SED Enterprise?

[Doug McIntyre]

I have some WD/HGST HUH721008AL drives that support Enterprise SED. I've been trying to utilize them with the build in SED support in FreeNAS 11.1U{whatever} and now 11.2 release.

Everything I've read up on SED mentions there are Opal disks, and then there are TCG Enterprise.

What I'm finding is that the sedutil-cli can see them, report on them, but not actually initialize them.

# sedutil-cli --InitialSetup password /dev/da0
Session Authenticate failed (response = false)
takeOwnership failed unable to set new SID password
Initial setup failed - unable to take ownership

If I use the documented way of FreeNAS way of setting the password in the GUI, and then running sedhelper, this is what I get.

# sedhelper setup password
da5 [SETUP FAILED]
da4 [SETUP FAILED]
da3 [SETUP FAILED]
da1 [SETUP FAILED]
da2 [SETUP FAILED]
da0 [SETUP FAILED]


But sedutil-cli can see the drives.
# sedutil-cli --scan
Scanning for Opal compliant disks
/dev/ada0 No INTEL SSDSC2BB160G4 D2010370
/dev/ada1 No INTEL SSDSC2BB160G4 D2010370
/dev/ada2 No INTEL SSDSC2BB160G4 D2010370
/dev/da0 E ATA HGST HUH721008AL X21D
/dev/da1 E ATA HGST HUH721008AL X21D
/dev/da2 E ATA HGST HUH721008AL X21D
/dev/da3 E ATA HGST HUH721008AL X21D
/dev/da4 E ATA HGST HUH721008AL X21D
/dev/da5 E ATA HGST HUH721008AL X21D

And can query the drives
# sedutil-cli --query /dev/da0

/dev/da0 SAS ATA HGST HUH721008AL X21D 7SGBULLC
TPer function (0x0001)
ACKNAK = N, ASYNC = N. BufferManagement = N, comIDManagement = N, Streaming = Y, SYNC = Y
Locking function (0x0002)
Locked = N, LockingEnabled = N, LockingSupported = Y, MBRDone = N, MBREnabled = N, MediaEncrypt = Y
Geometry function (0x0003)
Align = N, Alignment Granularity = 1 (4096), Logical Block size = 4096, Lowest Aligned LBA = 0
Enterprise function (0x0100)
Range crossing = N, Base comID = 0x07fe, comIDs = 2

TPer Properties:
MaxPacketSize = 2028 MaxComPacketSize = 2048
MaxResponseComPacketSize = 2048 MaxSessions = 1 MaxIndTokenSize = 1992
MaxAuthentications = 0 MaxTransactionLimit = 1 MaxMethods = 1


Everything out there I can find documents about Opal drives and says there is this also TCG Enterprise but nobody seems to use/have them. (also borne out with WD support that was very surprised that I managed to buy these particular drives, aparently I'm the only one in the world that has these per them).

I've pretty reached the stage of giving on up doing SED with these drives at all, but has anybody else had experience with the HGST TCG Enterprise SED drives? Let alone making them work with FreeNAS?

Thanks.

 

[dlavigne]

Please create a report at bugs.freenas.org and post the issue number here.

 

[Doug McIntyre]

Okay, I've created Issue #63279.

Thanks.

 

[susam]

I have a similar problem, with a disc "Seagate Exos 7E8 ST4000NM0045". The problem occurs with the command "sedutil-cli --initialsetup debug /dev/sdc" output on "Pic1". When I start the scan command, I get the output on "Pic2". Also with the command --setmbrdone off debug /dev/sda I get a output "Pic3". Does anyone know how I can encrypt the TCG Enterprice hard disk drive?
Thanks in advance

 

[dlavigne]

@susam which FreeNAS version? There was a sedutil bump in 11.2-U4.

 

[susam]

I did not try with your program. I use "RESCUE64.img.gz " (Small Linux system to recover from issues with sedutil on 64bit UEFI systems ). I need sedutil-cli for Pre-boot authentication. Can I boot FreeNAS as live and use sedutil-cli command for setup pre-boot authentication?

 

[dlavigne]

@susam does the upstream https://github.com/sedutil/sedutil/ support that? That is what is used in FreeNAS.

 

[susam]

@dlavigne It should support, in any case, I opened Issue. If we are lucky, someone will contact us soon
https://github.com/sedutil/sedutil/issues/25