search

storaged-project / udisks

The UDisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies.
https://storaged.org/doc/udisks2-api/latest/
Other
348 stars 142 forks source link

thunderbolt storage not be auto mounted while secureboot is enabled and already protected by DMAR #793

Open alex-tu-cc opened 4 years ago

alex-tu-cc commented 4 years ago

Tested on Ubuntu Focal, while secureboot enabled and DMAR supported. It does not need a user authentication so a block device will shown in /dev while user attach a thunderbolt storage.

But the attached thunderbolt storage will not be auto mounted. So far, user need to mount it manually by command.

tbzatek commented 4 years ago

There might be issues identifying the device as internal/removable. Anyway, can you please post output of udisksctl dump and dmesg? Are you plugging the device in after boot or before?

alex-tu-cc commented 4 years ago

Hi, I plugged the thunderbolt storage after boot. Please refer to the dmesg and udiskctl dump after plugged thunderbolt storage.

alex-tu-cc commented 2 years ago

@tbzatek Any other information that you need?

tbzatek commented 2 years ago

@alex-tu-cc I cannot access the dumps unless I register. Could you please post them here as attachments?

alex-tu-cc commented 2 years ago

@tbzatek sorry that pastebin wasn't that convenient. Please refer to the following attachment that I copied from the same comment. dmesg.txt udiskctl_dump.txt

khfeng commented 2 years ago

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

tbzatek commented 2 years ago

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

FYI, the UDisks hint doesn't necessarily come from one place, if there's something specific as returned by the NVMe device itself, we could use it.

tbzatek commented 2 years ago

Can you also post nvme id-ctrl -H /dev/nvme1 please?

khfeng commented 2 years ago

This patch should solve the issue: https://lkml.org/lkml/2022/1/11/1226

FYI, the UDisks hint doesn't necessarily come from one place, if there's something specific as returned by the NVMe device itself, we could use it.

It's just regular NVMe. However, we can still go up the hierarchy and check the physical device's removable sysfs attribute as predicate. This should be more future proof if the maintainer intends to remove GENHD_FL_REMOVABLE from USB storage.

I can come up with a patch if you don't mind.

khfeng commented 2 years ago

Can you also post nvme id-ctrl -H /dev/nvme1 please?


NVME Identify Controller:
vid       : 0x1dee
ssvid     : 0x126f
sn        : HBSD28232000029     
mn        : HP Portable SSD P800 256GB              
fr        : SVN127  
rab       : 6
ieee      : 000000
cmic      : 0
[3:3] : 0 ANA not supported
[2:2] : 0 PCI
[1:1] : 0 Single Controller
[0:0] : 0 Single Port

mdts : 6 cntlid : 0x1 ver : 0x10201 rtd3r : 0x7a120 rtd3e : 0x1e8480 oaes : 0x200 [14:14] : 0 Endurance Group Event Aggregate Log Page Change Notice Not Supported [13:13] : 0 LBA Status Information Notices Not Supported [12:12] : 0 Predictable Latency Event Aggregate Log Change Notices Not Supported [11:11] : 0 Asymmetric Namespace Access Change Notices Not Supported [9:9] : 0x1 Firmware Activation Notices Supported [8:8] : 0 Namespace Attribute Changed Event Not Supported

ctratt : 0 [9:9] : 0 UUID List Not Supported [7:7] : 0 Namespace Granularity Not Supported [5:5] : 0 Predictable Latency Mode Not Supported [4:4] : 0 Endurance Groups Not Supported [3:3] : 0 Read Recovery Levels Not Supported [2:2] : 0 NVM Sets Not Supported [1:1] : 0 Non-Operational Power State Permissive Not Supported [0:0] : 0 128-bit Host Identifier Not Supported

rrls : 0 crdt1 : 0 crdt2 : 0 crdt3 : 0 oacs : 0x16 [9:9] : 0 Get LBA Status Capability Not Supported [8:8] : 0 Doorbell Buffer Config Not Supported [7:7] : 0 Virtualization Management Not Supported [6:6] : 0 NVMe-MI Send and Receive Not Supported [5:5] : 0 Directives Not Supported [4:4] : 0x1 Device Self-test Supported [3:3] : 0 NS Management and Attachment Not Supported [2:2] : 0x1 FW Commit and Download Supported [1:1] : 0x1 Format NVM Supported [0:0] : 0 Security Send and Receive Not Supported

acl : 4 aerl : 7 frmw : 0x14 [4:4] : 0x1 Firmware Activate Without Reset Supported [3:1] : 0x2 Number of Firmware Slots [0:0] : 0 Firmware Slot 1 Read/Write

lpa : 0xf [3:3] : 0x1 Telemetry host/controller initiated log page Supported [2:2] : 0x1 Extended data for Get Log Page Supported [1:1] : 0x1 Command Effects Log Page Supported [0:0] : 0x1 SMART/Health Log Page per NS Supported

elpe : 255 npss : 4 avscc : 0 [0:0] : 0 Admin Vendor Specific Commands uses Vendor Specific Format

apsta : 0x1 [0:0] : 0x1 Autonomous Power State Transitions Supported

wctemp : 343 cctemp : 353 mtfa : 50 hmpre : 0 hmmin : 0 tnvmcap : 0 unvmcap : 0 rpmbs : 0 [31:24]: 0 Access Size [23:16]: 0 Total Size [5:3] : 0 Authentication Method [2:0] : 0 Number of RPMB Units

