]> git.ipfire.org Git - thirdparty/mdadm.git/commit
imsm: print disk encryption information
authorBlazej Kucman <blazej.kucman@intel.com>
Fri, 22 Mar 2024 11:51:19 +0000 (12:51 +0100)
committerMariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
Tue, 2 Apr 2024 06:29:15 +0000 (08:29 +0200)
commitbf62ed5d9642aa60abf4ac2d1d89f173bd66ae48
tree10805438e17744d9857542709603fefc018bb413
parent336e13fc5ef43bc5b4633a9dadac5f7208e6c241
imsm: print disk encryption information

Print SATA/NVMe disk encryption information in --detail-platform.
Encryption Ability and Status will be printed for each disk.

There is one exception, Opal SATA drives encryption is not checked when
ENCRYPTION_NO_VERIFY key with "sata_opal" value is set in conf, for this
reason such drives are treated as without encryption support.

To test this feature, drives SATA/NVMe with Opal support or SATA drives
with encryption support have to be used.

Example outputs of --detail-platform:

Non Opal, encryption enabled, SATA drive:
Port0 : /dev/sdc (CVPR050600G3120LGN)
        Encryption(Ability|Status): Other|Unlocked

NVMe drive without Opal support:
NVMe under VMD : /dev/nvme2n1 (PHLF737302GB1P0GGN)
        Encryption(Ability|Status): None|Unencrypted

Unencrypted SATA drive with OPAL support:

- default allow_tpm, we will get an error from mdadm:
          Port6 : /dev/sdi (CVTS4246015V180IGN)
mdadm: Detected SATA drive /dev/sdi with Trusted Computing support.
mdadm: Cannot verify encryption state. Requires libata.tpm_enabled=1.
mdadm: Failed to get drive encrytpion information.

-  default "allow_tpm" and config entry "ENCRYPTION_NO_VERIFY sata_opal":
Port6 : /dev/sdi (CVTS4246015V180IGN)
        Encryption(Ability|Status): None|Unencrypted

- added "libata.allow_tpm=1" to boot parameters(requires reboot),
the status will be read correctly:
Port6 : /dev/sdi (CVTS4246015V180IGN)
        Encryption(Ability|Status): SED|Unencrypted

Signed-off-by: Blazej Kucman <blazej.kucman@intel.com>
Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
drive_encryption.c
drive_encryption.h
mdadm.conf.5.in
super-intel.c