07:00
committed by Dan Williams
parent 4c6926a23b
commit 03b65b22ad
5 changed files with 159 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
drivers/nvdimm/security.c
View File

@@ -69,6 +69,36 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
return key;
}
static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
key_serial_t id)
{
key_ref_t keyref;
struct key *key;
struct encrypted_key_payload *epayload;
struct device *dev = &nvdimm->dev;
keyref = lookup_user_key(id, 0, 0);
if (IS_ERR(keyref))
return NULL;
key = key_ref_to_ptr(keyref);
if (key->type != &key_type_encrypted) {
key_put(key);
return NULL;
}
dev_dbg(dev, "%s: key found: %#x\n", __func__, key_serial(key));
down_read(&key->sem);
epayload = dereference_key_locked(key);
if (epayload->decrypted_datalen != NVDIMM_PASSPHRASE_LEN) {
up_read(&key->sem);
key_put(key);
key = NULL;
}
return key;
}
static struct key *nvdimm_key_revalidate(struct nvdimm *nvdimm)
{
struct key *key;
@@ -146,3 +176,36 @@ int nvdimm_security_unlock(struct device *dev)
nvdimm_bus_unlock(dev);
return rc;
}
int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
{
struct device *dev = &nvdimm->dev;
struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
struct key *key;
int rc;
/* The bus lock should be held at the top level of the call stack */
lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
if (!nvdimm->sec.ops || !nvdimm->sec.ops->disable
|| nvdimm->sec.state < 0)
return -EOPNOTSUPP;
if (nvdimm->sec.state >= NVDIMM_SECURITY_FROZEN) {
dev_warn(dev, "Incorrect security state: %d\n",
nvdimm->sec.state);
return -EIO;
}
key = nvdimm_lookup_user_key(nvdimm, keyid);
if (!key)
return -ENOKEY;
rc = nvdimm->sec.ops->disable(nvdimm, key_data(key));
dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
rc == 0 ? "success" : "fail");
nvdimm_put_key(key);
nvdimm->sec.state = nvdimm_security_state(nvdimm);
return rc;
}