From: gjoyce@linux.vnet.ibm.com
To: linux-block@vger.kernel.org
Cc: axboe@kernel.dk, gjoyce@linux.vnet.ibm.com, nayna@linux.ibm.com,
keyrings@vger.kernel.org, jonathan.derrick@linux.dev,
brking@linux.vnet.ibm.com, akpm@linux-foundation.org,
msuchanek@suse.de, linuxppc-dev@lists.ozlabs.org
Subject: [PATCH v3 0/3] sed-opal: keyrings, discovery, revert, key store
Date: Tue, 29 Nov 2022 17:25:03 -0600 [thread overview]
Message-ID: <20221129232506.3735672-1-gjoyce@linux.vnet.ibm.com> (raw)
From: Greg Joyce <gjoyce@linux.vnet.ibm.com>
TCG SED Opal is a specification from The Trusted Computing Group
that allows self encrypting storage devices (SED) to be locked at
power on and require an authentication key to unlock the drive.
The current SED Opal implementation in the block driver
requires that authentication keys be provided in an ioctl
so that they can be presented to the underlying SED
capable drive. Currently, the key is typically entered by
a user with an application like sedutil or sedcli. While
this process works, it does not lend itself to automation
like unlock by a udev rule.
The SED block driver has been extended so it can alternatively
obtain a key from a sed-opal kernel keyring. The SED ioctls
will indicate the source of the key, either directly in the
ioctl data or from the keyring.
Two new SED ioctls have also been added. These are:
1) IOC_OPAL_REVERT_LSP to revert LSP state
2) IOC_OPAL_DISCOVERY to discover drive capabilities/state
change log:
- rebase to 6.x
- added latest reviews
- removed platform functions for persistent key storage
- replaced key update logic with key_create_or_update()
- minor bracing and padding changes
- add error returns
- opal_key structure is application provided but kernel
verified
- added brief description of TCG SED Opal
Greg Joyce (3):
block: sed-opal: Implement IOC_OPAL_DISCOVERY
block: sed-opal: Implement IOC_OPAL_REVERT_LSP
block: sed-opal: keyring support for SED keys
block/Kconfig | 1 +
block/opal_proto.h | 4 +
block/sed-opal.c | 252 +++++++++++++++++++++++++++++++++-
include/linux/sed-opal.h | 5 +
include/uapi/linux/sed-opal.h | 25 +++-
5 files changed, 281 insertions(+), 6 deletions(-)
Signed-off-by: Greg Joyce <gjoyce@linux.vnet.ibm.com>
base-commit: 59d0d52c30d4991ac4b329f049cc37118e00f5b0
--
gjoyce@linux.vnet.ibm.com
next reply other threads:[~2022-11-29 23:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-29 23:25 gjoyce [this message]
2022-11-29 23:25 ` [PATCH v3 1/3] block: sed-opal: Implement IOC_OPAL_DISCOVERY gjoyce
2022-11-30 6:52 ` Hannes Reinecke
2022-11-29 23:25 ` [PATCH v3 2/3] block: sed-opal: Implement IOC_OPAL_REVERT_LSP gjoyce
2022-11-30 6:53 ` Hannes Reinecke
2022-11-29 23:25 ` [PATCH v3 3/3] block: sed-opal: keyring support for SED keys gjoyce
2022-11-30 7:00 ` Hannes Reinecke
2022-11-30 15:19 ` Greg Joyce
2022-12-01 3:46 ` Ben Boeckel
2022-12-01 15:29 ` Greg Joyce
2022-12-01 16:12 ` Ben Boeckel
2022-12-01 16:58 ` Greg Joyce
2022-12-01 17:00 ` Greg Joyce
2022-12-01 18:03 ` Greg Joyce
2022-12-02 6:56 ` Hannes Reinecke
2022-12-02 15:18 ` Greg Joyce
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221129232506.3735672-1-gjoyce@linux.vnet.ibm.com \
--to=gjoyce@linux.vnet.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=brking@linux.vnet.ibm.com \
--cc=jonathan.derrick@linux.dev \
--cc=keyrings@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=msuchanek@suse.de \
--cc=nayna@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).