aboutsummaryrefslogtreecommitdiff
path: root/include/linux/sed-opal.h
AgeCommit message (Collapse)AuthorFilesLines
2023-08-22block: sed-opal: keyring support for SED keysGreg Joyce1-0/+3
Extend the SED block driver so it can alternatively obtain a key from a sed-opal kernel keyring. The SED ioctls will indicate the source of the key, either directly in the ioctl data or from the keyring. This allows the use of SED commands in scripts such as udev scripts so that drives may be automatically unlocked as they become available. Signed-off-by: Greg Joyce <[email protected]> Reviewed-by: Jonathan Derrick <[email protected]> Acked-by: Jarkko Sakkinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2023-08-22block: sed-opal: Implement IOC_OPAL_REVERT_LSPGreg Joyce1-0/+1
This is used in conjunction with IOC_OPAL_REVERT_TPR to return a drive to Original Factory State without erasing the data. If IOC_OPAL_REVERT_LSP is called with opal_revert_lsp.options bit OPAL_PRESERVE set prior to calling IOC_OPAL_REVERT_TPR, the drive global locking range will not be erased. Signed-off-by: Greg Joyce <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Reviewed-by: Jonathan Derrick <[email protected]> Acked-by: Jarkko Sakkinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2023-08-22block: sed-opal: Implement IOC_OPAL_DISCOVERYGreg Joyce1-0/+1
Add IOC_OPAL_DISCOVERY ioctl to return raw discovery data to a SED Opal application. This allows the application to display drive capabilities and state. Signed-off-by: Greg Joyce <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Reviewed-by: Jonathan Derrick <[email protected]> Acked-by: Jarkko Sakkinen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2023-04-19sed-opal: geometry feature reporting commandOndrej Kozina1-0/+1
Locking range start and locking range length attributes may be require to satisfy restrictions exposed by OPAL2 geometry feature reporting. Geometry reporting feature is described in TCG OPAL SSC, section 3.1.1.4 (ALIGN, LogicalBlockSize, AlignmentGranularity and LowestAlignedLBA). 4.3.5.2.1.1 RangeStart Behavior: [ StartAlignment = (RangeStart modulo AlignmentGranularity) - LowestAlignedLBA ] When processing a Set method or CreateRow method on the Locking table for a non-Global Range row, if: a) the AlignmentRequired (ALIGN above) column in the LockingInfo table is TRUE; b) RangeStart is non-zero; and c) StartAlignment is non-zero, then the method SHALL fail and return an error status code INVALID_PARAMETER. 4.3.5.2.1.2 RangeLength Behavior: If RangeStart is zero, then [ LengthAlignment = (RangeLength modulo AlignmentGranularity) - LowestAlignedLBA ] If RangeStart is non-zero, then [ LengthAlignment = (RangeLength modulo AlignmentGranularity) ] When processing a Set method or CreateRow method on the Locking table for a non-Global Range row, if: a) the AlignmentRequired (ALIGN above) column in the LockingInfo table is TRUE; b) RangeLength is non-zero; and c) LengthAlignment is non-zero, then the method SHALL fail and return an error status code INVALID_PARAMETER In userspace we stuck to logical block size reported by general block device (via sysfs or ioctl), but we can not read 'AlignmentGranularity' or 'LowestAlignedLBA' anywhere else and we need to get those values from sed-opal interface otherwise we will not be able to report or avoid locking range setup INVALID_PARAMETER errors above. Signed-off-by: Ondrej Kozina <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Reviewed-by: Christian Brauner <[email protected]> Tested-by: Milan Broz <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2023-04-05sed-opal: Add command to read locking range parameters.Ondrej Kozina1-0/+1
It returns following attributes: locking range start locking range length read lock enabled write lock enabled lock state (RW, RO or LK) It can be retrieved by user authority provided the authority was added to locking range via prior IOC_OPAL_ADD_USR_TO_LR ioctl command. The command was extended to add user in ACE that allows to read attributes listed above. Signed-off-by: Ondrej Kozina <[email protected]> Tested-by: Luca Boccassi <[email protected]> Tested-by: Milan Broz <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2022-12-08block: sed-opal: Don't include <linux/kernel.h>Christophe JAILLET1-1/+2
There is no need to include <linux/kernel.h> here. Prefer the less invasive <linux/types.h> and <linux/compiler_types.h> which are needed in this .h file itself. Signed-off-by: Christophe JAILLET <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Link: https://lore.kernel.org/r/c1d479b39e30fe70c4579a1af035d4db49421f56.1670069909.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jens Axboe <[email protected]>
2022-08-22block: sed-opal: Add ioctl to return device status[email protected]1-0/+1
Provide a mechanism to retrieve basic status information about the device, including the "supported" flag indicating whether SED-OPAL is supported. The information returned is from the various feature descriptors received during the discovery0 step, and so this ioctl does nothing more than perform the discovery0 step and then save the information received. See "struct opal_status" and OPAL_FL_* bits for the status information currently returned. This is necessary to be able to check whether a device is OPAL enabled, set up, locked or unlocked from userspace programs like systemd-cryptsetup and libcryptsetup. Right now we just have to assume the user 'knows' or blindly attempt setup/lock/unlock operations. Signed-off-by: Douglas Miller <[email protected]> Tested-by: Luca Boccassi <[email protected]> Reviewed-by: Scott Bauer <[email protected]> Acked-by: Christian Brauner (Microsoft) <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]>
