NDCTL-LOAD-KEYS(1) ndctl Manual NDCTL-LOAD-KEYS(1) (NAME) ndctl-load-keys - kek (keyring) (SYNOPSIS) ndctl load-keys [<>] (DESCRIPTION) load-keys (kek) NVDIMM (user keyring) . libnvdimm initrd . modprobe . : nvdimm__hostname '_' . hostname '_' . . (OPTIONS) -p, --key-path= . /etc/ndctl/keys . -t, --tpm-handle= TPM ( 0x81000001 ). (/etc/ndctl/keys) tpm.handle tpm . ( ). Intel Device Specific Methods (DSM) v1.7 v1.8 [1] : enable passphrase ( ) update passphrase ( ) unlock DIMM ( DIMM) disable security ( ) freeze security ( ) secure (crypto) erase ( ) overwrite () master passphrase enable ( ) master passphrase update ( ) master passphrase secure erase ( ). NVDIMM . (front end) ( [2]) keyring . keyutils API . (back end) ( DIMM ) DIMM . DSM libndctl ioctl DSM sysfs security dimm . key-ID security keyring . master key ( ) () DIMM . master key DIMM DIMM . master key key-encryption-key (kek) . kek TPM ( ) System Master Key kek . kek . [2] . kek keyring : # keyctl show Session Keyring 736023423 --alswrv 0 0 keyring: _ses 675104189 --alswrv 0 65534 \_ keyring: _uid.0 680187394 --alswrv 0 0 \_ trusted: nvdimm-master (regions) DIMM . overwrite regions dimm . [1] [2] . (UNLOCK) DSM . initramfs (ndctl load-keys) libnvdimm modprobe . kek keyring . probe libnvdimm : 1. DIMM 2. keyring 3. kek 4. DSM DSM 5. DSM DIMM DIMM . (freeze) . ..SS " (SETUP USER PASSPHRASE)" DIMM kek keyring . kek DIMM enc32 . . (userspace) . blob blob (/etc/ndctl/keys) . blob . (UPDATE USER PASSPHRASE) DSM . . kek kek . update-passphrase : 1. keyring . 2. blob old. 3. blob keyring "old". 4. kek. 5. DSM . 6. blob keyring. (key-ID) sysfs . DSM keyring (blob) . () (CRYPTO (SECURE) ERASE) remove-passphrase . WBINVD (CPU cache) . sanitize-dimm ndctl --crypto-erase . (OVERWRITE) --overwrite sanitize-dimm ndctl . NVDIMM . . : . ndctl wait-overwrite NVDIMM . WBINVD . --crypto-erase --overwrite crypto-erase overwrite . (SECURITY FREEZE) . . (MASTER PASSPHRASE SETUP, UPDATE, and CRYPTO ERASE) . . (kek) . (COPYRIGHT) (C) 2016 - 2022, Intel Corporation. GPLv2: GPL . : . . ndctl 2026-06-30 NDCTL-LOAD-KEYS(1)