Skip to content

Commit 925650f

Browse files
mcgrofmcgrof
committed
tcg-storage: add TCG Opal storage security testing workflow
Add TCG (Trusted Computing Group) Opal SED (Self-Encrypting Drive) testing workflow for validating storage security features. This workflow enables testing of hardware-based full disk encryption capabilities found in modern NVMe and SATA drives. Key features: - TCG Opal 2.0+ compliance testing for self-encrypting drives - Support for drive provisioning, locking, and unlocking operations - Integration with sedutil-cli for drive management - Configurable encryption parameters (Admin1 password, locking ranges) - Multi-filesystem support (XFS, Btrfs, ext4) on encrypted drives - A/B testing support for baseline vs development comparisons - Device capability detection and validation The workflow validates critical storage security operations: - Initial drive provisioning with Owner credentials - Locking range configuration and management - Power cycle testing to verify encryption persistence - Performance impact measurement of encryption - Compatibility testing across different drive models Defconfigs: - tcg-storage: Standard TCG Opal testing configuration Note that Qemu lacks TCG Opal support, however if work is put in place for that, this can be used to test it. The real practical use would instead be to use the new declared hosts feature which enables us to test on bare metal, skipping bringup, you can use something like this: make defconfig-tcg-storage-declared-hosts DECLARE_HOSTS=foo TCG_DEVICE=/dev/nvme4n1 Workflow integration follows kdevops patterns: make defconfig-tcg-storage make bringup make tcg-storage # Run TCG Opal tests make tcg-results # View test results This enables systematic testing of hardware-based encryption features critical for data-at-rest protection in enterprise and security-sensitive environments. Generated-by: Claude AI Signed-off-by: Luis Chamberlain <[email protected]>
1 parent 6adeca5 commit 925650f

File tree

31 files changed

+1585
-0
lines changed

31 files changed

+1585
-0
lines changed

‎defconfigs/tcg-storage‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# TCG Storage testing configuration
2+
CONFIG_LIBVIRT=y
3+
CONFIG_LIBVIRT_DYNAMIC=y
4+
CONFIG_LIBVIRT_HOST_PREFIX="tcg"
5+
CONFIG_LIBVIRT_MEM_START=4096
6+
CONFIG_LIBVIRT_MEM_END=4096
7+
CONFIG_LIBVIRT_VCPUS_START=4
8+
CONFIG_LIBVIRT_VCPUS_END=4
9+
10+
# Workflow selection
11+
CONFIG_WORKFLOWS=y
12+
CONFIG_WORKFLOWS_TESTS=y
13+
CONFIG_WORKFLOWS_LINUX_TESTS=y
14+
CONFIG_WORKFLOWS_DEDICATED_WORKFLOW=y
15+
CONFIG_KDEVOPS_WORKFLOW_DEDICATE_TCG_STORAGE=y
16+
CONFIG_KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE=y
17+
18+
# TCG Storage specific options
19+
CONFIG_TCG_STORAGE_RUN_UNIT_TESTS=y
20+
# For virtual testing with NVMe
21+
CONFIG_TCG_STORAGE_TEST_DEVICE="/dev/nvme0n1"
22+
CONFIG_TCG_STORAGE_TEST_DEVICE_TYPE="nvme"
23+
24+
# Storage options for test VM - use NVMe
25+
CONFIG_LIBVIRT_EXTRA_STORAGE_DRIVE_COUNT=1
26+
CONFIG_LIBVIRT_EXTRA_STORAGE_DRIVE_NVME=y
27+
CONFIG_LIBVIRT_EXTRA_STORAGE_DRIVE_SIZE=10240

