libnvdimm: Introduce CONFIG_NVDIMM_SECURITY_TEST flag

nfit_test overrode the security_show() sysfs attribute function in nvdimm
dimm_devs in order to allow testing of security unlock. With the
introduction of CXL security commands, the trick to override
security_show() becomes significantly more complicated. By introdcing a
security flag CONFIG_NVDIMM_SECURITY_TEST, libnvdimm can just toggle the
check via a compile option. In addition the original override can can be
removed from tools/testing/nvdimm/.

The flag will also be used to bypass cpu_cache_invalidate_memregion() when
set in a different commit. This allows testing on QEMU with nfit_test or
cxl_test since cpu_cache_has_invalidate_memregion() checks whether
X86_FEATURE_HYPERVISOR cpu feature flag is set on x86.

Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/166983618758.2734609.18031639517065867138.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig
index 5a29046e3319dd164f175a640b7825f1100711e3..79d93126453d3fac3a738aed3ff5374a70ce0b4f 100644 (file)
--- a/drivers/nvdimm/Kconfig
+++ b/drivers/nvdimm/Kconfig
@@ -114,4 +114,16 @@ config NVDIMM_TEST_BUILD
          core devm_memremap_pages() implementation and other
          infrastructure.
 
+config NVDIMM_SECURITY_TEST
+       bool "Enable NVDIMM security unit tests"
+       depends on NVDIMM_KEYS
+       help
+         The NVDIMM and CXL subsystems support unit testing of their device
+         security state machines. The NVDIMM_SECURITY_TEST option disables CPU
+         cache maintenance operations around events like secure erase and
+         overwrite.  Also, when enabled, the NVDIMM subsystem core helps the unit
+         test implement a mock state machine.
+
+         Select N if unsure.
+
 endif

diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index c7c9805774911f434332b9a722cbffcacc86ac23..1fc081dcf631578373b6bebb0f293dd5e7917914 100644 (file)
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -349,11 +349,18 @@ static ssize_t available_slots_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(available_slots);
 
-__weak ssize_t security_show(struct device *dev,
+ssize_t security_show(struct device *dev,
                struct device_attribute *attr, char *buf)
 {
        struct nvdimm *nvdimm = to_nvdimm(dev);
 
+       /*
+        * For the test version we need to poll the "hardware" in order
+        * to get the updated status for unlock testing.
+        */
+       if (IS_ENABLED(CONFIG_NVDIMM_SECURITY_TEST))
+               nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+
        if (test_bit(NVDIMM_SECURITY_OVERWRITE, &nvdimm->sec.flags))
                return sprintf(buf, "overwrite\n");
        if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))

diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
index 92af4c3ca0d3dd13c88754cab93688b1fe0a5305..6814339b3dab264ffc83ffe233331299d546105f 100644 (file)
--- a/drivers/nvdimm/security.c
+++ b/drivers/nvdimm/security.c
@@ -177,6 +177,10 @@ static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
                        || !nvdimm->sec.flags)
                return -EIO;
 
+       /* cxl_test needs this to pre-populate the security state */
+       if (IS_ENABLED(CONFIG_NVDIMM_SECURITY_TEST))
+               nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+
        /* No need to go further if security is disabled */
        if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))
                return 0;

diff --git a/tools/testing/nvdimm/Kbuild b/tools/testing/nvdimm/Kbuild
index 5eb5c23b062fc2b7e2bd40a18ca42ae0fa7d990f..8153251ea389a7dcff59d13f258cee0b066c7dbf 100644 (file)
--- a/tools/testing/nvdimm/Kbuild
+++ b/tools/testing/nvdimm/Kbuild
@@ -79,7 +79,6 @@ libnvdimm-$(CONFIG_BTT) += $(NVDIMM_SRC)/btt_devs.o
 libnvdimm-$(CONFIG_NVDIMM_PFN) += $(NVDIMM_SRC)/pfn_devs.o
 libnvdimm-$(CONFIG_NVDIMM_DAX) += $(NVDIMM_SRC)/dax_devs.o
 libnvdimm-$(CONFIG_NVDIMM_KEYS) += $(NVDIMM_SRC)/security.o
-libnvdimm-y += dimm_devs.o
 libnvdimm-y += libnvdimm_test.o
 libnvdimm-y += config_check.o
 

diff --git a/tools/testing/nvdimm/dimm_devs.c b/tools/testing/nvdimm/dimm_devs.c
deleted file mode 100644 (file)
index 57bd27d..0000000
--- a/tools/testing/nvdimm/dimm_devs.c
+++ /dev/null
@@ -1,30 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright Intel Corp. 2018 */
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/nd.h>
-#include "pmem.h"
-#include "pfn.h"
-#include "nd.h"
-#include "nd-core.h"
-
-ssize_t security_show(struct device *dev,
-               struct device_attribute *attr, char *buf)
-{
-       struct nvdimm *nvdimm = to_nvdimm(dev);
-
-       /*
-        * For the test version we need to poll the "hardware" in order
-        * to get the updated status for unlock testing.
-        */
-       nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
-
-       if (test_bit(NVDIMM_SECURITY_DISABLED, &nvdimm->sec.flags))
-               return sprintf(buf, "disabled\n");
-       if (test_bit(NVDIMM_SECURITY_UNLOCKED, &nvdimm->sec.flags))
-               return sprintf(buf, "unlocked\n");
-       if (test_bit(NVDIMM_SECURITY_LOCKED, &nvdimm->sec.flags))
-               return sprintf(buf, "locked\n");
-       return -ENOTTY;
-}