xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libnvdimm/security: provide fix for secure-erase to use zero-key

Browse Source 
Add a zero key in order to standardize hardware that want a key of 0's to
be passed. Some platforms defaults to a zero-key with security enabled
rather than allow the OS to enable the security. The zero key would allow
us to manage those platform as well. This also adds a fix to secure erase
so it can use the zero key to do crypto erase. Some other security commands
already use zero keys. This introduces a standard zero-key to allow
unification of semantics cross nvdimm security commands.

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Dave Jiang
2019-03-27 11:10:44 -07:00
committed by Dan Williams
parent 486fa92df4
commit 037c8489ad
2 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tools/testing/nvdimm/test/nfit.c
View File

@@ -225,6 +225,8 @@ static struct workqueue_struct *nfit_wq;
static struct gen_pool *nfit_pool;
static const char zero_key[NVDIMM_PASSPHRASE_LEN];
static struct nfit_test *to_nfit_test(struct device *dev)
{
struct platform_device *pdev = to_platform_device(dev);
@@ -1059,8 +1061,7 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
struct device *dev = &t->pdev.dev;
struct nfit_test_sec *sec = &dimm_sec_info[dimm];
if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED) ||
(sec->state & ND_INTEL_SEC_STATE_FROZEN)) {
if (sec->state & ND_INTEL_SEC_STATE_FROZEN) {
nd_cmd->status = ND_INTEL_STATUS_INVALID_STATE;
dev_dbg(dev, "secure erase: wrong security state\n");
} else if (memcmp(nd_cmd->passphrase, sec->passphrase,
@@ -1068,6 +1069,12 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
nd_cmd->status = ND_INTEL_STATUS_INVALID_PASS;
dev_dbg(dev, "secure erase: wrong passphrase\n");
} else {
if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED)
&& (memcmp(nd_cmd->passphrase, zero_key,
ND_INTEL_PASSPHRASE_SIZE) != 0)) {
dev_dbg(dev, "invalid zero key\n");
return 0;
}
memset(sec->passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
memset(sec->master_passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
sec->state = 0;