Message-ID: <4f0177a1-0425-1de8-8e6f-836682d225b9@sancloud.com>
Date:   Mon, 6 Dec 2021 10:42:20 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.2
From:   Paul Barker <paul.barker@sancloud.com>
Subject: Re: [PATCH 3/4] mtd: add advanced protection and security ioctls
To:     shiva.linuxworks@gmail.com, tudor.ambarus@microchip.com,
        michael@walle.cc, p.yadav@ti.com, miquel.raynal@bootlin.com,
        richard@nod.at, vigneshr@ti.com
Cc:     linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
        Shivamurthy Shastri <sshivamurthy@micron.com>
References: <20211027103352.8879-1-sshivamurthy@micron.com>
 <20211027103352.8879-4-sshivamurthy@micron.com>
In-Reply-To: <20211027103352.8879-4-sshivamurthy@micron.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?eVlEN3dCZjNYZEx2KzJEQnNXTUp1V21PalU4SGc2aVQ4UkRjTEZ1a2RYYzcx?=
 =?utf-8?B?YnJLSjdlWUtyektYMWxwaktHTmFMNjA0L2tzZ24zckkrTWhFN3hScDArTzJ0?=
 =?utf-8?B?b1AzYVVxRkNodmltVnhFSmprYjYyTGJ1a2xDTkFhWDRJdzZpOEFNSmNINHBY?=
 =?utf-8?B?dEg4Rlpadm9hQVJZaWJvbERaQnRmd3dIZmNMYWZ3WFZHUlFhdFpBOVJ0aVFh?=
 =?utf-8?B?Qnd2TnZYejNMNVJhWW8zdUczdnd0SWtTcWIySDhOaEY3aThURDkzNHJWVzFQ?=
 =?utf-8?B?a0JuQUVWWjZLUGRpVGVMZnRnQ0lJZkp2MGg3RVdQb2pLZTQrSEY2eVdHVGQ2?=
 =?utf-8?B?eWEwWjBHNXFnUXV2Z2prdW04T2llRmlsOUM1V3VmTlgyc3pucURVMy9DRUJy?=
 =?utf-8?B?VnBFM3VuZ1FjWFZEZ0lMdjQwejh3QytJUWtpcmM1OTd4WlY0ZnZ3ZmJMNkpE?=
 =?utf-8?B?UlVYOWhhOEMvZWVKOU1LM0JYM0FXRGxKaGJHNkdEVURlWHFQamFJUTNQdDRT?=
 =?utf-8?B?aVFFcEIwQ1Y4QUp3WEhpMndVRFd5VWF0cFhrSEpZaGU0Y013K2MxZnBySkNm?=
 =?utf-8?B?SjZXTmVaZnIvN2p0cUJ3a3JSNEl4Z2FJZUwrYzlmN3NFMjBPOEx1Vk1MM2Ny?=
 =?utf-8?B?NlVaSE5iM3JJOFlGRSs3Q1R5emNKeURUNnVOdFFVUlIwdG9ONElDOENFT1Rq?=
 =?utf-8?B?bDZUUmVLYnhWSnZsRW5KbmJUMWZLOXlWK2gxMVZvenFWS29WWkZHSkNWd3JD?=
 =?utf-8?B?M3psZXFLeWJlekhhRFd5WVJkOUd2YURJZm15c3huM3NSWTVqaXVxYmxiZ09C?=
 =?utf-8?B?WDBuU3VWbXFkYXhmQmxCSThKWkExSEx0dGNqeFQxQXdQNGVrdmNhbnVocHQv?=
 =?utf-8?B?elh3d0dtRDYzbFVDQ0wwNGpFd0s3dS9SWFF5SUJKV2dqZnAxVmVCT2F5ajNo?=
 =?utf-8?B?bG5QeXlyaUFuckRhUGpvV1NNcm1COWFZUDF1eUJiTVp5MzdxTU1sYjRRaGUr?=
 =?utf-8?B?T3NreWMwdEszNFNjNk1KeDBOZTd3WXhYVVV5YTdDQ213Wm92d3pqam8zOHBk?=
 =?utf-8?B?ajZFTFJrTXZaaGVKUDNIVXk2STNncFNjMmljN3lBaUxOWG9uM2huOWVJbzBy?=
 =?utf-8?B?eSttWXkrL21VUjJ1WW9xY0dVWTI3L1VZRXZaYzZVb2JlUEFCd05kendXMW14?=
 =?utf-8?B?T3NrNFBnM3BhVHlaODdtZk9zN3RFcTZLV1RLa2NrVUp4VjNQVCttNDdBSFVX?=
 =?utf-8?B?VGJwcWhUQ213eHVwWGNUTkQ0Z20yaEZJdzczT1JpRTNlZEpDSnFrOWRaOUNn?=
 =?utf-8?B?dllTeXpncnZFQWEvcHhuQ2EzR05rb1pGOEVFL2Q1KzJwNFgrQ1RWbm9ZOTRt?=
 =?utf-8?B?ZHlNOHIyb0pNRGxqYnA5QllPTjlkMDErTEd6VDdxZ0Y3bzZ0NTZFeFI1SEdI?=
 =?utf-8?B?K3Uwa3laUSt4eU1UeFBadWxla2FGSStDSWNVVkphemRCSzQ2cjV3UGNka1RI?=