edstt : 5 dsto : 1 fwug : 0 kas : 0 hctma : 0x1 [0:0] : 0x1 Host Controlled Thermal Management Supported

mntmt : 303 mxtmt : 348 sanicap : 0x2 [31:30] : 0 Additional media modification after sanitize operation completes successfully is not defined [29:29] : 0 No-Deallocate After Sanitize bit in Sanitize command Supported [2:2] : 0 Overwrite Sanitize Operation Not Supported [1:1] : 0x1 Block Erase Sanitize Operation Supported [0:0] : 0 Crypto Erase Sanitize Operation Not Supported

hmminds : 0 hmmaxd : 0 nsetidmax : 0 anatt : 0 anacap : 0 [7:7] : 0 Non-zero group ID Not Supported [6:6] : 0 Group ID does not change [4:4] : 0 ANA Change state Not Supported [3:3] : 0 ANA Persistent Loss state Not Supported [2:2] : 0 ANA Inaccessible state Not Supported [1:1] : 0 ANA Non-optimized state Not Supported [0:0] : 0 ANA Optimized state Not Supported

anagrpmax : 0 nanagrpid : 0 sqes : 0x66 [7:4] : 0x6 Max SQ Entry Size (64) [3:0] : 0x6 Min SQ Entry Size (64)

cqes : 0x44 [7:4] : 0x4 Max CQ Entry Size (16) [3:0] : 0x4 Min CQ Entry Size (16)

maxcmd : 0 nn : 1 oncs : 0x5f [7:7] : 0 Verify Not Supported [6:6] : 0x1 Timestamp Supported [5:5] : 0 Reservations Not Supported [4:4] : 0x1 Save and Select Supported [3:3] : 0x1 Write Zeroes Supported [2:2] : 0x1 Data Set Management Supported [1:1] : 0x1 Write Uncorrectable Supported [0:0] : 0x1 Compare Supported

fuses : 0 [0:0] : 0 Fused Compare and Write Not Supported

fna : 0 [2:2] : 0 Crypto Erase Not Supported as part of Secure Erase [1:1] : 0 Crypto Erase Applies to Single Namespace(s) [0:0] : 0 Format Applies to Single Namespace(s)

vwc : 0x1 [0:0] : 0x1 Volatile Write Cache Present

awun : 0 awupf : 0 nvscc : 0 [0:0] : 0 NVM Vendor Specific Commands uses Vendor Specific Format

nwpc : 0 [2:2] : 0 Permanent Write Protect Not Supported [1:1] : 0 Write Protect Until Power Supply Not Supported [0:0] : 0 No Write Protect and Write Protect Namespace Not Supported

acwu : 0 sgls : 0 [1:0] : 0 Scatter-Gather Lists Not Supported

mnan : 0 subnqn : ioccsz : 0 iorcsz : 0 icdoff : 0 ctrattr : 0 [0:0] : 0 Dynamic Controller Model

msdbd : 0 ps 0 : mp:9.00W operational enlat:0 exlat:0 rrt:0 rrl:0 rwt:0 rwl:0 idle_power:- active_power:- ps 1 : mp:4.60W operational enlat:0 exlat:0 rrt:1 rrl:1 rwt:1 rwl:1 idle_power:- active_power:- ps 2 : mp:3.80W operational enlat:0 exlat:0 rrt:2 rrl:2 rwt:2 rwl:2 idle_power:- active_power:- ps 3 : mp:0.0450W non-operational enlat:2000 exlat:2000 rrt:3 rrl:3 rwt:3 rwl:3 idle_power:- active_power:- ps 4 : mp:0.0040W non-operational enlat:6000 exlat:8000 rrt:4 rrl:4 rwt:4 rwl:4 idle_power:- active_power:-

tbzatek commented 2 years ago

Thanks for the output, I don't see anything specific around removable capability (unsurprisingly).

Thinking about this in broader view, we might perhaps add new "thunderbolt" value to the org.freedesktop.UDisks2.Drive.ConnectionBus property. And then add support for ejecting if there's such functionality for Thunderbolt devices (simple write to the delete/remove sysfs node?)

Anyway, walking the device hierarchy up and checking capabilities there might be the way to go. Could you also please post udevadm info -a /dev/nvme1 to see how the hierarchy looks like? I don't have any external NVMe SSD available here, just the TB3 ports on my MacBook.

khfeng commented 2 years ago

Thanks for the output, I don't see anything specific around removable capability (unsurprisingly).

Thinking about this in broader view, we might perhaps add new "thunderbolt" value to the org.freedesktop.UDisks2.Drive.ConnectionBus property. And then add support for ejecting if there's such functionality for Thunderbolt devices (simple write to the delete/remove sysfs node?)

Anyway, walking the device hierarchy up and checking capabilities there might be the way to go. Could you also please post udevadm info -a /dev/nvme1 to see how the hierarchy looks like? I don't have any external NVMe SSD available here, just the TB3 ports on my MacBook.

I agree this is to way to go, especially when maintainer mentioned USB storages shouldn't have GENHD_FL_REMOVABLE applied, so check the physical device's removable sysfs attr is the most reliable and scalable way to deal with this issue.