Skip to content

Commit 83e476c

Browse files
AndrzejJakowskiAndrzejJakowski
committed
Initial commit
Signed-off-by: Andrzej Jakowski <[email protected]>
0 parents  commit 83e476c

27 files changed

+6635
-0
lines changed

‎.gitignore

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
*.o
2+
*.d
3+
*.a
4+
VERSION
5+
sedcli
6+
sedcli-kmip
7+
sedcli-static
8+
sedcli-dynamic
9+
libsed.a
10+
libsed.so*
11+
.cproject
12+
.project
13+
config.log
14+
config.mk
15+
config.h
16+
tags

‎LICENSE

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
sedcli is made available under the terms of GPL-2.0-or-later license.
2+
3+
libsed is made available under the terms of LGPL-2.1-or-later licens.
4+
5+
Contributions into sedcli are accepted on GPL-2.0-or-later license,
6+
while contributions into libsed are accepted on LGPL-2.1-or-later
7+
license.
8+
All patches must be signedoff by the developer, which indicates that
9+
submitter agress to the Developer Certificate of Origin
10+
<https://developercertificate.org/>.

‎LICENSE.GPL-2.0-or-later

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
sedcli - utility for management of Self-Encrypting Drives
2+
3+
Copyright (C) 2018-2019 Intel Corporation
4+
5+
This program is free software; you can redistribute it and/or modify it
6+
under the terms of the GNU General Public License, as published
7+
by the Free Software Foundation; either version 2 of the License,
8+
or (at your option) any later version.
9+
10+
This program is distributed in the hope that it will be useful,
11+
but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
GNU General Public License for more details.
14+
15+
You should have received a copy of the GNU General Public License
16+
along with this program; if not, see <http://www.gnu.org/licenses/>.
17+
18+
In addition, as a special exception, the copyright holders of sedcli
19+
give you permission to combine sedcli with free software programs or
20+
libraries that are released under the GNU LGPL and with code included
21+
in the standard release of OpenSSL under the OpenSSL license (or modified
22+
versions of such code, with unchanged license). You may copy and distribute
23+
such a system following the terms of the GNU GPL for sedcli and the
24+
licenses of the other code concerned, provided that you include the source
25+
code of that other code when and as the GNU GPL requires distribution of
26+
source code.
27+
28+
SPDX-License-Identifier: GPL-2.0-or-later

‎LICENSE.LGPL-2.1-or-later

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
libsed - library allowing programmatic management of Self-Encrypting Drives
2+
3+
Copyright (C) 2018-2019 Intel Corporation
4+
5+
This library is free software; you can redistribute it and/or modify it
6+
under the terms of the GNU Lesser General Public License as published
7+
by the Free Software Foundation; either version 2.1 of the License,
8+
or (at your option) any later version.
9+
10+
This library is distributed in the hope that it will be useful,
11+
but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
GNU Lesser General Public License for more details.
14+
15+
You should have received a copy of the GNU Lesser General Public License
16+
along with this library; if not, see <http://www.gnu.org/licenses/>.
17+
18+
In addition, as a special exception, the copyright holders of libsed give
19+
you permission to combine libsed simultaneously with free software programs
20+
or libraries that are released under the GNU GPL (with or without an
21+
exception for OpenSSL's license) and with code included in the standard
22+
release of OpenSSL under the OpenSSL license (or modified versions of such
23+
code, with unchanged license). You may copy and distribute such a system
24+
following the terms of the GNU GPL for libsed and the licenses of the other
25+
code concerned.
26+
27+
SPDX-License-Identifier: LGPL-2.1-or-later

‎README.md

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# sedcli and libsed
2+
3+
TCG Opal is an industry standard allowing Self-Encrypting Drives management,
4+
i.e. enable locking, configuring users, locking ranges etc.
5+
6+
Sedcli is an utility for managing NVMe SEDs that are TCG Opal complaint.
7+
8+
Libsed is a library allowing to programatically manage NVMe SEDs that are TCG
9+
Opal complaint.
10+
11+
## Getting started
12+
13+
In order to get started use following steps (<sedcli> denotes top level
14+
directory for sedcli):
15+
16+
```
17+
# download sedcli sources
18+
git clone https://github.com/sedcli/sedcli.git
19+
20+
# navigate to source directory
21+
cd <sedcli>/src
22+
23+
# perform build environment configuration and run compilation
24+
./configure
25+
make
26+
make install
27+
28+
# invoke sedcli help to available commands and its syntax
29+
sedcli -H
30+
31+
# alterntively read sedcli man page
32+
man sedcli
33+
34+
```
35+
36+
## Contributing
37+
38+
We encourage contributions! Patches are accepted via pull request:
39+
* Contributions into sedcli are accepted on GPL-2.0-or-later license
40+
* Contributions into libsed are accepted on LGPL-2.1.-or-later license
41+
* Patches must be signedoff by the developer. This indicates that submitter
42+
agrees to the **Developer Certificate of Origin**
43+
([DCO]https://developercertificate.org)

