Re: [PATCH 2/3] cxl/mem: Support sanitation commands

[Jonathan Cameron <Jonathan.Cameron@Huawei.com>]

On Mon,  5 Dec 2022 17:15:00 -0800
Davidlohr Bueso <dave@stgolabs.net> wrote:

> Implement support for the non-pmem exclusive sanitize (aka overwrite)
> and secure erase commands, per CXL specs.
> 
> To properly support this feature, create a 'security' sysfs file that
> when read will list the current pmem security state or overwrite, and
> when written to, perform the requested operation.
> 
> As with ndctl-speak, the use cases here would be:
> 
> $> cxl sanitize --erase memX
> $> cxl sanitize --overwrite memX
> $> cxl sanitize --wait-overwrite memX  
> 
> Where userspace can implement entirely the wait/query mechanism for
> waiting for the sanitize to complete (albeit no poll support for
> the security sysfs file).
> 
> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>

Hi Davidlohr,

Given I'm late to the game and there has been lots of discussion I'll
focus on just the ABI.

> +What:		/sys/bus/cxl/devices/memX/security
> +Date:		December, 2022
> +KernelVersion:	v6.2
> +Contact:	linux-cxl@vger.kernel.org
> +Description:
> +		Reading this file will display the security state for that
> +		device. The following states are available: disabled, frozen,
> +		locked, unlocked and overwrite. When writing to the file, the
> +		following commands are supported:
> +		* overwrite - Sanitize the device to securely re-purpose or
> +		  decommission it. This is done by ensuring that all user data
> +		  and meta-data, whether it resides in persistent capacity,
> +		  volatile capacity, or the label storage area, is made
> +		  permanently unavailable by whatever means is appropriate for
> +		  the media type. This causes all CPU caches to be flushed.
> +		* erase - Secure Erase user data by changing the media encryption
> +		  keys for all user data areas of the device. This causes all
> +		  CPU caches to be flushed.

General rule of sysfs is one file, one thing.  I think this interface needs splitting.
RO attribute security_state
WO attribute security_overwrite (or maybe security_sanitize as overwriting is an
  implementation choice?)
WO attribute security_erase

Jonathan