Skip to content

[Mellanox] [SED] Wipe SSD CLI #28433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ShauliTaragin wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

[Mellanox] [SED] Wipe SSD CLI #28433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion build_debian.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -385,7 +385,8 @@ sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y in
ethtool \
zstd \
tzdata-legacy \
nvme-cli
nvme-cli \
rsync

sudo cp files/initramfs-tools/pzstd $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/pzstd
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/pzstd
Expand Down
2 changes: 2 additions & 0 deletions files/build_templates/sonic_debian_extension.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,8 @@ sudo cp $IMAGE_CONFIGS/sed_mgmt/sed_pw_reset.sh $FILESYSTEM_ROOT/usr/local/bin/
sudo chmod 755 $FILESYSTEM_ROOT/usr/local/bin/sed_pw_reset.sh
sudo cp $IMAGE_CONFIGS/sed_mgmt/sed_pw_tpm_recovery.sh $FILESYSTEM_ROOT/usr/local/bin/
sudo chmod 755 $FILESYSTEM_ROOT/usr/local/bin/sed_pw_tpm_recovery.sh
sudo cp $IMAGE_CONFIGS/sed_mgmt/ssd_erase.sh $FILESYSTEM_ROOT/usr/local/bin/
sudo chmod 755 $FILESYSTEM_ROOT/usr/local/bin/ssd_erase.sh
sudo cp $IMAGE_CONFIGS/sed_mgmt/sed-pw-tpm-recovery.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM
echo "sed-pw-tpm-recovery.service" | sudo tee -a $GENERATED_SERVICE_FILE
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT systemctl enable sed-pw-tpm-recovery.service
Expand Down
34 changes: 34 additions & 0 deletions files/image_config/sed_mgmt/sed_pw_utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,3 +233,37 @@ check_sed_ready() {
log_info "SED is ready for operations on disk $disk_name"
return 0
}

# Validate SSD wipe prereqs. Caller (ssd_erase.sh) must have already set
# psid_val, default_pw, tpm_reg, tpm_reg_2 globals (empty is rejected at CLI
# parse time). Populates disk_name and nvme_disk_name on success.
# Delegates TPM / SED / LockingEnabled checks to check_sed_ready.
# Tool availability is enforced upstream by ssd_erase.sh:check_tools.
check_sed_crypto_erase_prereqs() {
log_info "Check pre-requirements for SED crypto erase"

if [ -z "$disk_name" ] && ! find_disk_name; then
log_error "Block device cannot be determined for SED crypto erase"
return 1
fi

if ! check_sed_ready; then
return 1
fi

# sedutil-cli --PSIDrevert requires the controller name (e.g. /dev/nvme0),
# not the namespace (e.g. /dev/nvme0n1). Derive it here for do_crypto_erase.
nvme_disk_name=$(echo "$disk_name" | sed -E 's|(/dev/nvme[0-9]+).*|\1|')
log_debug "nvme_disk_name (controller): $nvme_disk_name"

# NVMe sanitize support (Block Erase = sanact 0x02).
local id_out
id_out=$(nvme id-ctrl -H "$disk_name" 2>&1)
if ! echo "$id_out" | grep -qi 'sanitize'; then
log_error "NVMe controller does not advertise sanitize support"
return 1
fi

log_info "SED crypto erase prerequisites OK (disk=$nvme_disk_name)"
return 0
}
Loading
Loading