 =?utf-8?B?Q3EyQ1FlK1lFc3lDZERCTnNkTlViSEhUc3ZFVmdBaGQ0MnlNUEdoQURSOWp4?=
 =?utf-8?B?V1dOQTZZKzNYVEQ4YXNjOHliKzh5UmpJRm1BcDcycW1EMStTeGw4NDl2dk1u?=
 =?utf-8?B?WTFFQnIvRXpjcGxtRTdzbjhOVG9iR0NCazZIbkJxVmxaS01vbkEyR09YWmYw?=
 =?utf-8?B?Yld1b3YybzJ2dFFvZDFWc1JzZzRCZXBUZk1SWCtjUHRrU2ZjNmtwTkpGWUVS?=
 =?utf-8?B?bUZNazB4WU81THlhQlFvTWlNMnhaR3J1ak5PcTFlUVdCRnB1NUVrQWxwQ2Rw?=
 =?utf-8?B?bFdUZ2hKQnRlTi9TODRnRTF4bk9wUEZBdEppa202VEVXQk01N3Jrd3BNSVM5?=
 =?utf-8?B?M0R1Q2kxZDIyU0dPNTJqakpkYzBpQzJTSFBOWmlhamdPMmxMSjUxMDVJdnpw?=
 =?utf-8?B?VmhDaTM1Z2UwT25xa1A3WW8vd0d5ZlpHaFE5Nmp5MU1tbStwUCswdzlFZFV4?=
 =?utf-8?B?c3ljT3hmZkZnc0o1UktxUjhvbXNjTnZ6QmlFYk5rOElxUW1HS0xvVjRzUTdD?=
 =?utf-8?B?dWpuNkY1WC9wSkJEcm9HWDN1amRKbTZUd2pZdWcxbEpuTHZlUllaQzlBb3VQ?=
 =?utf-8?B?VXJyWElKamhXazBnZE8rYmFNZCt6TzNDb2NwdjQ2ZkNYaERjNzFsRUJhWjJM?=
 =?utf-8?B?cVFkNElqanozV3h1Nkd0b3BsUmJ4RFNVQWk4ZnBxWW1Ra2xiaXlnUVc2NXQz?=
 =?utf-8?B?dmF1cGs4MFQxUVJWS1c2empFQXZ3PT0=?=
X-OriginatorOrg: sancloud.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9da9b77a-ea89-446b-85ba-08d9b8a515d6
X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB2241.GBRP123.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Dec 2021 10:42:22.6530
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 840be37c-244a-450e-9bcc-2064862de1f4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YzRuTQTYxPFynJIF/D/sBcANOsi8/wiDltwsFHX4Qm/ZbbkF92y8Jj6Xw2KNB5s1X8A8LOpoUzbuw2EDOlz9zg4rJ5sWpmmnihPM3p2JUL0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB4612
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 27/10/2021 11:33, shiva.linuxworks@gmail.com wrote:
> From: Shivamurthy Shastri <sshivamurthy@micron.com>
> 
> Added new ioctls for advanced protection and security features.
> These features are currently supported by new Micron SPI NOR flashes.
> 
> Signed-off-by: Shivamurthy Shastri <sshivamurthy@micron.com>
> ---
>   drivers/mtd/mtdchar.c      | 145 +++++++++++++++++++++++++++++++++++++
>   include/uapi/mtd/mtd-abi.h |  11 +++
>   2 files changed, 156 insertions(+)
> 
> diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
> index 155e991d9d75..97b97b80276d 100644
> --- a/drivers/mtd/mtdchar.c
> +++ b/drivers/mtd/mtdchar.c
> @@ -654,6 +654,16 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
>   	case MTDFILEMODE:
>   	case BLKPG:
>   	case BLKRRPART:
> +	case SECURE_PACKET_READ:
> +	case SECURE_PACKET_WRITE:
> +	case RD_VLOCK_BITS:
> +	case WR_VLOCK_BITS:
> +	case RD_NVLOCK_BITS:
> +	case WR_NVLOCK_BITS:
> +	case ER_NVLOCK_BITS:
> +	case RD_GLOBAL_FREEZE_BITS:
> +	case WR_GLOBAL_FREEZE_BITS:
> +	case RD_PASSWORD:
>   		break;

