[PATCH 3/4] mtd: add advanced protection and security ioctls

Paul Barker paul.barker at sancloud.com
Mon Dec 6 03:13:02 PST 2021


Apologies for the double-reply, spotted another thing I'd like to 
comment on...

On 06/12/2021 10:42, Paul Barker wrote:
> On 27/10/2021 11:33, shiva.linuxworks at gmail.com wrote:
>> From: Shivamurthy Shastri <sshivamurthy at micron.com>
>>
>> Added new ioctls for advanced protection and security features.
>> These features are currently supported by new Micron SPI NOR flashes.
>>
>> Signed-off-by: Shivamurthy Shastri <sshivamurthy at micron.com>
>> ---
>>   drivers/mtd/mtdchar.c      | 145 +++++++++++++++++++++++++++++++++++++
>>   include/uapi/mtd/mtd-abi.h |  11 +++
>>   2 files changed, 156 insertions(+)
>>
>> diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
>> index 155e991d9d75..97b97b80276d 100644
>> --- a/drivers/mtd/mtdchar.c
>> +++ b/drivers/mtd/mtdchar.c
>> @@ -654,6 +654,16 @@ static int mtdchar_ioctl(struct file *file, u_int 
>> cmd, u_long arg)
>>       case MTDFILEMODE:
>>       case BLKPG:
>>       case BLKRRPART:
>> +    case SECURE_PACKET_READ:
>> +    case SECURE_PACKET_WRITE:
>> +    case RD_VLOCK_BITS:
>> +    case WR_VLOCK_BITS:
>> +    case RD_NVLOCK_BITS:
>> +    case WR_NVLOCK_BITS:
>> +    case ER_NVLOCK_BITS:
>> +    case RD_GLOBAL_FREEZE_BITS:
>> +    case WR_GLOBAL_FREEZE_BITS:
>> +    case RD_PASSWORD:
>>           break;
> 
> It looks like you've listed all of the ioctls as "safe" commands so the 
> write permission bit is not checked. My understanding is that all ioctls 
> which may modify the data in flash need moving to the "dangerous" 
> commands section below this so that the write permission bit is checked.
> 
>>       /* "dangerous" commands */
>> @@ -1017,6 +1027,141 @@ static int mtdchar_ioctl(struct file *file, 
>> u_int cmd, u_long arg)
>>           ret = 0;
>>           break;
>>       }
>> +    case SECURE_PACKET_READ:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = kmalloc(buf.length, GFP_KERNEL);
>> +        ret = master->_secure_packet_read(master, buf.length, oobbuf);

After reviewing patch 2 in this series it's clear that these function 
pointers are NULL if a driver does not implement the sec_ops functions. 
So unless the implementation there is changed, each of these calls needs 
to be wrapped in a test to see if the corresponding pointer is valid and 
to return -EOPNOTSUPP if it is NULL.