‎defconfigs/tcg-storage-declared-hosts‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#
2+
# TCG Storage testing with declared hosts (bare metal or pre-existing infrastructure)
3+
#
4+
# Usage:
5+
# make defconfig-tcg-storage-declared-hosts DECLARE_HOSTS=foo TCG_DEVICE=/dev/nvme0n1
6+
# make
7+
# make tcg-storage
8+
#
9+
CONFIG_WORKFLOWS=y
10+
CONFIG_WORKFLOWS_TESTS=y
11+
CONFIG_WORKFLOWS_LINUX_TESTS=y
12+
CONFIG_WORKFLOWS_DEDICATED_WORKFLOW=y
13+
CONFIG_KDEVOPS_WORKFLOW_DEDICATE_TCG_STORAGE=y
14+
CONFIG_KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE=y
15+
16+
# Skip bringup for declared hosts - we're using existing systems
17+
CONFIG_SKIP_BRINGUP=y
18+
CONFIG_KDEVOPS_USE_DECLARED_HOSTS=y
19+
20+
# TCG Storage testing options
21+
CONFIG_TCG_STORAGE_GITHUB_URL="https://github.com/open-source-firmware/go-tcg-storage"
22+
CONFIG_TCG_STORAGE_BRANCH="main"
23+
24+
# Device configuration - will be overridden by TCG_DEVICE variable
25+
CONFIG_TCG_STORAGE_TEST_DEVICE="/dev/nvme0n1"
26+
CONFIG_TCG_STORAGE_TEST_DEVICE_TYPE="nvme"
27+
CONFIG_TCG_STORAGE_TEST_PASSWORD="testpassword123"
28+
29+
# Enable both unit and integration tests for real hardware
30+
CONFIG_TCG_STORAGE_RUN_UNIT_TESTS=y
31+
CONFIG_TCG_STORAGE_RUN_INTEGRATION_TESTS=y
32+
33+
# Enable all TCG test types for real hardware
34+
CONFIG_TCG_STORAGE_TEST_TAKE_OWNERSHIP=y
35+
CONFIG_TCG_STORAGE_TEST_LOCKING_RANGES=y
36+
# Be careful with revert on real hardware
37+
CONFIG_TCG_STORAGE_TEST_REVERT=n
38+
39+
CONFIG_TCG_STORAGE_RESULTS_DIR="workflows/tcg-storage/results"

‎kconfigs/workflows/Kconfig‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,15 @@ config KDEVOPS_WORKFLOW_DEDICATE_BUILD_LINUX
248248
This will dedicate your configuration to running only the
249249
build-linux workflow for repeated Linux kernel builds.
250250

251+
config KDEVOPS_WORKFLOW_DEDICATE_TCG_STORAGE
252+
bool "tcg-storage"
253+
depends on !KDEVOPS_USE_DECLARED_HOSTS
254+
select KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE
255+
help
256+
This will dedicate your configuration to running only the
257+
TCG storage workflow for testing TCG/OPAL functionality on
258+
self-encrypting drives.
259+
251260
endchoice
252261

253262
config KDEVOPS_WORKFLOW_NAME
@@ -267,6 +276,7 @@ config KDEVOPS_WORKFLOW_NAME
267276
default "ai" if KDEVOPS_WORKFLOW_DEDICATE_AI
268277
default "minio" if KDEVOPS_WORKFLOW_DEDICATE_MINIO
269278
default "build-linux" if KDEVOPS_WORKFLOW_DEDICATE_BUILD_LINUX
279+
default "tcg-storage" if KDEVOPS_WORKFLOW_DEDICATE_TCG_STORAGE
270280

271281
endif
272282

@@ -395,6 +405,16 @@ config KDEVOPS_WORKFLOW_NOT_DEDICATED_ENABLE_AI
395405
Select this option if you want to provision AI benchmarks on a
396406
single target node for by-hand testing.
397407

408+
config KDEVOPS_WORKFLOW_NOT_DEDICATED_ENABLE_TCG_STORAGE
409+
bool "tcg-storage"
410+
depends on !KDEVOPS_USE_DECLARED_HOSTS
411+
select KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE
412+
depends on LIBVIRT || TERRAFORM_PRIVATE_NET
413+
help
414+
Select this option if you want to provision TCG storage testing on a
415+
single target node for testing TCG/OPAL functionality on
416+
self-encrypting drives.
417+
398418
endif # !WORKFLOWS_DEDICATED_WORKFLOW
399419