It looks like you've listed all of the ioctls as "safe" commands so the 
write permission bit is not checked. My understanding is that all ioctls 
which may modify the data in flash need moving to the "dangerous" 
commands section below this so that the write permission bit is checked.

>   
>   	/* "dangerous" commands */
> @@ -1017,6 +1027,141 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
>   		ret = 0;
>   		break;
>   	}
> +	case SECURE_PACKET_READ:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = kmalloc(buf.length, GFP_KERNEL);
> +		ret = master->_secure_packet_read(master, buf.length, oobbuf);
> +		if (copy_to_user(buf.ptr, oobbuf, buf.length))
> +			ret = -EFAULT;
> +		break;
> +	}
> +
> +	case SECURE_PACKET_WRITE:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = memdup_user(buf.ptr, buf.length);
> +		ret = master->_secure_packet_write(master, buf.length, oobbuf);
> +		break;
> +	}
> +
> +	case RD_VLOCK_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = kmalloc(buf.length, GFP_KERNEL);
> +		ret = master->_read_vlock_bits(master, buf.start, buf.length,
> +					       oobbuf);
> +		if (copy_to_user(buf.ptr, oobbuf, buf.length))
> +			ret = -EFAULT;
> +		break;
> +	}
> +
> +	case WR_VLOCK_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = memdup_user(buf.ptr, buf.length);
> +		ret = master->_write_vlock_bits(master, buf. start, buf.length,
> +						oobbuf);
> +		break;
> +	}
> +
> +	case RD_NVLOCK_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = kmalloc(buf.length, GFP_KERNEL);
> +		ret = master->_read_nvlock_bits(master, buf.start, buf.length,
> +						oobbuf);
> +		if (copy_to_user(buf.ptr, oobbuf, buf.length))
> +			ret = -EFAULT;
> +		break;
> +	}
> +
> +	case WR_NVLOCK_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		ret = master->_write_nvlock_bits(master, buf.start);
> +		break;
> +	}
> +
> +	case ER_NVLOCK_BITS:
> +	{
> +		ret = master->_erase_nvlock_bits(master);
> +		break;
> +	}
> +
> +	case RD_GLOBAL_FREEZE_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = kmalloc(buf.length, GFP_KERNEL);
> +		ret = master->_read_global_freeze_bits(master, buf.length,
> +						       oobbuf);
> +		if (copy_to_user(buf.ptr, oobbuf, buf.length))
> +			ret = -EFAULT;
> +		break;
> +	}
> +
> +	case WR_GLOBAL_FREEZE_BITS:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = memdup_user(buf.ptr, buf.length);
> +		ret = master->_write_global_freeze_bits(master, buf.length,
> +							oobbuf);
> +		break;
> +	}
> +
> +	case RD_PASSWORD:
> +	{
> +		struct mtd_oob_buf buf;
> +		u8 *oobbuf;
> +
> +		if (copy_from_user(&buf, argp, sizeof(buf)))
> +			ret = -EFAULT;
> +
> +		oobbuf = kmalloc(buf.length, GFP_KERNEL);
> +		ret = master->_read_password(master, buf.length, oobbuf);
> +		if (copy_to_user(buf.ptr, oobbuf, buf.length))
> +			ret = -EFAULT;
> +		break;
> +	}
>   	}
>   
>   	return ret;
> diff --git a/include/uapi/mtd/mtd-abi.h b/include/uapi/mtd/mtd-abi.h
> index b869990c2db2..dbd7bf60d484 100644
> --- a/include/uapi/mtd/mtd-abi.h
> +++ b/include/uapi/mtd/mtd-abi.h
> @@ -208,6 +208,17 @@ struct otp_info {
>   /* Erase a given range of user data (must be in mode %MTD_FILE_MODE_OTP_USER) */
>   #define OTPERASE		_IOW('M', 25, struct otp_info)
>   
> +#define SECURE_PACKET_READ	_IOWR('M', 26, struct mtd_oob_buf)
> +#define SECURE_PACKET_WRITE	_IOWR('M', 27, struct mtd_oob_buf)
> +#define RD_VLOCK_BITS		_IOWR('M', 28, struct mtd_oob_buf)
> +#define WR_VLOCK_BITS		_IOWR('M', 29, struct mtd_oob_buf)
> +#define RD_NVLOCK_BITS		_IOWR('M', 30, struct mtd_oob_buf)
> +#define WR_NVLOCK_BITS		_IOWR('M', 31, struct mtd_oob_buf)
> +#define ER_NVLOCK_BITS		_IO('M', 32)
> +#define RD_GLOBAL_FREEZE_BITS	_IOWR('M', 33, struct mtd_oob_buf)
> +#define WR_GLOBAL_FREEZE_BITS	_IOWR('M', 34, struct mtd_oob_buf)
> +#define RD_PASSWORD		_IOWR('M', 35, struct mtd_oob_buf)
> +

All other ioctls defined in this header are preceeded by a comment which 
briefly explains what they do. I think this is needed for these new 
ioctls as well.

>   /*
>    * Obsolete legacy interface. Keep it in order not to break userspace
>    * interfaces
> 

Thanks,

-- 
Paul Barker
Principal Software Engineer
SanCloud Ltd

e: paul.barker@sancloud.com
w: https://sancloud.co.uk/