From patchwork Fri Mar 22 23:42:50 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Jiang X-Patchwork-Id: 10866661 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 19D4213B5 for ; Fri, 22 Mar 2019 23:42:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EB3EC2A930 for ; Fri, 22 Mar 2019 23:42:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DD2E82AA08; Fri, 22 Mar 2019 23:42:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7A5732A930 for ; Fri, 22 Mar 2019 23:42:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 5FD1E211E9598; Fri, 22 Mar 2019 16:42:53 -0700 (PDT) X-Original-To: linux-nvdimm@lists.01.org Delivered-To: linux-nvdimm@lists.01.org Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.31; helo=mga06.intel.com; envelope-from=dave.jiang@intel.com; receiver=linux-nvdimm@lists.01.org Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id F0929211E9593 for ; Fri, 22 Mar 2019 16:42:51 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Mar 2019 16:42:51 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.60,256,1549958400"; d="scan'208";a="331188197" Received: from djiang5-desk3.ch.intel.com ([143.182.136.93]) by fmsmga005.fm.intel.com with ESMTP; 22 Mar 2019 16:42:51 -0700 Subject: [PATCH v2] ndctl: add support to allow zero key for secure erase From: Dave Jiang To: vishal.l.verma@intel.com, dan.j.williams@intel.com Date: Fri, 22 Mar 2019 16:42:50 -0700 Message-ID: <155329809436.64360.3502200842888668766.stgit@djiang5-desk3.ch.intel.com> User-Agent: StGit/unknown-version MIME-Version: 1.0 X-BeenThere: linux-nvdimm@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Linux-nvdimm developer list." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-nvdimm@lists.01.org Errors-To: linux-nvdimm-bounces@lists.01.org Sender: "Linux-nvdimm" X-Virus-Scanned: ClamAV using ClamSMTP Providing a way for crypto-erase to pass in a key that is with 0's as payload. Signed-off-by: Dave Jiang --- v2: - Make zero key option explicit with -z parameter. Otherwise we will look for a key. (Dan) Documentation/ndctl/ndctl-sanitize-dimm.txt | 4 ++++ ndctl/dimm.c | 16 +++++++++++++--- ndctl/util/keys.c | 12 +++++++----- ndctl/util/keys.h | 1 + 4 files changed, 25 insertions(+), 8 deletions(-) diff --git a/Documentation/ndctl/ndctl-sanitize-dimm.txt b/Documentation/ndctl/ndctl-sanitize-dimm.txt index 7f57a115..797820dd 100644 --- a/Documentation/ndctl/ndctl-sanitize-dimm.txt +++ b/Documentation/ndctl/ndctl-sanitize-dimm.txt @@ -56,6 +56,10 @@ include::xable-dimm-options.txt[] Indicate that we are using the master passphrase to perform the erase. This only is applicable to the 'crypto-erase' option. +-z:: +--zero-key:: + Passing in a key with payload that is just 0's. + --verbose:: Emit debug messages. diff --git a/ndctl/dimm.c b/ndctl/dimm.c index cc0bec04..b2b09b6a 100644 --- a/ndctl/dimm.c +++ b/ndctl/dimm.c @@ -49,6 +49,7 @@ static struct parameters { const char *kek; bool crypto_erase; bool overwrite; + bool zero_key; bool master_pass; bool force; bool json; @@ -904,6 +905,7 @@ static int action_sanitize_dimm(struct ndctl_dimm *dimm, struct action_context *actx) { int rc; + enum ndctl_key_type key_type; if (ndctl_dimm_get_security(dimm) < 0) { error("%s: security operation not supported\n", @@ -927,8 +929,14 @@ static int action_sanitize_dimm(struct ndctl_dimm *dimm, } if (param.crypto_erase) { - rc = ndctl_dimm_secure_erase_key(dimm, param.master_pass ? - ND_MASTER_KEY : ND_USER_KEY); + if (param.zero_key) + key_type = ND_ZERO_KEY; + else if (param.master_pass) + key_type = ND_MASTER_KEY; + else + key_type = ND_USER_KEY; + + rc = ndctl_dimm_secure_erase_key(dimm, key_type); if (rc < 0) return rc; } @@ -1057,7 +1065,9 @@ OPT_STRING('k', "key-handle", ¶m.kek, "key-handle", \ OPT_BOOLEAN('c', "crypto-erase", ¶m.crypto_erase, \ "crypto erase a dimm"), \ OPT_BOOLEAN('o', "overwrite", ¶m.overwrite, \ - "overwrite a dimm") + "overwrite a dimm"), \ +OPT_BOOLEAN('z', "zero-key", ¶m.zero_key, \ + "pass in a zero key") #define MASTER_OPTIONS() \ OPT_BOOLEAN('m', "master-passphrase", ¶m.master_pass, \ diff --git a/ndctl/util/keys.c b/ndctl/util/keys.c index c1f2e843..c091cc5c 100644 --- a/ndctl/util/keys.c +++ b/ndctl/util/keys.c @@ -612,17 +612,19 @@ int ndctl_dimm_remove_key(struct ndctl_dimm *dimm) int ndctl_dimm_secure_erase_key(struct ndctl_dimm *dimm, enum ndctl_key_type key_type) { - key_serial_t key; + key_serial_t key = 0; int rc; - key = check_dimm_key(dimm, true, key_type); - if (key < 0) - return key; + if (key_type != ND_ZERO_KEY) { + key = check_dimm_key(dimm, true, key_type); + if (key < 0) + return key; + } if (key_type == ND_MASTER_KEY) rc = run_key_op(dimm, key, ndctl_dimm_master_secure_erase, "master crypto erase"); - else if (key_type == ND_USER_KEY) + else if (key_type == ND_USER_KEY || key_type == ND_ZERO_KEY) rc = run_key_op(dimm, key, ndctl_dimm_secure_erase, "crypto erase"); else diff --git a/ndctl/util/keys.h b/ndctl/util/keys.h index 30687a13..eab78d2f 100644 --- a/ndctl/util/keys.h +++ b/ndctl/util/keys.h @@ -9,6 +9,7 @@ enum ndctl_key_type { ND_USER_OLD_KEY, ND_MASTER_KEY, ND_MASTER_OLD_KEY, + ND_ZERO_KEY, }; #ifdef ENABLE_KEYUTILS