400420
config KDEVOPS_WORKFLOW_ENABLE_FSTESTS
@@ -552,6 +572,17 @@ source "workflows/build-linux/Kconfig"
552572
endmenu
553573
endif # KDEVOPS_WORKFLOW_ENABLE_BUILD_LINUX
554574

575+
config KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE
576+
bool
577+
output yaml
578+
default y if KDEVOPS_WORKFLOW_NOT_DEDICATED_ENABLE_TCG_STORAGE || KDEVOPS_WORKFLOW_DEDICATE_TCG_STORAGE
579+
580+
if KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE
581+
menu "Configure and run TCG storage tests"
582+
source "workflows/tcg-storage/Kconfig"
583+
endmenu
584+
endif # KDEVOPS_WORKFLOW_ENABLE_TCG_STORAGE
585+
555586
config KDEVOPS_WORKFLOW_ENABLE_SSD_STEADY_STATE
556587
bool "Attain SSD steady state prior to tests"
557588
output yaml

‎playbooks/roles/ansible_cfg/defaults/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
---
2+
ansible_cfg_file: "{{ topdir_path | default(playbook_dir | dirname) }}/ansible.cfg"
3+
topdir_path: "{{ playbook_dir | dirname }}"
4+
ansible_cfg_inventory: "{{ topdir_path | default(playbook_dir | dirname) }}/hosts"
25
ansible_cfg_deprecation_warnings: true
36
ansible_cfg_callback_plugin_string: dense
47
ansible_cfg_callback_plugin_check_mode_markers: false

‎playbooks/roles/gen_hosts/defaults/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier GPL-2.0+
22
---
3+
ansible_cfg_inventory: "{{ topdir_path | default(playbook_dir | dirname) }}/hosts"
34
topdir_path: "/dev/null"
45

56
hosts_type_generic: true
@@ -30,6 +31,8 @@ kdevops_workflow_enable_sysbench: false
3031
kdevops_workflow_enable_fio_tests: false
3132
kdevops_workflow_enable_mmtests: false
3233
kdevops_workflow_enable_ai: false
34+
kdevops_workflow_enable_minio: false
35+
kdevops_workflow_enable_tcg_storage: false
3336
workflows_reboot_limit: false
3437
kdevops_use_declared_hosts: false
3538

‎playbooks/roles/gen_hosts/tasks/main.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,21 @@
270270
- ansible_hosts_template.stat.exists
271271
- not kdevops_use_declared_hosts|default(false)|bool
272272

273+
- name: Generate the Ansible hosts file for a dedicated TCG Storage setup
274+
tags: ['hosts']
275+
ansible.builtin.template:
276+
src: "{{ kdevops_hosts_template }}"
277+
dest: "{{ ansible_cfg_inventory }}"
278+
force: true
279+
trim_blocks: True
280+
lstrip_blocks: True
281+
mode: '0644'
282+
when:
283+
- kdevops_workflows_dedicated_workflow
284+
- kdevops_workflow_enable_tcg_storage|default(false)|bool
285+
- ansible_hosts_template.stat.exists
286+
- not kdevops_use_declared_hosts|default(false)|bool
287+
273288
- name: Verify if final host file exists
274289
ansible.builtin.stat:
275290
path: "{{ ansible_cfg_inventory }}"