2019-11-04block: sed-opal: Add support to read/write opal tables genericallyRevanth Rajashekar1-0/+1
This feature gives the user RW access to any opal table with admin1 authority. The flags described in the new structure determines if the user wants to read/write the data. Flags are checked for valid values in order to allow future features to be added to the ioctl. The user can provide the desired table's UID. Also, the ioctl provides a size and offset field and internally will loop data accesses to return the full data block. Read overrun is prevented by the initiator's sec_send_recv() backend. The ioctl provides a private field with the intention to accommodate any future expansions to the ioctl. Reviewed-by: Scott Bauer <[email protected]> Reviewed-by: Jon Derrick <[email protected]> Signed-off-by: Revanth Rajashekar <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-06-29block: sed-opal: ioctl for writing to shadow mbrJonas Rabenstein1-0/+1
Allow modification of the shadow mbr. If the shadow mbr is not marked as done, this data will be presented read only as the device content. Only after marking the shadow mbr as done and unlocking a locking range the actual content is accessible. Co-authored-by: David Kozub <[email protected]> Signed-off-by: Jonas Rabenstein <[email protected]> Signed-off-by: David Kozub <[email protected]> Reviewed-by: Scott Bauer <[email protected]> Reviewed-by: Jon Derrick <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-06-29block: sed-opal: add ioctl for done-mark of shadow mbrJonas Rabenstein1-0/+1
Enable users to mark the shadow mbr as done without completely deactivating the shadow mbr feature. This may be useful on reboots, when the power to the disk is not disconnected in between and the shadow mbr stores the required boot files. Of course, this saves also the (few) commands required to enable the feature if it is already enabled and one only wants to mark the shadow mbr as done. Co-authored-by: David Kozub <[email protected]> Signed-off-by: Jonas Rabenstein <[email protected]> Signed-off-by: David Kozub <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Reviewed by: Scott Bauer <[email protected]> Reviewed-by: Jon Derrick <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-06-29block: sed-opal: PSID reverttper capabilityRevanth Rajashekar1-0/+1
PSID is a 32 character password printed on the drive label, to prove its physical access. This PSID reverttper function is very useful to regain the control over the drive when it is locked and the user can no longer access it because of some failures. However, *all the data on the drive is completely erased*. This method is advisable only when the user is exhausted of all other recovery methods. PSID capabilities are described in: https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage-Opal_Feature_Set_PSID_v1.00_r1.00.pdf Signed-off-by: Revanth Rajashekar <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2019-04-30block: switch all files cleared marked as GPLv2 to SPDX tagsChristoph Hellwig1-9/+1
All these files have some form of the usual GPLv2 boilerplate. Switch them to use SPDX tags instead. Reviewed-by: Chaitanya Kulkarni <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2017-02-23block/sed-opal: Introduce free_opal_dev to free the structure and clean up stateScott Bauer1-0/+5
Before we free the opal structure we need to clean up any saved locking ranges that the user had told us to unlock from a suspend. Signed-off-by: Scott Bauer <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2017-02-17block/sed-opal: allocate struct opal_dev dynamicallyChristoph Hellwig1-112/+4
Insted of bloating the containing structure with it all the time this allocates struct opal_dev dynamically. Additionally this allows moving the definition of struct opal_dev into sed-opal.c. For this a new private data field is added to it that is passed to the send/receive callback. After that a lot of internals can be made private as well. Signed-off-by: Christoph Hellwig <[email protected]> Tested-by: Scott Bauer <[email protected]> Reviewed-by: Scott Bauer <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2017-02-14Move stack parameters for sed_ioctl to prevent oversized stack with CONFIG_KASANScott Bauer1-2/+2
When CONFIG_KASAN is enabled, compilation fails: block/sed-opal.c: In function 'sed_ioctl': block/sed-opal.c:2447:1: error: the frame size of 2256 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Moved all the ioctl structures off the stack and dynamically allocate using _IOC_SIZE() Fixes: 455a7b238cd6 ("block: Add Sed-opal library") Reported-by: Arnd Bergmann <[email protected]> Signed-off-by: Scott Bauer <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2017-02-06block: Add Sed-opal libraryScott Bauer1-0/+178
This patch implements the necessary logic to bring an Opal enabled drive out of a factory-enabled into a working Opal state. This patch set also enables logic to save a password to be replayed during a resume from suspend. Signed-off-by: Scott Bauer <[email protected]> Signed-off-by: Rafael Antognolli <[email protected]> Reviewed-by: Christoph Hellwig <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.