[0/5] sed-opal: add command to read locking range attributes

Message

Ondrej Kozina March 22, 2023, 3:15 p.m. UTC

This patch set aims to add ability to user authorities to read locking
range attributes.

It's achieved in two steps (except SUM enabled drives):

1) Patch IOC_OPAL_ADD_USR_TO_LR command so that user authority (together with
OPAL_ADMIN1) is added in ACE that allows getting locking range attributes.

2) Add new ioctl command IOC_OPAL_GET_LR_STATUS to get locking range
attributes to user authority assigned to specific locking range.

libcryptsetup plans to support OPAL2 drives and needs to verify locking
range parameters before device activation (LR unlock) takes place since
it's considered undesirable to have (for example) partition mapped beyond
locking range boundaries.

Ondrej Kozina (5):
  sed-opal: do not add user authority twice in boolean ace.
  sed-opal: add helper for adding user authorities in ACE.
  sed-opal: allow user authority to get locking range attributes.
  sed-opal: add helper to get multiple columns at once.
  sed-opal: Add command to read locking range parameters.

 block/opal_proto.h            |   1 +
 block/sed-opal.c              | 263 ++++++++++++++++++++++++++++------
 include/linux/sed-opal.h      |   1 +
 include/uapi/linux/sed-opal.h |  11 ++
 4 files changed, 233 insertions(+), 43 deletions(-)

Comments

Luca Boccassi April 2, 2023, 2:49 p.m. UTC | #1

On Wed, 22 Mar 2023 at 15:16, Ondrej Kozina <[e-mail]> wrote:
>
> This patch set aims to add ability to user authorities to read locking
> range attributes.
>
> It's achieved in two steps (except SUM enabled drives):
>
> 1) Patch IOC_OPAL_ADD_USR_TO_LR command so that user authority (together with
> OPAL_ADMIN1) is added in ACE that allows getting locking range attributes.
>
> 2) Add new ioctl command IOC_OPAL_GET_LR_STATUS to get locking range
> attributes to user authority assigned to specific locking range.
>
> libcryptsetup plans to support OPAL2 drives and needs to verify locking
> range parameters before device activation (LR unlock) takes place since
> it's considered undesirable to have (for example) partition mapped beyond
> locking range boundaries.
>
> Ondrej Kozina (5):
>   sed-opal: do not add user authority twice in boolean ace.
>   sed-opal: add helper for adding user authorities in ACE.
>   sed-opal: allow user authority to get locking range attributes.
>   sed-opal: add helper to get multiple columns at once.
>   sed-opal: Add command to read locking range parameters.
>
>  block/opal_proto.h            |   1 +
>  block/sed-opal.c              | 263 ++++++++++++++++++++++++++++------
>  include/linux/sed-opal.h      |   1 +
>  include/uapi/linux/sed-opal.h |  11 ++
>  4 files changed, 233 insertions(+), 43 deletions(-)

Hi Jens,

Any chance we could get this series looked at, please? It's the last
thing we need to get userspace support going:
https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/461

Thanks!

Kind regards,
Luca Boccassi