1 ===============
2 NVDIMM Security
3 ===============
4
5 1. Introduction
6 ---------------
7
8 With the introduction of Intel Device Specific
9 specification [1], security DSMs are introduce
10 security DSMs: "get security state", "set pass
11 "unlock unit", "freeze lock", "secure erase",
12 data structure has been added to struct dimm i
13 operations and generic APIs are exposed to all
14
15 2. Sysfs Interface
16 ------------------
17 The "security" sysfs attribute is provided in
18 example:
19 /sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:
20
21 The "show" attribute of that attribute will di
22 that DIMM. The following states are available:
23 frozen, and overwrite. If security is not supp
24 will not be visible.
25
26 The "store" attribute takes several commands w
27 in order to support some of the security funct
28 update <old_keyid> <new_keyid> - enable or upd
29 disable <keyid> - disable enabled security and
30 freeze - freeze changing of security states.
31 erase <keyid> - delete existing user encryptio
32 overwrite <keyid> - wipe the entire nvdimm.
33 master_update <keyid> <new_keyid> - enable or
34 master_erase <keyid> - delete existing user en
35
36 3. Key Management
37 -----------------
38
39 The key is associated to the payload by the DI
40 # cat /sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACP
41 8089-a2-1740-00000133
42 The DIMM id would be provided along with the k
43 the kernel.
44
45 The security keys are managed on the basis of
46 key "passphrase" is expected to be 32bytes lon
47 security specification [2]. A key is initially
48 kernel API call during nvdimm unlock. It is up
49 all the keys are in the kernel user keyring fo
50
51 A nvdimm encrypted-key of format enc32 has the
52 nvdimm:<bus-provider-specific-unique-id>
53
54 See file ``Documentation/security/keys/trusted
55 encrypted-keys of enc32 format. TPM usage with
56 preferred for sealing the encrypted-keys.
57
58 4. Unlocking
59 ------------
60 When the DIMMs are being enumerated by the ker
61 retrieve the key from the kernel user keyring.
62 a locked DIMM can be unlocked. Once unlocked,
63 until reboot. Typically an entity (i.e. shell
64 relevant encrypted-keys into the kernel user k
65 This provides the unlock function access to al
66 the passphrase for the respective nvdimms. It
67 keys are injected before libnvdimm is loaded b
68
69 5. Update
70 ---------
71 When doing an update, it is expected that the
72 the kernel user keyring and reinjected as diff
73 what the key description is for the old key si
74 keyid when doing the update operation. It is a
75 is injected with the description format descri
76 document. The update command written to the s
77 the format:
78 update <old keyid> <new keyid>
79
80 If there is no old keyid due to a security ena
81 passed in.
82
83 6. Freeze
84 ---------
85 The freeze operation does not require any keys
86 frozen by a user with root privilege.
87
88 7. Disable
89 ----------
90 The security disable command format is:
91 disable <keyid>
92
93 An key with the current passphrase payload tha
94 in the kernel user keyring.
95
96 8. Secure Erase
97 ---------------
98 The command format for doing a secure erase is
99 erase <keyid>
100
101 An key with the current passphrase payload tha
102 in the kernel user keyring.
103
104 9. Overwrite
105 ------------
106 The command format for doing an overwrite is:
107 overwrite <keyid>
108
109 Overwrite can be done without a key if securit
110 of 0 can be passed in to indicate no key.
111
112 The sysfs attribute "security" can be polled t
113 Overwrite can last tens of minutes or more dep
114
115 An encrypted-key with the current user passphr
116 should be injected and its keyid should be pas
117
118 10. Master Update
119 -----------------
120 The command format for doing a master update i
121 update <old keyid> <new keyid>
122
123 The operating mechanism for master update is i
124 master passphrase key is passed to the kernel.
125 is just another encrypted-key.
126
127 This command is only available when security i
128
129 11. Master Erase
130 ----------------
131 The command format for doing a master erase is
132 master_erase <current keyid>
133
134 This command has the same operating mechanism
135 passphrase key is passed to the kernel. The ma
136 another encrypted-key.
137
138 This command is only available when the master
139 by the extended security status.
140
141 [1]: https://pmem.io/documents/NVDIMM_DSM_Inte
142
143 [2]: http://www.t13.org/documents/UploadedDocu
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.