>> +        if (copy_to_user(buf.ptr, oobbuf, buf.length))
>> +            ret = -EFAULT;
>> +        break;
>> +    }
>> +
>> +    case SECURE_PACKET_WRITE:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = memdup_user(buf.ptr, buf.length);
>> +        ret = master->_secure_packet_write(master, buf.length, oobbuf);
>> +        break;
>> +    }
>> +
>> +    case RD_VLOCK_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = kmalloc(buf.length, GFP_KERNEL);
>> +        ret = master->_read_vlock_bits(master, buf.start, buf.length,
>> +                           oobbuf);
>> +        if (copy_to_user(buf.ptr, oobbuf, buf.length))
>> +            ret = -EFAULT;
>> +        break;
>> +    }
>> +
>> +    case WR_VLOCK_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = memdup_user(buf.ptr, buf.length);
>> +        ret = master->_write_vlock_bits(master, buf. start, buf.length,
>> +                        oobbuf);
>> +        break;
>> +    }
>> +
>> +    case RD_NVLOCK_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = kmalloc(buf.length, GFP_KERNEL);
>> +        ret = master->_read_nvlock_bits(master, buf.start, buf.length,
>> +                        oobbuf);
>> +        if (copy_to_user(buf.ptr, oobbuf, buf.length))
>> +            ret = -EFAULT;
>> +        break;
>> +    }
>> +
>> +    case WR_NVLOCK_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        ret = master->_write_nvlock_bits(master, buf.start);
>> +        break;
>> +    }
>> +
>> +    case ER_NVLOCK_BITS:
>> +    {
>> +        ret = master->_erase_nvlock_bits(master);
>> +        break;
>> +    }
>> +
>> +    case RD_GLOBAL_FREEZE_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = kmalloc(buf.length, GFP_KERNEL);
>> +        ret = master->_read_global_freeze_bits(master, buf.length,
>> +                               oobbuf);
>> +        if (copy_to_user(buf.ptr, oobbuf, buf.length))
>> +            ret = -EFAULT;
>> +        break;
>> +    }
>> +
>> +    case WR_GLOBAL_FREEZE_BITS:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = memdup_user(buf.ptr, buf.length);
>> +        ret = master->_write_global_freeze_bits(master, buf.length,
>> +                            oobbuf);
>> +        break;
>> +    }
>> +
>> +    case RD_PASSWORD:
>> +    {
>> +        struct mtd_oob_buf buf;
>> +        u8 *oobbuf;
>> +
>> +        if (copy_from_user(&buf, argp, sizeof(buf)))
>> +            ret = -EFAULT;
>> +
>> +        oobbuf = kmalloc(buf.length, GFP_KERNEL);
>> +        ret = master->_read_password(master, buf.length, oobbuf);
>> +        if (copy_to_user(buf.ptr, oobbuf, buf.length))
>> +            ret = -EFAULT;
>> +        break;
>> +    }
>>       }
>>       return ret;
>> diff --git a/include/uapi/mtd/mtd-abi.h b/include/uapi/mtd/mtd-abi.h
>> index b869990c2db2..dbd7bf60d484 100644
>> --- a/include/uapi/mtd/mtd-abi.h
>> +++ b/include/uapi/mtd/mtd-abi.h
>> @@ -208,6 +208,17 @@ struct otp_info {
>>   /* Erase a given range of user data (must be in mode 
>> %MTD_FILE_MODE_OTP_USER) */
>>   #define OTPERASE        _IOW('M', 25, struct otp_info)
>> +#define SECURE_PACKET_READ    _IOWR('M', 26, struct mtd_oob_buf)
>> +#define SECURE_PACKET_WRITE    _IOWR('M', 27, struct mtd_oob_buf)
>> +#define RD_VLOCK_BITS        _IOWR('M', 28, struct mtd_oob_buf)
>> +#define WR_VLOCK_BITS        _IOWR('M', 29, struct mtd_oob_buf)
>> +#define RD_NVLOCK_BITS        _IOWR('M', 30, struct mtd_oob_buf)
>> +#define WR_NVLOCK_BITS        _IOWR('M', 31, struct mtd_oob_buf)
>> +#define ER_NVLOCK_BITS        _IO('M', 32)
>> +#define RD_GLOBAL_FREEZE_BITS    _IOWR('M', 33, struct mtd_oob_buf)
>> +#define WR_GLOBAL_FREEZE_BITS    _IOWR('M', 34, struct mtd_oob_buf)
>> +#define RD_PASSWORD        _IOWR('M', 35, struct mtd_oob_buf)
>> +
> 
> All other ioctls defined in this header are preceeded by a comment which 
> briefly explains what they do. I think this is needed for these new 
> ioctls as well.
> 
>>   /*
>>    * Obsolete legacy interface. Keep it in order not to break userspace
>>    * interfaces
>>
> 
> Thanks,
> 

-- 
Paul Barker
Principal Software Engineer
SanCloud Ltd

e: paul.barker at sancloud.com
w: https://sancloud.co.uk/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xA67255DFCCE62ECD.asc
Type: application/pgp-keys
Size: 7525 bytes
Desc: OpenPGP public key
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20211206/bf387adb/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20211206/bf387adb/attachment-0001.sig>


More information about the linux-mtd mailing list