‎doc/sedcli.8

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
.TH sedcli 8
2+
.SH NAME
3+
sedcli \- manage Opal Self-Encrypting Drives (SEDs) NVMe SSDs
4+
5+
.SH SYNOPSIS
6+
7+
\fBsedcli\fR <command> [options...]
8+
9+
.SH DESCRIPTION
10+
Sedcli enables a system Administrator/Operator to manage NVMe SEDs that are TCG
11+
Opal compliant. In Opal terminology SED is called a Trusted Peripheral (TPer)
12+
and provides an Admin Security Provider (Admin SP) and Locking Security Provider
13+
(Locking SP).
14+
15+
.PP
16+
Management of the TCG Opal features require several operations that are performed
17+
as an Administrator within the TCG Opal command set to either the AdminSP or
18+
LockingSP. The AdminSP provides commands that enable the user to perform
19+
administrative operations such as taking ownership of the device, activation of
20+
the LockingSP, and revert the TPer, whereas the LockingSP provides commands that
21+
enable the user to configure and enable locking enforcement on user data either
22+
globally or on a locking range basis after the LockingSP has been activated by
23+
the AdminSP.
24+
25+
.PP
26+
To start Opal management, an Administrator typically needs to perform the
27+
following process at a minimum:
28+
.IP
29+
1. Take ownership of the device (setting a non-MSID credential for the SID
30+
Authority in the AdminSP)
31+
.IP
32+
2. Activate the LockingSP (this will move the Opal feature to the Manufactured
33+
state and copy the SID authority password to the LockingSP Admin1 password)
34+
.IP
35+
3. Enable Read Lock Enabled and Write Lock Enabled on all desired ranges
36+
(e.g. Global Range)
37+
.PP
38+
After these steps are accomplished, the TPer will be Read or Write locked after
39+
power cycle or when explicitly locked using sedcli command.
40+
41+
.PP
42+
In addition to these basic flows, one can perform crypto erase of the TPer
43+
using the SID authority or the PSID authority as part of revert TPer operation.
44+
In case of using the PSID authority the operator needs to provide the credential
45+
that is printed on the disk label. The Revert TPer operation reverts device
46+
back to the Manufactured-Inactive state, which then requires re-configuration
47+
of the Opal management system using the process previously identified (i.e.
48+
take ownership, activate LSP, enable global range). It is also possible to
49+
update Admin1 password for Locking SP.
50+
51+
.SH OPTIONS
52+
.IP "\fB\-O -d <device>\fR or \fB\-\-ownership --device <device>\fR"
53+
Takes ownership of the device.
54+
55+
.IP "\fB\-A -d <device>\fR or \fB\-\-activate-lsp --device <device>\fR"
56+
Activates Locking SP.
57+
58+
.IP "\fB\-R -d <device> [-i]\fR or \fB\-\-revert --device <device> [--psid]\fR"
59+
Reverts TPer to Manufactured-Inactivate state using either SID or PSID authority.
60+
61+
.IP "\fB\-L -d <device> -t <locktype>\fR or \fB\-\-lock-unlock --device <device> --locktype {RW|RO|WO|UNLOCK}\fR"
62+
Changes the lock state for the device. There is a possibility to setup Read lock,
63+
Write lock and Read-Write lock and unlock the device.
64+
65+
.IP "\fB\-P -d <device>\fR or \fB\-\-set-password --device <device>\fR"
66+
Updates password for Admin1 authority in Locking SP.
67+
68+
.IP "\fB\-V\fR or \fB\-\-version\fR"
69+
Prints version of sedcli.
70+
71+
.IP "\fB\-H\fR or \fB\-\-help\fR"
72+
Prints help on usage.
73+
74+
75+
.SH COPYRIGHT
76+
Copyright(c) 2018-2019 by the Intel Corporation.
77+
78+
.SH AUTHOR
79+
This manual page was created by Andrzej Jakowski <[email protected]>
80+
81+
.SH SEE ALSO
82+
.TP
83+
sedcli(8)