‎playbooks/roles/gen_hosts/templates/workflows/tcg-storage.j2‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{#
2+
TCG Storage workflow hosts template
3+
4+
This template generates the Ansible hosts file for the TCG Storage testing workflow.
5+
It supports both single node and baseline/dev (A/B testing) configurations.
6+
#}
7+
[all]
8+
localhost ansible_connection=local
9+
{{ kdevops_host_prefix }}-tcg-storage
10+
{% if kdevops_baseline_and_dev %}
11+
{{ kdevops_host_prefix }}-tcg-storage-dev
12+
{% endif %}
13+
14+
[all:vars]
15+
ansible_python_interpreter = "{{ kdevops_python_interpreter }}"
16+
17+
[baseline]
18+
{{ kdevops_host_prefix }}-tcg-storage
19+
20+
[baseline:vars]
21+
ansible_python_interpreter = "{{ kdevops_python_interpreter }}"
22+
23+
{% if kdevops_baseline_and_dev %}
24+
[dev]
25+
{{ kdevops_host_prefix }}-tcg-storage-dev
26+
27+
[dev:vars]
28+
ansible_python_interpreter = "{{ kdevops_python_interpreter }}"
29+
30+
{% endif %}
31+
[tcg-storage]
32+
{{ kdevops_host_prefix }}-tcg-storage
33+
{% if kdevops_baseline_and_dev %}
34+
{{ kdevops_host_prefix }}-tcg-storage-dev
35+
{% endif %}
36+
37+
[tcg-storage:vars]
38+
ansible_python_interpreter = "{{ kdevops_python_interpreter }}"

‎playbooks/roles/gen_nodes/defaults/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ kdevops_workflow_enable_selftests: false
1313
kdevops_workflow_enable_mmtests: false
1414
kdevops_workflow_enable_fio_tests: false
1515
kdevops_workflow_enable_ai: false
16+
kdevops_workflow_enable_minio: false
17+
kdevops_workflow_enable_tcg_storage: false
1618
kdevops_nfsd_enable: false
1719
kdevops_smbd_enable: false
1820
kdevops_krb5_enable: false

‎playbooks/roles/gen_nodes/tasks/main.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -906,6 +906,41 @@
906906
- kdevops_baseline_and_dev
907907
- not minio_enable_multifs_testing|default(false)|bool
908908

909+
# TCG Storage nodes
910+
- name: Generate the TCG Storage kdevops nodes file using {{ kdevops_nodes_template }} as jinja2 source template
911+
tags: ['hosts']
912+
vars:
913+
node_template: "{{ kdevops_nodes_template | basename }}"
914+
nodes: "{{ [kdevops_host_prefix + '-tcg-storage'] }}"
915+
all_generic_nodes: "{{ [kdevops_host_prefix + '-tcg-storage'] }}"
916+
ansible.builtin.template:
917+
src: "{{ node_template }}"
918+
dest: "{{ topdir_path }}/{{ kdevops_nodes }}"
919+
force: true
920+
mode: '0644'
921+
when:
922+
- kdevops_workflows_dedicated_workflow
923+
- kdevops_workflow_enable_tcg_storage|default(false)|bool
924+
- ansible_nodes_template.stat.exists
925+
- not kdevops_baseline_and_dev
926+
927+
- name: Generate the TCG Storage kdevops nodes file with dev hosts using {{ kdevops_nodes_template }} as jinja2 source template
928+
tags: ['hosts']
929+
vars:
930+
node_template: "{{ kdevops_nodes_template | basename }}"
931+
nodes: "{{ [kdevops_host_prefix + '-tcg-storage', kdevops_host_prefix + '-tcg-storage-dev'] }}"
932+
all_generic_nodes: "{{ [kdevops_host_prefix + '-tcg-storage', kdevops_host_prefix + '-tcg-storage-dev'] }}"
933+
ansible.builtin.template:
934+
src: "{{ node_template }}"
935+
dest: "{{ topdir_path }}/{{ kdevops_nodes }}"
936+
force: true
937+
mode: '0644'
938+
when:
939+
- kdevops_workflows_dedicated_workflow
940+
- kdevops_workflow_enable_tcg_storage|default(false)|bool
941+
- ansible_nodes_template.stat.exists
942+
- kdevops_baseline_and_dev
943+
909944
# Build-linux workflow nodes
910945

911946
# Multi-filesystem Build-linux configurations

‎playbooks/roles/guestfs/defaults/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
---
22
distro_debian_based: false
3+
virtbuilder_os_version: "debian-13-generic-amd64-daily"
34

45
libvirt_uri_system: false
56
libvirt_enable_largeio: false
67
bootlinux_9p: false
8+
kdevops_workflow_enable_minio: false
9+
kdevops_workflow_enable_tcg_storage: false

0 commit comments

Comments
 (0)