NDCTL-UPDATE-PASSPHRASE(1) ndctl Manual NDCTL-UPDATE-PASSPHRASE(1) (NAME) ndctl-update-passphrase - NVDIMM (SYNOPSIS) ndctl update-passphrase [..] [<>] (DESCRIPTION) NVDIMM. : 1. kek . 2. setup-passphrase NVDIMM . o NVDIMM (unlocked) . (blob) /etc/ndctl/keys "nvdimm__.blob" . (OPTIONS) nmemX dimm. dimm() . all --dimm . -b, --bus= (bus id) ( "ACPI.NFIT"). () . all --bus . -k, --key_handle= (Handle) kek ( key-encryption-key) () DIMM() . : < >:< > trusted:nvdimm-master : kek . -m, --master-passphrase (master passphrase) (user passphrase) . -v, --verbose (). (THEORY OF OPERATION) (Intel DSM) . . [1] : DIMM (freeze security) () . NVDIMM . (Front end) ( [2]) . keyutils API . (Back end) (payload) ( DIMM ) DIMM . DSM libndctl ioctl DSM sysfs security dimm . key-ID security . (master key) () DIMM . DIMM DIMM . (key-encryption-key kek) . kek TPM ( ) (System Master Key) kek . kek . [2] . kek : # keyctl show Session Keyring 736023423 --alswrv 0 0 keyring: _ses 675104189 --alswrv 0 65534 \_ keyring: _uid.0 680187394 --alswrv 0 0 \_ trusted: nvdimm-master (regions) DIMM . overwrite regions dimm . [1] [2] . (UNLOCK) DSM . initramfs (ndctl load-keys) libnvdimm modprobe . kek . (probe) libnvdimm : 1. DIMM 2. 3. kek 4. DSM DSM 5. DSM DIMM DIMM . (freeze) . . (SETUP USER PASSPHRASE) DIMM kek . kek DIMM enc32 . . . (blob) blob (/etc/ndctl/keys) . blob . (UPDATE USER PASSPHRASE) DSM . . kek kek . update-passphrase : 1. . 2. blob old (). 3. blob "old". 4. kek. 5. DSM . 6. blob . (REMOVE USER PASSPHRASE) key-ID sysfs . DSM blob . (CRYPTO (SECURE) ERASE) remove-passphrase . WBINVD () . sanitize-dimm ndctl --crypto-erase . (OVERWRITE) --overwrite sanitize-dimm ndctl . NVDIMM . . : . ndctl wait-overwrite NVDIMM . WBINVD . --crypto-erase --overwrite crypto-erase overwrite . (SECURITY FREEZE) . () . (MASTER PASSPHRASE SETUP, UPDATE, and CRYPTO ERASE) . . (kek) . (COPYRIGHT) Copyright (C) 2016 - 2022, Intel Corporation. License GPLv2: GNU GPL 2 . : . . (SEE ALSO) ndctl-setup-passphrase(1), ndctl-remove-passphrase(1) ndctl 2026-06-30 NDCTL-UPDATE-PASSPHRASE(1)