On Mon, Jul 2, 2018 at 4:39 PM, Dave Jiang <[email protected]> wrote:
> Adding support for setting and/or updating passphrase on the Intel nvdimms.
> The passphrase is pulled from userspace through the kernel key management.
> We trigger the update via writing "update" to the sysfs attribute
> "security". The state of the security can also be read via the "security"
> attribute. libnvdimm will generically support the key_change API call.
>
> Signed-off-by: Dave Jiang <[email protected]>
> ---
> drivers/acpi/nfit/intel.c | 54 ++++++++++++++++++++++
> drivers/nvdimm/dimm_devs.c | 110
> ++++++++++++++++++++++++++++++++++++++++++++
> include/linux/libnvdimm.h | 4 ++
> 3 files changed, 168 insertions(+)
>
> diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
> index 1bdb493694e0..792a5c694a9e 100644
> --- a/drivers/acpi/nfit/intel.c
> +++ b/drivers/acpi/nfit/intel.c
> @@ -16,6 +16,59 @@
> #include <acpi/nfit.h>
> #include "nfit.h"
>
> +static int intel_dimm_security_update_passphrase(
> + struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
> + const char *old_pass, const char *new_pass)
Raw strings concern me especially if we have future security
implementations that are not string passphrase based. How about having
this routine and the other security ops take 'struct nvdimm_key_data
*' arguments where:
struct nvdmm_key_data {
u8 data[NVDIMM_PASSPHRASE_LEN];
};
> +{
> + struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus);
> + int cmd_rc, rc = 0, pkg_size;
> + struct nd_intel_set_passphrase *cmd;
> + struct nd_cmd_pkg *pkg;
> + struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
> +
> + if (!test_bit(NVDIMM_INTEL_SET_PASSPHRASE, &nfit_mem->dsm_mask))
> + return -ENOTTY;
> +
> + pkg_size = sizeof(*pkg) + sizeof(*cmd);
> + pkg = kzalloc(pkg_size, GFP_KERNEL);
> + if (!pkg)
> + return -ENOMEM;
I think these commands are small enough to allocate on the stack, but
you would need to wrap it.
struct {
struct nd_cmd_pkg pkg;
struct nd_intel_set_passphrase cmd;
} cmd = {
.pkg = {
...
},
.cmd = {
...
},
};
This would save the memory allocation and the cast of nd_payload.
_______________________________________________
Linux-nvdimm mailing list
[email protected]
https://lists.01.org/mailman/listinfo/linux-nvdimm
