[v2,00/19] Introduce security commands for CXL pmem device

Message

Dave Jiang Sept. 21, 2022, 3:31 p.m. UTC

This series adds the support for "Persistent Memory Data-at-rest Security"
block of command set for the CXL Memory Devices. The enabling is done
through the nvdimm_security_ops as the operations are very similar to the
same operations that the persistent memory devices through NFIT provider
support. This enabling does not include the security pass-through commands
nor the Santize commands.

Under the nvdimm_security_ops, this patch series will enable get_flags(),
freeze(), change_key(), unlock(), disable(), and erase(). The disable() API
does not support disabling of the master passphrase. To maintain
established user ABI through the sysfs attribute "security", the "disable"
command is left untouched and a new "disable_master" command is introduced
with a new disable_master() API call for the nvdimm_security_ops().

This series does not include plumbing to directly handle the security
commands through cxl control util. The enabled security commands will still
go through ndctl tool with this enabling.

The first commit is from Davidlohr [1]. It's submitted separately and can
be dropped. It's here for reference and 0-day testing convenience. The
series does have dependency on the patch.

[1]: https://lore.kernel.org/nvdimm/[e-mail]/T/#u

v2:
- Rebased against Davidlohr's memregion flush call
- Remove SECURITY Kconfig and merge with PMEM (Davidlohr & Jonathan)
- Remove inclusion of ndctl.h from security.c (Davidlohr)
- Return errno and leave out return_code for error cases not in spec for
  mock device (Jonathan)
  - Add comment for using NVDIMM_PASSPHRASE_LEN (Jonathan)
  - Put 'struct cxl_set_pass' on the stack instead of kmalloc (Jonathan)
  - Directly return in mock_set_passphrase() when done. (Jonathan)
  - Tie user interface change commenting for passphrase disable. (Jonathan)
  - Pass passphrase directly in command and remove copy. (Jonathan)
  - Remove state check to enable first time passphrase set in mock device.
  - Fix missing ptr assignment in mock secure erase
  - Tested against cxl_test with new cxl security test.

---

Dave Jiang (18):
      cxl/pmem: Introduce nvdimm_security_ops with ->get_flags() operation
      tools/testing/cxl: Add "Get Security State" opcode support
      cxl/pmem: Add "Set Passphrase" security command support
      tools/testing/cxl: Add "Set Passphrase" opcode support
      cxl/pmem: Add Disable Passphrase security command support
      tools/testing/cxl: Add "Disable" security opcode support
      cxl/pmem: Add "Freeze Security State" security command support
      tools/testing/cxl: Add "Freeze Security State" security opcode support
      cxl/pmem: Add "Unlock" security command support
      tools/testing/cxl: Add "Unlock" security opcode support
      cxl/pmem: Add "Passphrase Secure Erase" security command support
      tools/testing/cxl: Add "passphrase secure erase" opcode support
      nvdimm/cxl/pmem: Add support for master passphrase disable security command
      cxl/pmem: add id attribute to CXL based nvdimm
      tools/testing/cxl: add mechanism to lock mem device for testing
      cxl/pmem: add provider name to cxl pmem dimm attribute group
      libnvdimm: Introduce CONFIG_NVDIMM_SECURITY_TEST flag
      cxl: add dimm_id support for __nvdimm_create()

Davidlohr Bueso (1):
      memregion: Add cpu_cache_invalidate_memregion() interface


 arch/x86/Kconfig                   |   1 +
 arch/x86/mm/pat/set_memory.c       |  15 ++
 drivers/acpi/nfit/intel.c          |  41 ++--
 drivers/cxl/Makefile               |   2 +-
 drivers/cxl/core/mbox.c            |   6 +
 drivers/cxl/cxlmem.h               |  44 +++++
 drivers/cxl/pci.c                  |   4 +
 drivers/cxl/pmem.c                 |  45 ++++-
 drivers/cxl/security.c             | 184 ++++++++++++++++++
 drivers/nvdimm/Kconfig             |   9 +
 drivers/nvdimm/dimm_devs.c         |   9 +-
 drivers/nvdimm/security.c          |  37 +++-
 include/linux/libnvdimm.h          |   2 +
 include/linux/memregion.h          |  35 ++++
 include/uapi/linux/cxl_mem.h       |   6 +
 lib/Kconfig                        |   3 +
 tools/testing/cxl/Kbuild           |   1 +
 tools/testing/cxl/test/cxl.c       |  70 ++++++-
 tools/testing/cxl/test/mem.c       | 294 +++++++++++++++++++++++++++++
 tools/testing/cxl/test/mem_pdata.h |  16 ++
 tools/testing/nvdimm/Kbuild        |   1 -
 tools/testing/nvdimm/dimm_devs.c   |  30 ---
 22 files changed, 788 insertions(+), 67 deletions(-)
 create mode 100644 drivers/cxl/security.c
 create mode 100644 tools/testing/cxl/test/mem_pdata.h
 delete mode 100644 tools/testing/nvdimm/dimm_devs.c

--