From patchwork Fri Nov 9 22:14:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Jiang X-Patchwork-Id: 10676647 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C212013AD for ; Fri, 9 Nov 2018 22:14:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B04652F1A5 for ; Fri, 9 Nov 2018 22:14:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A47592F317; Fri, 9 Nov 2018 22:14:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 433AB2F1A5 for ; Fri, 9 Nov 2018 22:14:47 +0000 (UTC) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 3B6CE21A00AE6; Fri, 9 Nov 2018 14:14:47 -0800 (PST) X-Original-To: linux-nvdimm@lists.01.org Delivered-To: linux-nvdimm@lists.01.org Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.24; helo=mga09.intel.com; envelope-from=dave.jiang@intel.com; receiver=linux-nvdimm@lists.01.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2EB0F2118EF60 for ; Fri, 9 Nov 2018 14:14:46 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Nov 2018 14:14:45 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,484,1534834800"; d="scan'208";a="272832828" Received: from djiang5-desk3.ch.intel.com ([143.182.136.93]) by orsmga005.jf.intel.com with ESMTP; 09 Nov 2018 14:14:45 -0800 Subject: [PATCH 11/11] acpi/nfit: prevent indiscriminate DSM payload dumping for security DSMs From: Dave Jiang To: dan.j.williams@intel.com, zohar@linux.vnet.ibm.com Date: Fri, 09 Nov 2018 15:14:45 -0700 Message-ID: <154180168546.70506.10546818094914224030.stgit@djiang5-desk3.ch.intel.com> In-Reply-To: <154180093865.70506.6858789591063128903.stgit@djiang5-desk3.ch.intel.com> References: <154180093865.70506.6858789591063128903.stgit@djiang5-desk3.ch.intel.com> User-Agent: StGit/unknown-version MIME-Version: 1.0 X-BeenThere: linux-nvdimm@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Linux-nvdimm developer list." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-nvdimm@lists.01.org Errors-To: linux-nvdimm-bounces@lists.01.org Sender: "Linux-nvdimm" X-Virus-Scanned: ClamAV using ClamSMTP Right now when debug is enabled, we dump the command buffer indescriminately. This exposes the clear text payload for security DSMs. Introducing a kernel config to only dump the payload if the config option is turned on so the production kernels can leave this option off and not expose the passphrases. Signed-off-by: Dave Jiang --- drivers/acpi/nfit/Kconfig | 7 +++++++ drivers/acpi/nfit/core.c | 24 +++++++++++++++++++++--- 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/nfit/Kconfig b/drivers/acpi/nfit/Kconfig index f7c57e33499e..a0a8eabda2e8 100644 --- a/drivers/acpi/nfit/Kconfig +++ b/drivers/acpi/nfit/Kconfig @@ -13,3 +13,10 @@ config ACPI_NFIT To compile this driver as a module, choose M here: the module will be called nfit. + +config NFIT_SECURITY_DEBUG + bool "Turn on debugging for NVDIMM security features" + depends on ACPI_NFIT + help + Turning on debug output for NVDIMM security DSM commands. This + should not be turned on on a production kernel. diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 867e6fea3737..baaf5308de35 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -405,6 +405,21 @@ static u8 nfit_dsm_revid(unsigned family, unsigned func) return id; } +static bool is_security_cmd(unsigned int cmd, unsigned int func, + unsigned int family) +{ + if (cmd != ND_CMD_CALL) + return false; + + if (family == NVDIMM_FAMILY_INTEL) { + if (func >= NVDIMM_INTEL_GET_SECURITY_STATE && + func <= NVDIMM_INTEL_MASTER_SECURE_ERASE) + return true; + } + + return false; +} + int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc) { @@ -489,9 +504,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, dev_dbg(dev, "%s cmd: %d: func: %d input length: %d\n", dimm_name, cmd, func, in_buf.buffer.length); - print_hex_dump_debug("nvdimm in ", DUMP_PREFIX_OFFSET, 4, 4, - in_buf.buffer.pointer, - min_t(u32, 256, in_buf.buffer.length), true); + if ((call_pkg && !is_security_cmd(cmd, func, call_pkg->nd_family)) || + IS_ENABLED(CONFIG_NFIT_SECURITY_DEBUG)) { + print_hex_dump_debug("nvdimm in ", DUMP_PREFIX_OFFSET, 4, 4, + in_buf.buffer.pointer, + min_t(u32, 256, in_buf.buffer.length), true); + } /* call the BIOS, prefer the named methods over _DSM if available */ if (nvdimm && cmd == ND_CMD_GET_CONFIG_SIZE