Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parse additional features, basic support SecretProtect table, and small fixes #117

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

mge-fbe-com
Copy link

@mge-fbe-com mge-fbe-com commented Dec 12, 2024

Hi,
This PR contains a collection of fixes and improvements.

Manual test results bellow.
I had to decrease the DefaultMaxComPacketSize for it to work with test hardware and a 6.4 based kernel (I plan to tackle this later).

Secret protect output example:

2024/12/12 04:57:55 Locking SP LockingSecretProtect:
([]table.SecretProtect) (len=1 cap=1) {
 (table.SecretProtect) {
  UID: (uid.UID) (len=8 cap=8) {
   00000000  00 00 00 1d 00 00 00 1e                           |........|
  },
  Table: (uid.RowUID) (len=8 cap=8) {
   00000000  00 00 00 01 00 00 08 06                           |........|
  },
  Column: (uint) 3,
  ProtectMechanism: ([]table.ProtectMechanism) (len=1 cap=1) {
   (table.ProtectMechanism) 1
  }
 }
}

Test if revert-noerase still works:

[root@localhost ~]# echo okokok > /dev/nvme0n1
[root@localhost ~]# head -c 6 /dev/nvme0n1 |hexdump -C
00000000  6f 6b 6f 6b 6f 6b                                 |okokok|
00000006
[root@localhost ~]# gosedctl initial-setup --device=/dev/nvme0 --password=sid
Open device: /dev/nvme0Find ComID
Create new ControlSession
Create new Session
Read MSID Pin
Authenticate with MSID as SID Authority at AdminSP
Set new password
Activate LockingSP
Configure LockingRange0
SetMBRDone on
SetMBREnable on
[root@localhost ~]# head -c 6 /dev/nvme0n1 |hexdump -C
00000000  6f 6b 6f 6b 6f 6b                                 |okokok|
00000006
[root@localhost ~]# gosedctl revert-tper --device=/dev/nvme0 --password=sid

# data is gone
[root@localhost ~]# head -c 6 /dev/nvme0n1 |hexdump -C
00000000  00 00 00 00 00 00                                 |......|
00000006

# setup
[root@localhost ~]# gosedctl initial-setup --device=/dev/nvme0 --password=sid
Open device: /dev/nvme0Find ComID
Create new ControlSession
Create new Session
Read MSID Pin
Authenticate with MSID as SID Authority at AdminSP
Set new password
Activate LockingSP
Configure LockingRange0
SetMBRDone on
SetMBREnable on
[root@localhost ~]# echo okokok > /dev/nvme0n1
[root@localhost ~]# head -c 6 /dev/nvme0n1 |hexdump -C
00000000  6f 6b 6f 6b 6f 6b                                 |okokok|
00000006
[root@localhost ~]# gosedctl revert-noerase --device=/dev/nvme0 --password=sid

# data is still present
[root@localhost ~]# head -c 6 /dev/nvme0n1 |hexdump -C
00000000  6f 6b 6f 6b 6f 6b                                 |okokok|
00000006

Example discovery output:

===> DRIVE SECURITY INFORMATION
2024/12/12 04:02:34 Drive identity: Protocol=NVMe, Model=WDC CL SN730 SDBQNTY-512G-2020, Serial=24223W80276311, Firmware=11160120
2024/12/12 04:02:34 SecurityProtocols: [0 1 2]
2024/12/12 04:02:34 Drive certificate:
([]*x509.Certificate) <nil>

===> TCG AUTO ComID SELF-TEST
2024/12/12 04:02:34 Allocated ComID 0x00007ffe
2024/12/12 04:02:34 ComID validated successfully
2024/12/12 04:02:34 Synchronous protocol stack reset successfully

===> TCG FEATURE DISCOVERY
(*core.Level0Discovery)(0xc0001a60f0)({
  MajorVersion: (int) 0,
  MinorVersion: (int) 1,
  Vendor: ([32]uint8) (len=32 cap=32) {
    00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  },
  TPer: (*feature.TPer)(0xc000012370)({
    SyncSupported: (bool) true,
    AsyncSupported: (bool) false,
    AckNakSupported: (bool) false,
    BufferMgmtSupported: (bool) false,
    StreamingSupported: (bool) true,
    ComIDMgmtSupported: (bool) false
  }),
  Locking: (*feature.Locking)(0xc000012380)({
    LockingSupported: (bool) true,
    LockingEnabled: (bool) false,
    Locked: (bool) false,
    MediaEncryption: (bool) true,
    MBREnabled: (bool) false,
    MBRDone: (bool) false,
    MBRShadowing: (bool) true
  }),
  Geometry: (*feature.Geometry)(0xc000018120)({
    Align: (bool) true,
    LogicalBlockSize: (uint32) 512,
    AlignmentGranularity: (uint64) 1,
    LowestAlignedLBA: (uint64) 0
  }),
  SecureMsg: (*feature.SecureMsg)(<nil>),
  Enterprise: (*feature.Enterprise)(<nil>),
  OpalV1: (*feature.OpalV1)(<nil>),
  SingleUser: (*feature.SingleUser)(0xc0000123f8)({
    NumberLockingObjectsSupported: (uint32) 9,
    Policy: (bool) true,
    Any: (bool) false,
    All: (bool) false
  }),
  DataStore: (*feature.DataStore)(0x82e3a0)({
  }),
  OpalV2: (*feature.OpalV2)(0xc000012410)({
    CommonSSC: (feature.CommonSSC) {
      BaseComID: (uint16) 32766,
      NumComID: (uint16) 1
    },
    RangeCrossingBehavior: (bool) false,
    NumLockingSPAdminSupported: (uint16) 4,
    NumLockingSPUserSupported: (uint16) 9,
    InitialCPINSIDIndicator: (uint8) 0,
    BehaviorCPINSIDuponTPerRevert: (uint8) 0
  }),
  Opalite: (*feature.Opalite)(<nil>),
  PyriteV1: (*feature.PyriteV1)(<nil>),
  PyriteV2: (*feature.PyriteV2)(<nil>),
  RubyV1: (*feature.RubyV1)(<nil>),
  LockingLBA: (*feature.LockingLBA)(<nil>),
  BlockSID: (*feature.BlockSID)(0xc000012470)({
    LockingSPFreezeLockState: (bool) false,
    LockingSPFreezeLockSupported: (bool) false,
    SIDAuthenticationBlockedState: (bool) false,
    SIDValueState: (bool) false,
    HardwareReset: (bool) false
  }),
  NamespaceLocking: (*feature.NamespaceLocking)(<nil>),
  DataRemoval: (*feature.DataRemoval)(<nil>),
  NamespaceGeometry: (*feature.NamespaceGeometry)(<nil>),
  ShadowMBRForMultipleNamespaces: (*feature.ShadowMBRForMultipleNamespaces)(<nil>),
  SeagatePorts: (*feature.SeagatePorts)(<nil>),
  UnknownFeatures: ([]uint16) <nil>
})

@mge-fbe-com mge-fbe-com marked this pull request as ready for review December 12, 2024 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant