R
E
F
E
R
E
N
C
E

TCG Storage Application Note: Configurable Namespace Locking
ExamplesVersion 1.0
Revision 2.0
September 14, 2021

Contact: admin@trustedcomputinggroup.org

PUBLIC REVIEWWORK IN PROGRESSThis document is an intermediate draft
for comment only and is subject tochange without notice. Readers should
not design products based on thisdocument.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

DISCLAIMERS, NOTICES, AND LICENSE TERMS
THIS DOCUMENT IS PROVIDED "AS IS" WITH NO WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY
OF MERCHANTABILITY, NONINFRINGEMENT, FITNESS FOR ANY PARTICULAR PURPOSE, OR ANY
WARRANTY OTHERWISE ARISING OUT OF ANY PROPOSAL, DOCUMENT OR SAMPLE.
Without limitation, TCG disclaims all liability, including liability for infringement of any proprietary rights, relating to useof information in this document and to the implementation of this document, and TCG disclaims all liability for cost of
procurement of substitute goods or services, lost profits, loss of use, loss of data or any incidental, consequential,
direct, indirect, or special damages, whether under contract, tort, warranty or otherwise, arising in any way out of use
or reliance upon this document or any information herein.
This document is copyrighted by Trusted Computing Group (TCG), and no license, express or implied, is granted
herein other than as follows: You may not copy or reproduce the document or distribute it to others without written
permission from TCG, except that you may freely do so for the purposes of (a) examining or implementing TCG
documents or (b) developing, testing, or promoting information technology standards and best practices, so long as
you distribute the document with these disclaimers, notices, and license terms.
Contact the Trusted Computing Group at www.trustedcomputinggroup.org for information on document licensing
through membership agreements.
Any marks and brands contained herein are the property of their respective owners.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 1 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

CHANGE HISTORYREVISIONDATE

DESCRIPTION

1.00/1.00

February 26, 2019

Final edits

1.00/2.00

September 14, 2021

Update section 2.10 (Assign Namespace Non-Global Range Locking object with zero
length) per Errata 1

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 2 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

CONTENTSDISCLAIMERS, NOTICES, AND LICENSE TERMS ................................................................................................... 1
CHANGE HISTORY .................................................................................................................................................... 2
1

SCOPE ................................................................................................................................................................ 6
1.1 Intended Audience ....................................................................................................................................... 6
1.2 Document References ................................................................................................................................. 6
1.3 Abbreviations and Notations ........................................................................................................................ 6

2

Namespace Manipulation Examples .................................................................................................................... 7
2.1 Overview ...................................................................................................................................................... 7
2.2 Initial State ................................................................................................................................................... 7
2.3 Assign Namespace Global Range Locking object for NS1 .......................................................................... 7
2.4 Assign Namespace Global Range Locking object for NS3 .......................................................................... 7
2.5 Assign Namespace Non-Global Range Locking object for NS1.LBA[10..19] ............................................... 8
2.6 Assign Namespace Non-Global Range Locking object for NS1.LBA[30..39] ............................................... 8
2.7 Assign of overlapping Namespace Non-Global Range Locking object does not work ................................. 9
2.8 Assign Namespace Non-Global Range Locking object for NS3.LBA[15..24] ............................................... 9
2.9 Modify Namespace Non-Global Range Locking object for LO5 ................................................................. 10
2.10

Assign Namespace Non-Global Range Locking object with zero length .............................. 10

2.11

Set Namespace Non-Global Range Locking object to non-zero length ................................ 11

2.12

Deassign Namespace Non-Global Range Locking object for NS1.[30..39] .......................... 11

2.13
Deassign Namespace Non-Global Range Locking object with
KeepNamespaceGlobalRangeKey = TRUE does not work .............................................................................. 12
2.14

Deassign Namespace Non-Global Range Locking object for NS1.[10..19] .......................... 12

2.15
Deassign Namespace Global Range Locking object for NS1 with
KeepNamespaceGlobalRangeKey = TRUE ..................................................................................................... 13
2.16

Assign Namespace Global Range Locking object for NS2 ................................................... 13

2.17
Deassign Namespace Non-Global Range Locking object for Namespace 2 with
KeepNamespaceGlobalRangeKey = FALSE ................................................................................................... 14
2.18

Use NVMe Namespace Management command to create NS5 ........................................... 14

2.19
NVMe Namespace Management command to delete a namespace with an associatedLocking object does not work ........................................................................................................................... 15

3

2.20

Use NVMe Namespace Management command to delete NS5 ........................................... 15

2.21

Use GenKey method for cryptographic erase of NS3.LBA[0..9] ........................................... 16

2.22

Use NVMe Format NVM command for cryptographic erase of NS4 ..................................... 16

2.23

Use NVMe Format NVM command for cryptographic erase of NS3 ..................................... 17

2.24

Use GenKey method on the Global Range Locking Object .................................................. 17

Locking SP Modes Examples ............................................................................................................................ 19

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 3 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

3.1 Overview .................................................................................................................................................... 19
3.2 No namespaces have been created........................................................................................................... 19
3.3 Only one single unassigned namespace exists ......................................................................................... 19
3.4 Multiple unassigned namespaces exist ...................................................................................................... 19
3.5 One single namespace with multiple locking ranges – case 1 ................................................................... 19
3.6 One single namespace with multiple locking ranges – case 2 ................................................................... 20
3.7 Multiple namespaces, some assigned ....................................................................................................... 20
3.8 Multiple namespaces, some assigned with multiple locking ranges ........................................................... 20
3.9 Example Locking SP Mode Selection Process at Power On ...................................................................... 20
4

Revert / Revert SP usage examples .................................................................................................................. 22
4.1 Overview .................................................................................................................................................... 22
4.2 Use Revert method .................................................................................................................................... 22
4.3 Use RevertSP method with KeepGlobalRangeKey = FALSE .................................................................... 23
4.4 Use RevertSP method with KeepGlobalRangeKey = TRUE ...................................................................... 24

5Single User Mode Feature Set Interaction Examples ........................................................................................ 25
5.1 Overview .................................................................................................................................................... 25
5.2 Initial state .................................................................................................................................................. 25
5.3 Reactivate Global Range Locking object into Single User Mode ............................................................... 25
5.4 Assign new Namespace Global Range Locking object does not work if Global Range Locking object is inSingle User Mode ............................................................................................................................................. 26
5.5 Deassign Namespace Global Range Locking object does not work if Global Range Locking object is inSingle User Mode ............................................................................................................................................. 26
5.6 Reactivate into Single User Mode for some Locking Objects ..................................................................... 26
5.7 Assign Namespace Non-Global Range Locking object does not work if Namespace Global Range Locking
object is in Single User Mode ........................................................................................................................... 27
5.8 Deassign does not work if Locking object is in Single User Mode............................................................. 27
5.9 Deassign Namespace Non-Global Range Locking object does not work if corresponding Namespace
Global Range Locking object is in Single User Mode ....................................................................................... 27
5.10

Single User Mode Setup ....................................................................................................... 27

5.11

Update to add additional Locking Object in Single User Mode Setup ................................... 28

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 4 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

TABLES
Table 1 Example – Initial State .................................................................................................................................... 7
Table 2 Example – After Assign Namespace Global Range Locking object for NS1 .................................................. 7
Table 3 Example – After Assign Namespace Global Range Locking object for NS3 .................................................. 7
Table 4 Example – After Assign Namespace Non-Global Range Locking object for NS1.LBA[10..19] ....................... 8
Table 5 Example – After Assign Namespace Non-Global Range Locking object for NS1.LBA[30..39] ....................... 9
Table 6 Example – Assign of overlapping Namespace Non-Global Range Locking object does not work .................. 9
Table 7 Example – After Assign Namespace Non-Global Range Locking object for NS3.LBA[15..24] ..................... 10
Table 8 Example – After Modify Namespace Non-Global Range Locking object for LO5 ......................................... 10
Table 9 Example – After Assign Namespace Non-Global Range Locking object with zero length ............................ 11
Table 10 Example – After Set Namespace Non-Global Range Locking object non-zero length ............................... 11
Table 11 Example – After Deassign Namespace Non-Global Range Locking object for NS1.[30..39] ...................... 12
Table 12 Example –Deassign Namespace Non-Global Range Locking object with
KeepNamespaceGlobalRangeKey = TRUE does not work ....................................................................................... 12
Table 13 Example – After Deassign Namespace Non-Global Range Locking object for NS1.[10..19] ...................... 13
Table 14 Example – After Deassign Namespace Global Range Locking object for NS1 with
KeepNamespaceGlobalRangeKey = TRUE .............................................................................................................. 13
Table 15 Example – After Assign Namespace Global Range Locking object for Namespace 2 ............................... 14
Table 16 Example – After Deassign Namespace Non-Global Range Locking object for Namespace 2 with
KeepNamespaceGlobalRangeKey = FALSE ............................................................................................................ 14
Table 17 Example – After Using NVMe Namespace Management command to create NS5.................................... 15
Table 18 Example – NVMe Namespace Management command to delete a namespace with an associated Locking
object does not work.................................................................................................................................................. 15
Table 19 Example – After Using NVMe Namespace Management command to delete NS5 .................................... 16
Table 20 Example – After Using GenKey method for cryptographic erase of NS3.LBA[0..9] .................................... 16
Table 21 Example – After Using NVMe Format NVM command for cryptographic erase of NS4 .............................. 17
Table 22 Example – After Using NVMe Format NVM command for cryptographic erase of NS3 .............................. 17
Table 23 Example – After Using GenKey method on the Global Range Locking Object ........................................... 17
Table 24 Example – No namespaces exist ............................................................................................................... 19
Table 25 Example – Only one single unassigned namespace exists ........................................................................ 19
Table 26 Example – Multiple unassigned namespaces exist .................................................................................... 19
Table 27 Example – One single namespace with multiple locking ranges – case 1 .................................................. 20
Table 28 Example – One single namespace with multiple locking ranges – case 2 .................................................. 20
Table 29 Example – Multiple namespaces, some assigned ...................................................................................... 20
Table 30 Example – Multiple namespaces, some assigned with multiple locking ranges ......................................... 20
Table 31 Example – State before Revert is executed ............................................................................................... 22
Table 32 Example – State after Revert is executed .................................................................................................. 22
Table 33 Example – State before RevertSP (KeepGlobalRangeKey = FALSE) is executed ..................................... 23
Table 34 Example – State after RevertSP (KeepGlobalRangeKey = FALSE) is executed........................................ 23
Table 35 Example – Initial state before RevertSP (KeepGlobalRangeKey = TRUE) is executed ............................. 24
Table 36 Example – State after RevertSP (KeepGlobalRangeKey = TRUE) is executed ......................................... 24
Table 37 Example – Initial state for Single User Mode examples .............................................................................. 25
Table 38 Example – Initial state for Single User Mode examples .............................................................................. 25
Table 39 Example – State after Reactivate completes .............................................................................................. 26

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 5 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

1 SCOPE
This application note provides examples illustrating the operation of Configurable Namespace Locking (CNL) for the
Opal Security Subsystem Class (SSC).

1.1 Intended Audience
The intended audience for this specification is both trusted Storage Device manufacturers and developers that want
to use these Storage Devices in their systems.

1.2 Document References[1] Trusted Computing Group (TCG), “TCG Storage Architecture Core Specification”, Version 2.01
[2] Trusted Computing Group (TCG), “Storage Interface Interactions Specification”, Version 1.08
[3] Trusted Computing Group (TCG), “TCG Storage Opal SSC Feature Set: Configurable Namespace Locking”,
Version 1.00
[4] NVM Express, Inc., “NVM Express”, Version 1.4

1.3 Abbreviations and Notations
Kn

Key number n

LBA

Logical Block Address

LO

Locking Object

LOn

Locking Object number n

MEKMedia Encryption Key

NS

Namespace

NSn

Namespace number n

LBA[k..j]

A range of LBAs (from k through j, inclusive)

NSn.LBA[k..j] A range of LBAs in namespace n

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 6 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

2 Namespace Manipulation Examples
2.1 Overview
These examples illustrate the effects of executing various TCG methods and NVMe commands upon the Locking
SP. Each example builds upon the previous example. These examples can be viewed as a state transition
diagram, with each table representing a state, and the method invocation representing a state transition from thepreceding example (state) to the following example (state).
The tables that follow indicate the rows in the Locking SP, although the columns do not correspond (for the mostpart) to Locking SP columns. The meanings are:
1. Locking Object: An informal name for the Locking object.
2. Namespace: A list of namespaces controlled by that Locking object.
3. NS Global Range: The Namespace Global Range column value in that row, i.e., TRUE or FALSE. This isignored for the Locking object for the global range.
4. Range in NS: A description of the LBA ranges controlled by that Locking object.
A blank row indicates a Locking Object that does not have a namespace or range assigned to it.

2.2 Initial State
Four namespaces [NS1, …, NS4] are associated with the Global Range Locking object.
Locking Object
GlobalNamespace
NS1
NS2
NS3
NS4

Table 1 Example – Initial StateNS Global Range
Range in NS
Ignored
All

MEK
K1
K2
K3
K4

2.3 Assign Namespace Global Range Locking object for NS1
Assign (NSID = NS1, RangeStart = 0, RangeLength = 0) returns { LO1, TRUE, SUCCESS }Results:a) LO1 is addedb) Control of NS1 is transferred to LO1
Table 2 Example – After Assign Namespace Global Range Locking object for NS1
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS3
K3
NS4
K4
LO1
NS1
TRUE
All
K1

2.4 Assign Namespace Global Range Locking object for NS3
Assign (NSID = NS3, RangeStart = 0, RangeLength = 0) returns { LO2, TRUE, SUCCESS }Results:a) LO2 is addedb) Control of NS3 is transferred to LO2
Table 3 Example – After Assign Namespace Global Range Locking object for NS3
Locking Object
Namespace
NS Global Range
Range in NS
MEK

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 7 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Global
LO1
LO2

NS2
NS4
NS1
NS3

Ignored

All

TRUE
TRUE

All
All

K2
K4
K1
K3

2.5 Assign Namespace Non-Global Range Locking object for NS1.LBA[10..19]
Assign (NSID = NS1, RangeStart = 10, RangeLength = 10) returns { LO3, FALSE, SUCCESS }Results:a) LO3 is addedb) K5 is createdc) Control of NS1.LBA[10..19] is transferred from LO1 to LO3
Table 4 Example – After Assign Namespace Non-Global Range Locking object for NS1.LBA[10..19]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
ALL
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
LO2
NS3
TRUE
All
K3
LO3
NS1
FALSE
LBA[10..19]K5

2.6 Assign Namespace Non-Global Range Locking object for NS1.LBA[30..39]
Assign (NSID = NS1, RangeStart = 30, RangeLength = 10) returns { LO4, FALSE, SUCCESS }Results:a) LO4 is addedb) K6 is createdc) Control of NS1.LBA[30..39] is transferred from LO1 to LO4

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 8 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 5 Example – After Assign Namespace Non-Global Range Locking object for NS1.LBA[30..39]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All
K3
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]K6

2.7 Assign of overlapping Namespace Non-Global Range Locking object does
not work
Assign (NSID = NS1, RangeStart = 15, RangeLength = 10) returns INVALID_PARAMETER
Reason for failure: Range NS1.LBA[15..24] overlaps LO3 (NS1.LBA[10..19])
Results:a) Locking SP is unchanged:
Table 6 Example – Assign of overlapping Namespace Non-Global Range Locking object does not work
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All
K3
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]K6

2.8 Assign Namespace Non-Global Range Locking object for NS3.LBA[15..24]
Assign (NSID = NS3, RangeStart = 15, RangeLength = 10) returns { LO5, FALSE, SUCCESS }Results:a) LO5 is addedb) K7 is createdc) Control of NS3.LBA[15..24] is transferred from LO2 to LO5
Note: This succeeds where the previous Assign() failed because they refer to different namespaces. The logicalblock address spaces are independent for each namespace.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 9 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 7 Example – After Assign Namespace Non-Global Range Locking object for NS3.LBA[15..24]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All
except K3
LBA[15..24]
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]
K6
LO5
NS3
FALSE
LBA[15..24]
K7

2.9 Modify Namespace Non-Global Range Locking object for LO5
Set (UID = LO5, RangeStart = 20, RangeLength = 10) returns SUCCESSResults:a) LO5 is modifiedb) Control of NS3.LBA[15..19] is transferred from LO5 to LO2 (Namespace Global Range Locking object)c) Control of NS3.LBA[25..29] is transferred from LO2 to LO5.
Table 8 Example – After Modify Namespace Non-Global Range Locking object for LO5
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All
except K3
LBA[20..29]
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]
K6
LO5
NS3
FALSE
LBA[20..29]
K7

2.10 Assign Namespace Non-Global Range Locking object with zero length
Assign (NSID = NS3, RangeStart = 20, RangeLength = 0) returns { LO6, FALSE, SUCCESS }Results:a) LO6 is created. It is not associated with any LBAs.
b) K8 is created.
c) Because RangeLength is 0, the use of RangeStart = 20 does not cause an overlap with NS3.LBA[20..29],
which is associated with LO5.
A later Set() may modify RangeStart and RangeLength, after which the specified Locking object will control the
specified range.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 10 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 9 Example – After Assign Namespace Non-Global Range Locking object with zero length
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All
except K3
LBA[20..29]
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]
K6
LO5
NS3
FALSE
LBA[20..29]
K7
LO6
NS3
FALSE
None
K8

2.11 Set Namespace Non-Global Range Locking object to non-zero length
Set (LO6, RangeStart = 0, RangeLength = 10) returns SUCCESSResults:a) LO6 is modifiedb) Control of NS3.LBA[0..9] is transferred from LO2 to LO6:
Table 10 Example – After Set Namespace Non-Global Range Locking object non-zero length
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
and
LBA[30..39]
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]
LO3
NS1
FALSE
LBA[10..19]
K5
LO4
NS1
FALSE
LBA[30..39]
K6
LO5
NS3
FALSE
LBA[20..29]
K7
LO6
NS3
FALSE
LBA[0..9]K8

2.12 Deassign Namespace Non-Global Range Locking object for NS1.[30..39]
Deassign (UID = LO4, KeepNamespaceGlobalRangeKey = FALSE) returns SUCCESSResults:a) LO4 is removedb) K6 is eradicatedc) LBA[30..39] is returned to control of LO1:

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 11 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 11 Example – After Deassign Namespace Non-Global Range Locking object for NS1.[30..39]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]
LO3
NS1
FALSE
LBA[10..19]
K5
LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.13 Deassign Namespace Non-Global Range Locking object with
KeepNamespaceGlobalRangeKey = TRUE does not work
Deassign (UID = LO3, KeepNamespaceGlobalRangeKey = TRUE) returns INVALID_PARAMETER
Results:a) No change to Locking SP
Table 12 Example –Deassign Namespace Non-Global Range Locking object with
KeepNamespaceGlobalRangeKey = TRUE does not work
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
except K1
LBA[10..19]
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]
LO3
NS1
FALSE
LBA[10..19]
K5
LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.14 Deassign Namespace Non-Global Range Locking object for NS1.[10..19]
Deassign (UID = LO3, KeepNamespaceGlobalRangeKey = FALSE) returns SUCCESSResults:a) LO3 is removedb) K5 is eradicatedc) LBA[10..19] is returned to control of LO1:

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 12 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 13 Example – After Deassign Namespace Non-Global Range Locking object for NS1.[10..19]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS2
Ignored
All
K2
NS4
K4
LO1
NS1
TRUE
All
K1
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.15 Deassign Namespace Global Range Locking object for NS1 with
KeepNamespaceGlobalRangeKey = TRUE
Deassign (UID = LO1, KeepNamespaceGlobalRangeKey = TRUE) returns SUCCESSResults:a) LO1 is removedb) K1 is transferred to control of Global Range Locking objectc) All LBAs of NS1 return to control of Global Range Locking object:
Table 14 Example – After Deassign Namespace Global Range Locking object for NS1 with
KeepNamespaceGlobalRangeKey = TRUE
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K2
NS4
K4
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.16 Assign Namespace Global Range Locking object for NS2
Assign (NSID = NS2, RangeStart = 0, RangeLength = 0) returns { LO1, TRUE, SUCCESS }Results:a) LO1 is addedb) Control of NS2 is transferred to LO1:

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 13 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 15 Example – After Assign Namespace Global Range Locking object for Namespace 2
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS4
K4
LO1
NS2
TRUE
All
K2
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7
K8

2.17 Deassign Namespace Non-Global Range Locking object for Namespace 2
with KeepNamespaceGlobalRangeKey = FALSE
Deassign (UID = LO1, KeepNamespaceGlobalRangeKey = FALSE) returns SUCCESSResults:
a)
b)
c)
d)

LO1 is removed
K2 is eradicated
K9 is created and associated with NS2 in place of K2
All LBAs in NS2 return to control of Global Range Locking object

Table 16 Example – After Deassign Namespace Non-Global Range Locking object for Namespace 2 with
KeepNamespaceGlobalRangeKey = FALSE
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K4
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.18 Use NVMe Namespace Management command to create NS5
Namespace Management (SEL = Create, NSID = NS5, NSZE, FLBS, DPS, NMIC) returns Successful
Completion
Results:a) NS5 is created and assigned to the Global Range Locking objectb) K10 is created

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 14 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 17 Example – After Using NVMe Namespace Management command to create NS5
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K4
NS5
K10
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.19 NVMe Namespace Management command to delete a namespace with anassociated Locking object does not work
Namespace Management (SEL = Delete, NSID = NS3) returns Access Denied
Results:a) No change to Locking SP
Table 18 Example – NVMe Namespace Management command to delete a namespace with an associated Locking
object does not work
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K4
NS5
K10
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K8

2.20 Use NVMe Namespace Management command to delete NS5
Namespace Management (SEL = Delete, NSID = NS5) returns Successful Completion
Results:a) Because NS5 is assigned to the Global Range Locking object it is deletedb) K10 is eradicated

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 15 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 19 Example – After Using NVMe Namespace Management command to delete NS5
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K4
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7
K8

2.21 Use GenKey method for cryptographic erase of NS3.LBA[0..9]
LO6.GenKey () returns SUCCESSResults:a) K8 is eradicatedb) K11 is created
Table 20 Example – After Using GenKey method for cryptographic erase of NS3.LBA[0..9]
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K4
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7K11

2.22 Use NVMe Format NVM command for cryptographic erase of NS4
Format NVM (NSID = NS4, SES = Cryptographic Erase) returns Successful Completion
Results:a) K4 is eradicatedb) K12 is created

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 16 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 21 Example – After Using NVMe Format NVM command for cryptographic erase of NS4
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K12
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K3

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K7
K11

2.23 Use NVMe Format NVM command for cryptographic erase of NS3
Format NVM (NSID = NS3, SES = Cryptographic Erase) returns Successful Completion
Results:a) K3, K7, and K11 are eradicatedb) K13, K14, and K15 are created
Table 22 Example – After Using NVMe Format NVM command for cryptographic erase of NS3
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K9
NS4
K12
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K13

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K14
K15

2.24 Use GenKey method on the Global Range Locking Object
GlobalRange.GenKey () returns SUCCESSResults:a) K1, K9, and K12 are eradicatedb) K16, K17, and K18 are created

Table 23 Example – After Using GenKey method on the Global Range Locking Object
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K16
NS2
K17
NS4
K18
LO2

NS3

TRUE

All except LBA[0..9]and LBA[20..29]

K13

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 17 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

LO5
LO6

NS3
NS3

FALSE
FALSE

LBA[20..29]
LBA[0..9]K14
K15

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 18 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

3 Locking SP Modes Examples
3.1 Overview
These examples illustrate the namespace assignments that map to the various Locking SP modes. Each example
is independent of the prior example.

3.2 No namespaces have been created
The mode of the Locking SP is not defined when no namespaces exist in the NVM subsystem.
Table 24 Example – No namespaces exist
Locking Object
Namespace
Global3.3 Only one single unassigned namespace exists
The Locking SP is in the Global LO / Multiple NS mode when only one single unassigned namespace exists in the
NVM subsystem before any manipulations.
Table 25 Example – Only one single unassigned namespace exists
Locking Object
Namespace
GlobalNS1

3.4 Multiple unassigned namespaces exist
The Locking SP is in the Global LO / Multiple NS mode when multiple unassigned namespaces exist in the NVM
subsystem before any manipulations.
Table 26 Example – Multiple unassigned namespaces exist
Locking Object
Namespace
Global
NS1
NS2
NS3

3.5 One single namespace with multiple locking ranges – case 1
The Locking SP is in the Multiple LO / Single NS mode when only one single namespace exists in the NVM
subsystem with LBA ranges under the control of other locking objects by using the Set method (not by using theAssign method). Note that the NSID column value will be 0 for all locking objects in this case.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 19 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

Table 27 Example – One single namespace with multiple locking ranges – case 1
Locking Object
Namespace
Global
NS1 Global
LO1
NS1 LBA Range 1
LO2
NS1 LBA Range 2
LO3
NS1 LBA Range 3

3.6 One single namespace with multiple locking ranges – case 2
The Locking SP is in the Multiple LO / Multiple NS mode when only one single namespace exists in the NVM
subsystem with LBA ranges under the control of other locking objects by using the Assign method (not by using the
Set method). Note that the global range for the namespace is under the control of a non-Global Range locking
object in this case (it is under the control of a Namespace Global Range locking object). Note that the NSID column
value will be 1 for LO1, LO2, and LO3 in this case.
Table 28 Example – One single namespace with multiple locking ranges – case 2
Locking Object
Namespace
GlobalLO1
NS1 LBA Global Range
LO2
NS1 LBA Range 1
LO3
NS1 LBA Range 2

3.7 Multiple namespaces, some assigned
The Locking SP is in the Multiple LO / Multiple NS mode when multiple namespaces exist in the NVM subsystemwith some assigned to other locking objects.
Table 29 Example – Multiple namespaces, some assigned
Locking Object
Namespace
Global
NS1
NS3
NS5
LO1
NS2 LBA Global Range
LO2
NS4 LBA Global Range
LO3
NS6 LBA Global Range

3.8 Multiple namespaces, some assigned with multiple locking ranges
The Locking SP is in the Multiple LO / Multiple NS mode when multiple namespaces exist in the NVM subsystemwith some assigned to other locking objects and some with multiple locking ranges.
Table 30 Example – Multiple namespaces, some assigned with multiple locking ranges
Locking Object
Namespace
Global
NS1
NS3
NS5
LO1
NS2 LBA Global Range
LO2
NS4 LBA Global Range
LO3
NS2 LBA Range 1
LO4
NS2 LBA Range 2
LO5
NS4 LBA Range 1

3.9 Example Locking SP Mode Selection Process at Power On
The following is an example Locking SP mode selection process at power on based on the state of the system.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 20 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

•

•

•

If NamespaceID == 0 in all Locking objects
and RangeLength == 0 in all Locking objects
o Locking SP is in Global LO / Multiple NS modeo Unused Key Count = Maximum Key Count – number of existing namespaces
Else if NamespaceID == 0 in all Locking objects
and RangeLength != 0 in at least one Locking object
o Note that only a single namespace exists▪ All other possibilities at this point are invalido Locking SP is in Multiple LO / Single NS modeo Number of configured Non-Global Range Locking objects = number of Non-Global Range Locking
objects with RangeLength != 0o Unused Key Count = Maximum Key Count – ( 1 + number of configured Non-Global Range Locking
objects )Elseo Note that NamespaceID != 0 in at least one Locking object
o Locking SP is in Multiple LO / Multiple NS modeo Number of configured Non-Global Range Locking objects = number of Non-Global Range Locking
objects with NamespaceID != 0o Number of configured Namespace Non-Global Range Locking objects = number of configured NonGlobal Range Locking objects with NamespaceGlobalRange = FALSE▪ Presumably RangeLength != 0 for these Locking objects but it is not a requiremento Unused Key Count = Maximum Key Count – ( number of existing namespaces + number ofconfigured Namespace Non-Global Range Locking objects )TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 21 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

4 Revert / Revert SP usage examples
4.1 Overview
The definitions of the table columns are the same as in section 2 for these examples.

4.2 Use Revert method
Assume the following starting state
Locking Object
Global

LO1
LO2
LO3
LO4
LO5
LO6

Table 31 Example – State before Revert is executedNamespace
NS Global Range
Range in NS
NS1
Ignored
All
NS2
NS4
NS5
TRUE
All
NS3
TRUE
All except LBA[0..9]and LBA[20..29]
NS6
TRUE
All except
LBA[10..19]
NS6
FALSE
LBA[10..19]
NS3
FALSE
LBA[20..29]
NS3
FALSE
LBA[0..9]

MEK
K1
K2
K4
K5
K3
K6
K7
K8
K9

Unused Key Count = 6
After a Revert method is executed with success, Table 32is the final state.
Locking Object
GlobalTable 32 Example – State after Revert is executedNamespace
NS Global Range
Range in NS
NS1
Ignored (T)
All
NS2
NS3
NS4
NS5
NS6

MEK
K10
K11
K12
K13
K14
K15

Unused Key Count = 9Note that the Revert method and the RevertSP method with KeepGlobalRangeKey = FALSE functionally have thesame effect with regards to the Configurable Namespace Locking feature. See Table 33 andTable 34.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 22 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

4.3 Use RevertSP method with KeepGlobalRangeKey = FALSE
Assume the following starting state
Table 33 Example – State before RevertSP (KeepGlobalRangeKey = FALSE) is executed
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K2
NS4
K4
LO1
NS5
TRUE
All
K5
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]
LO3
NS6
TRUE
All except
K6
LBA[10..19]
LO4
NS6
FALSE
LBA[10..19]
K7
LO5
NS3
FALSE
LBA[20..29]
K8
LO6
NS3
FALSE
LBA[0..9]K9Unused Key Count = 6
After a RevertSP (KeepGlobalRangeKey = FALSE) method is executed with success, Table 34is the final state.
Table 34 Example – State after RevertSP (KeepGlobalRangeKey = FALSE) is executed
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored (T)
All
K10
NS2
K11
NS3
K12
NS4
K13
NS5
K14
NS6
K15

Unused Key Count = 9Note that the Revert method and the RevertSP method with KeepGlobalRangeKey = FALSE functionally have thesame effect with regards to the Configurable Namespace Locking feature. See Table 33 and

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 23 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

4.4 Use RevertSP method with KeepGlobalRangeKey = TRUE
Assume the following starting state
Table 35 Example – Initial state before RevertSP (KeepGlobalRangeKey = TRUE) is executed
Locking Object
Namespace
NS Global Range
Range in NS
MEK
GlobalNS1
Ignored
All
K1
NS2
K2
NS4
K4
LO1
NS5
TRUE
All
K5
LO2
NS3
TRUE
All except LBA[0..9] K3
and LBA[20..29]
LO3
NS6
TRUE
All except
K6
LBA[10..19]
LO4
NS6
FALSE
LBA[10..19]
K7
LO5
NS3
FALSE
LBA[20..29]
K8
LO6
NS3
FALSE
LBA[0..9]K9Unused Key Count = 6
After a RevertSP (KeepGlobalRangeKey = TRUE) method is executed with success, Table 36is the final state.
Table 36 Example – State after RevertSP (KeepGlobalRangeKey = TRUE) is executed
Locking Object
Namespace
NS Global Range
Range in NS
MEK
NA….
NS1
Ignored (T)
All
K1
NS2
K2
NS3
K10
NS4
K4
NS5
K11
NS6
K12

Unused Key Count = 9
Note: Global Range Locking object is inactive.

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 24 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

5 Single User Mode Feature Set Interaction Examples
5.1 Overview
Each example builds upon the previous example as in section 2. The definitions of the table columns are the sameas in section 2. Note that this feature set causes changes to base Single User Mode behavior only when
RangeStartLengthPolicy is 0.

5.2 Initial state
Assume the following starting state
Locking Object
Global

LO1
LO2

LO3
LO4
LO5
LO6

Table 37 Example – Initial state for Single User Mode examples
Namespace
NS Global
Range in NS
MEK
Range
NS1
Ignored
All
K1
NS2
K2
NS4
K4
NS5
TRUE
All
K5
NS3
TRUE
All except
K3
LBA[0..9] andLBA[20..29]
NS6
TRUE
All except
K6
LBA[10..19]
NS6
FALSE
LBA[10..19]
K7
NS3
FALSE
LBA[20..29]
K8
NS3
FALSE
LBA[0..9]K9Single User
Mode
N/A

N/A
N/A

N/A
N/A
N/A
N/A

5.3 Reactivate Global Range Locking object into Single User Mode
Reactivate ([Global], RangeStartLengthPolicy = 0)
Locking Object
Global

LO1
LO2

LO3
LO4
LO5
LO6

Table 38 Example – Initial state for Single User Mode examples
Namespace
NS Global
Range in NS
MEK
Range
NS1
Ignored
All
K1
NS2
K2
NS4
K4
NS5
TRUE
All
K5
NS3
TRUE
All except
K3
LBA[0..9] andLBA[20..29]
NS6
TRUE
All except
K6
LBA[10..19]
NS6
FALSE
LBA[10..19]
K7
NS3
FALSE
LBA[20..29]
K8
NS3
FALSE
LBA[0..9]K9Single User
Mode
Yes

No
No

No
No
No
No

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 25 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

5.4 Assign new Namespace Global Range Locking object does not work if
Global Range Locking object is in Single User Mode
Assign (NSID = NS1) returns NOT_AUTHORIZED
Reason for failure: NS1 control cannot be moved if the Global Range Locking object is in Single User Mode andcurrently controls NS1.
Results:a) Locking SP is unchanged:
Note: RangeStartLengthPolicy being 0 causes this change in behavior.

5.5 Deassign Namespace Global Range Locking object does not work if Global
Range Locking object is in Single User Mode
Deassign (LO1) returns NOT_AUTHORIZED
Reason for failure: NS5 control cannot be moved to the Global Range Locking object because the Global Range
Locking object is in Single User Mode.
Results:a) Locking SP is unchanged:
Note: RangeStartLengthPolicy being 0 causes this change in behavior.

5.6 Reactivate into Single User Mode for some Locking Objects
Reactivate ([LO3, LO5], RangeStartLengthPolicy = 0)
Before the Reactivate call: ACE_Assign BooleanExpr = {Admins, User1, User2, User4, User6, User7}
Table 39 Example – State after Reactivate completes
Locking Object Namespace
NS Global
Range in NS
MEK
Range
GlobalNS1
Ignored
All
K1
NS2
K2
NS4
K4
LO1
NS5
TRUE
All
K5
LO2
NS3
TRUE
All except
K3
LBA[0..9] andLBA[20..29]
LO3
NS6
TRUE
All except
K6
LBA[10..19]
LO4
NS6
FALSE
LBA[10..19]
K7
LO5
NS3
FALSE
LBA[20..29]
K8
LO6
NS3
FALSE
LBA[0..9]K9After the Reactivate call: ACE_Assign BooleanExpr = {Admins, User1, User2, User7}

Single User
Mode
No

No
No

Yes
No
Yes
No

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 26 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples

5.7 Assign Namespace Non-Global Range Locking object does not work if
Namespace Global Range Locking object is in Single User Mode
Assign (NSID = NS6, RangeStart = 30, RangeLength = 10) returns NOT_AUTHORIZED
Reason for failure: LO3 that controls NS6 is in Single User Mode and hence a new Namespace Non-Global Range
Locking object cannot be created for NS6.
Results:a) Locking SP is unchanged:
Note: RangeStartLengthPolicy being 0 causes this change in behavior.

5.8 Deassign does not work if Locking object is in Single User Mode
Deassign (LO5) returns NOT_AUTHORIZED
Reason for failure: LO5 is in Single User Mode and hence cannot be deassigned.
Results:a) Locking SP is unchanged:
Note: RangeStartLengthPolicy being 0 causes this change in behavior.

5.9 Deassign Namespace Non-Global Range Locking object does not work if
corresponding Namespace Global Range Locking object is in Single User
Mode
Deassign (LO4) returns NOT_AUTHORIZED
Reason for failure: LO3 that controls the global range for NS6 is in Single User Mode and hence LO4 which is a
Namespace Non-Global Range Locking object for NS6 cannot be deassigned.
Results:a) Locking SP is unchanged:
Note: RangeStartLengthPolicy being 0 causes this change in behavior.

5.10 Single User Mode Setup
The following is an example of setting up multiple ranges in Single User Mode. Namespace 1 is to be controlled by
two Single User Mode authorities while Namespace 2 is to be left alone.
•
•
•
•
•
•
•
•

Create Namespaces 1 and 2
Assign Namespace 1 to LO1
Assign Namespace 1 to LO2 without specifying a range
Assign Namespace 2 to LO3
Modify ACE to also allow User6 to call Assign
Reactivate with LO1 and LO2 in Single User Mode and with RangeStartLengthPolicy = 0
Authenticate as Single User Mode authority User3
Set a non-zero LBA range for Namespace 1 in LO2

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 27 | © TCG 2021

TCG Storage Application Note: Configurable Namespace Locking Examples••

Authenticate as User6
Assign Namespace 2 non-zero LBA range to LO4
o Namespace Global Range Locking Object for Namespace 2 (LO3) is not in Single User Mode andhence Assign is allowed to specify Namespace 2

5.11 Update to add additional Locking Object in Single User Mode Setup
The following example continues on from the above example. The goal is to have a third Single User Modeauthority added to control Namespace 1. However, the Namespace Global Range Locking Object for Namespace 1(LO1) is in Single User Mode and hence Assign is not allowed specifying Namespace 1.
•••

Reactivate with no Single User Mode locking objects defined
Assign Namespace 1 to LO5
Reactivate with LO1, LO2, and LO5 in Single User Mode

TCG Storage Application Note: Configurable Namespace Locking Examples | Version 1.0 | Revision 2.0 | 9/14/2021 | PUBLIC REVIEW | Page 28 | © TCG 2021