mirror of
https://github.com/torvalds/linux
synced 2024-11-05 18:23:50 +00:00
d78c620a2e
In the process of debugging a system with an NVDIMM that was failing to unlock it was found that the kernel is reporting 'locked' while the DIMM security interface is 'frozen'. Unfortunately the security state is tracked internally as an enum which prevents it from communicating the difference between 'locked' and 'locked + frozen'. It follows that the enum also prevents the kernel from communicating 'unlocked + frozen' which would be useful for debugging why security operations like 'change passphrase' are disabled. Ditch the security state enum for a set of flags and introduce a new sysfs attribute explicitly for the 'frozen' state. The regression risk is low because the 'frozen' state was already blocked behind the 'locked' state, but will need to revisit if there were cases where applications need 'frozen' to show up in the primary 'security' attribute. The expectation is that communicating 'frozen' is mostly a helper for debug and status monitoring. Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reported-by: Jeff Moyer <jmoyer@redhat.com> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Link: https://lore.kernel.org/r/156686729474.184120.5835135644278860826.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams <dan.j.williams@intel.com>
30 lines
874 B
C
30 lines
874 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright Intel Corp. 2018 */
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/moduleparam.h>
|
|
#include <linux/nd.h>
|
|
#include "pmem.h"
|
|
#include "pfn.h"
|
|
#include "nd.h"
|
|
#include "nd-core.h"
|
|
|
|
ssize_t security_show(struct device *dev,
|
|
struct device_attribute *attr, char *buf)
|
|
{
|
|
struct nvdimm *nvdimm = to_nvdimm(dev);
|
|
|
|
/*
|
|
* For the test version we need to poll the "hardware" in order
|
|
* to get the updated status for unlock testing.
|
|
*/
|
|
nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
|
|
|
|
if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))
|
|
return sprintf(buf, "disabled\n");
|
|
if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags))
|
|
return sprintf(buf, "unlocked\n");
|
|
if (test_bit(NVDIMM_SECURITY_LOCKED, &nvdimm->sec.flags))
|
|
return sprintf(buf, "locked\n");
|
|
return -ENOTTY;
|
|
}
|