From patchwork Fri Oct 12 22:28:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Jiang X-Patchwork-Id: 10639351 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A76B5933 for ; Fri, 12 Oct 2018 22:28:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A6E42B718 for ; Fri, 12 Oct 2018 22:28:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7E6822B71D; Fri, 12 Oct 2018 22:28:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3763E2B718 for ; Fri, 12 Oct 2018 22:28:38 +0000 (UTC) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id E4D592116DFA2; Fri, 12 Oct 2018 15:28:37 -0700 (PDT) X-Original-To: linux-nvdimm@lists.01.org Delivered-To: linux-nvdimm@lists.01.org Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.31; helo=mga06.intel.com; envelope-from=dave.jiang@intel.com; receiver=linux-nvdimm@lists.01.org Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 08D9F21D0DE59 for ; Fri, 12 Oct 2018 15:28:36 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Oct 2018 15:28:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,374,1534834800"; d="scan'208";a="270911056" Received: from djiang5-desk3.ch.intel.com ([143.182.136.93]) by fmsmga005.fm.intel.com with ESMTP; 12 Oct 2018 15:28:36 -0700 Subject: [PATCH v4 0/7] ndctl: add security support From: Dave Jiang To: vishal.l.verma@intel.com, dan.j.williams@intel.com Date: Fri, 12 Oct 2018 15:28:35 -0700 Message-ID: <153938316555.20740.14314691018876178251.stgit@djiang5-desk3.ch.intel.com> User-Agent: StGit/unknown-version MIME-Version: 1.0 X-BeenThere: linux-nvdimm@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Linux-nvdimm developer list." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-nvdimm@lists.01.org Errors-To: linux-nvdimm-bounces@lists.01.org Sender: "Linux-nvdimm" X-Virus-Scanned: ClamAV using ClamSMTP The following series implements mechanisms that utilize the sysfs knobs provided by the kernel in order to support the Intel DSM v1.7 spec that provides security to NVDIMM. The following abilities are added: 1. display security state 2. update security 3. disable security 4. freeze security 5. secure erase 6. kernel unlock upcall support v4: - Updated to match latest kernel interface. - Added unit test for all security calls v3: - Added support to inject keys in order to update nvdimm security. v2: - Fixup the upcall util to match recent kernel updates for nvdimm security. --- Dave Jiang (7): ndctl: add support for display security state ndctl: add update to security support ndctl: add disable security support ndctl: add support for freeze security ndctl: add support for sanitize dimm ndctl: add request-key upcall reference app ndctl: add unit test for security ops (minus overwrite) Documentation/ndctl/Makefile.am | 7 + Documentation/ndctl/ndctl-disable-security.txt | 48 +++++ Documentation/ndctl/ndctl-freeze-security.txt | 21 ++ Documentation/ndctl/ndctl-list.txt | 8 + Documentation/ndctl/ndctl-sanitize.txt | 52 +++++ Documentation/ndctl/ndctl-update-security.txt | 56 ++++++ Documentation/ndctl/nvdimm-upcall.txt | 33 +++ Makefile.am | 5 + builtin.h | 4 configure.ac | 5 + contrib/nvdimm.conf | 1 ndctl.spec.in | 3 ndctl/Makefile.am | 7 + ndctl/dimm.c | 228 +++++++++++++++++++++++- ndctl/lib/Makefile.am | 4 ndctl/lib/dimm.c | 63 +++++++ ndctl/lib/keys.c | 139 +++++++++++++++ ndctl/lib/libndctl.sym | 11 + ndctl/libndctl.h | 18 ++ ndctl/ndctl.c | 4 ndctl/nvdimm-upcall.c | 154 ++++++++++++++++ test/Makefile.am | 3 test/security.sh | 187 ++++++++++++++++++++ util/json.c | 8 + 24 files changed, 1054 insertions(+), 15 deletions(-) create mode 100644 Documentation/ndctl/ndctl-disable-security.txt create mode 100644 Documentation/ndctl/ndctl-freeze-security.txt create mode 100644 Documentation/ndctl/ndctl-sanitize.txt create mode 100644 Documentation/ndctl/ndctl-update-security.txt create mode 100644 Documentation/ndctl/nvdimm-upcall.txt create mode 100644 contrib/nvdimm.conf create mode 100644 ndctl/lib/keys.c create mode 100644 ndctl/nvdimm-upcall.c create mode 100755 test/security.sh -- Signature