‎src/Makefile

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#
2+
# Copyright (C) 2018-2019 Intel Corporation
3+
#
4+
# SPDX-License-Identifier: GPL-2.0-or-later
5+
#
6+
7+
#
8+
# Includes dir
9+
#
10+
INCLUDES = ./include ./lib/include
11+
12+
#
13+
# Flags for compilation
14+
#
15+
CFLAGS = $(patsubst %,-I%,$(INCLUDES))
16+
CFLAGS += $(patsubst %,-D%,$(DEFINES))
17+
18+
ifeq (, $(filter $(MAKECMDGOALS), clean distclean))
19+
ifeq ("$(wildcard config.mk config.h)", "")
20+
$(error Run ./configure before invoking make)
21+
endif
22+
include config.mk
23+
endif
24+
25+
OBJDIR = .obj/
26+
LIBOBJDIR = .libobj/
27+
TARGET = sedcli
28+
LIB = libsed
29+
#
30+
# Files to be compiled
31+
32+
LIBOBJS = sed.o
33+
LIBOBJS += sed_util.o
34+
ifndef CONFIG_OPAL_DRIVER
35+
LIBOBJS += nvme_access.o
36+
LIBOBJS += nvme_pt_ioctl.o
37+
LIBOBJS += opal_parser.o
38+
else
39+
LIBOBJS += sed_ioctl.o
40+
endif
41+
42+
OBJS = argp.o
43+
OBJS += sedcli_main.o
44+
45+
ALL_TARGETS = $(TARGET)-static $(TARGET)-dynamic
46+
47+
all: $(ALL_TARGETS)
48+
@ln -sf $(TARGET)-static $(TARGET)
49+
50+
$(TARGET)-static: $(TARGET).a $(LIB).a
51+
@echo " LD " $@
52+
@$(CC) $(TARGET).a $(LDFLAGS) -Wl,-Bstatic -lsed -Wl,-Bdynamic -o $@
53+
54+
$(TARGET)-dynamic: $(TARGET).a $(LIB).so
55+
@echo " LD " $@
56+
@$(CC) $(TARGET).a $(LDFLAGS) -lsed -o $@
57+
58+
$(TARGET).a: $(patsubst %,$(OBJDIR)%,$(OBJS))
59+
@echo " AR " $@
60+
@ar rcs $@ $^
61+
62+
#
63+
# Static library
64+
#
65+
$(LIB).a: $(patsubst %,$(LIBOBJDIR)%,$(LIBOBJS))
66+
@echo " AR " $@
67+
@ar rcs $@ $^
68+
69+
#
70+
# Shared library
71+
#
72+
$(LIB).so: $(LIB).a
73+
@echo " LD " $@
74+
@$(CC) -shared -Wl,-soname,$@.1 -Wl,--whole-archive $(LIB).a -Wl,--no-whole-archive -o $@.1.0.1
75+
@ln -sf $@.1.0.1 $@.1
76+
@ln -sf $@.1.0.1 $@
77+
78+
#
79+
# Main targets for compilation
80+
#
81+
$(OBJDIR)%.o: %.c
82+
@echo " CC " $<
83+
@mkdir -p $(dir $@)
84+
@$(CC) -c $(CFLAGS) -MMD -MP -MF"$(@:%.o=%.d)" -MT"$(@:%.o=%.d)" -o "$@" "$<"
85+
86+
$(LIBOBJDIR)%.o: lib/%.c
87+
@echo " CC " $<
88+
@mkdir -p $(dir $@)
89+
@$(CC) -c $(CFLAGS) -shared -fPIC -MMD -MP -MF"$(@:%.o=%.d)" -MT"$(@:%.o=%.d)" -o "$@" "$<"
90+
91+
clean:
92+
@echo " CLEAN "
93+
@rm -f *.a $(TARGET)-static $(TARGET)-dynamic $(TARGET) *.so*
94+
@rm -fr $(OBJDIR) $(LIBOBJDIR)
95+
@rm -f $(shell find -name \*.d) $(shell find -name \*.o)
96+
97+
distclean: clean
98+
@rm -f config.log config.mk config.h
99+
100+
install:
101+
@echo " Installing $(TARGET)"
102+
install -m 755 $(TARGET)-dynamic /usr/sbin/$(TARGET)
103+
install -m 755 $(LIB).so.1.0.1 /usr/lib64/
104+
ln -sf /usr/lib64/$(LIB).so.1.0.1 /usr/lib64/$(LIB).so.1
105+
install -m 644 ../doc/$(TARGET).8 /usr/share/man/man8/$(TARGET).8
106+
107+
uninstall:
108+
@echo " Removing $(TARGET)"
109+
-rm /usr/sbin/$(TARGET)
110+
-rm /usr/lib64/$(LIB).so*
111+
-rm /usr/share/man/man8/$(TARGET).8
112+
113+
.PHONY: clean all distclean install uninstall

0 commit comments

Comments
 (0)