Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License version 2 and |
| 6 | * only version 2 as published by the Free Software Foundation. |
| 7 | * |
| 8 | * This program is distributed in the hope that it will be useful, |
| 9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 11 | * GNU General Public License for more details. |
| 12 | */ |
| 13 | |
| 14 | /* |
| 15 | * Per-File-Key (PFK). |
| 16 | * |
| 17 | * This driver is responsible for overall management of various |
| 18 | * Per File Encryption variants that work on top of or as part of different |
| 19 | * file systems. |
| 20 | * |
| 21 | * The driver has the following purpose : |
| 22 | * 1) Define priorities between PFE's if more than one is enabled |
| 23 | * 2) Extract key information from inode |
| 24 | * 3) Load and manage various keys in ICE HW engine |
| 25 | * 4) It should be invoked from various layers in FS/BLOCK/STORAGE DRIVER |
| 26 | * that need to take decision on HW encryption management of the data |
| 27 | * Some examples: |
| 28 | * BLOCK LAYER: when it takes decision on whether 2 chunks can be united |
| 29 | * to one encryption / decryption request sent to the HW |
| 30 | * |
| 31 | * UFS DRIVER: when it need to configure ICE HW with a particular key slot |
| 32 | * to be used for encryption / decryption |
| 33 | * |
| 34 | * PFE variants can differ on particular way of storing the cryptographic info |
| 35 | * inside inode, actions to be taken upon file operations, etc., but the common |
| 36 | * properties are described above |
| 37 | * |
| 38 | */ |
| 39 | |
| 40 | |
| 41 | /* Uncomment the line below to enable debug messages */ |
| 42 | /* #define DEBUG 1 */ |
| 43 | #define pr_fmt(fmt) "pfk [%s]: " fmt, __func__ |
| 44 | |
| 45 | #include <linux/module.h> |
| 46 | #include <linux/fs.h> |
| 47 | #include <linux/errno.h> |
| 48 | #include <linux/printk.h> |
| 49 | #include <linux/bio.h> |
| 50 | #include <linux/security.h> |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 51 | #include <crypto/algapi.h> |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 52 | #include <crypto/ice.h> |
| 53 | |
| 54 | #include <linux/pfk.h> |
| 55 | |
| 56 | #include "pfk_kc.h" |
| 57 | #include "objsec.h" |
| 58 | #include "pfk_ice.h" |
| 59 | #include "pfk_ext4.h" |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 60 | #include "pfk_f2fs.h" |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 61 | #include "pfk_internal.h" |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 62 | //#include "ext4.h" |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 63 | |
| 64 | static bool pfk_ready; |
| 65 | |
| 66 | |
| 67 | /* might be replaced by a table when more than one cipher is supported */ |
| 68 | #define PFK_SUPPORTED_KEY_SIZE 32 |
| 69 | #define PFK_SUPPORTED_SALT_SIZE 32 |
| 70 | |
| 71 | /* Various PFE types and function tables to support each one of them */ |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 72 | enum pfe_type {EXT4_CRYPT_PFE, F2FS_CRYPT_PFE, INVALID_PFE}; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 73 | |
| 74 | typedef int (*pfk_parse_inode_type)(const struct bio *bio, |
| 75 | const struct inode *inode, |
| 76 | struct pfk_key_info *key_info, |
| 77 | enum ice_cryto_algo_mode *algo, |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 78 | bool *is_pfe, |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 79 | const char *storage_type); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 80 | |
| 81 | typedef bool (*pfk_allow_merge_bio_type)(const struct bio *bio1, |
| 82 | const struct bio *bio2, const struct inode *inode1, |
| 83 | const struct inode *inode2); |
| 84 | |
| 85 | static const pfk_parse_inode_type pfk_parse_inode_ftable[] = { |
| 86 | /* EXT4_CRYPT_PFE */ &pfk_ext4_parse_inode, |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 87 | /* F2FS_CRYPT_PFE */ &pfk_f2fs_parse_inode, |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 88 | }; |
| 89 | |
| 90 | static const pfk_allow_merge_bio_type pfk_allow_merge_bio_ftable[] = { |
| 91 | /* EXT4_CRYPT_PFE */ &pfk_ext4_allow_merge_bio, |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 92 | /* F2FS_CRYPT_PFE */ &pfk_f2fs_allow_merge_bio, |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 93 | }; |
| 94 | |
| 95 | static void __exit pfk_exit(void) |
| 96 | { |
| 97 | pfk_ready = false; |
| 98 | pfk_ext4_deinit(); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 99 | pfk_f2fs_deinit(); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 100 | pfk_kc_deinit(); |
| 101 | } |
| 102 | |
| 103 | static int __init pfk_init(void) |
| 104 | { |
| 105 | |
| 106 | int ret = 0; |
| 107 | |
| 108 | ret = pfk_ext4_init(); |
| 109 | if (ret != 0) |
| 110 | goto fail; |
| 111 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 112 | ret = pfk_f2fs_init(); |
| 113 | if (ret != 0) |
| 114 | goto fail; |
| 115 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 116 | ret = pfk_kc_init(); |
| 117 | if (ret != 0) { |
| 118 | pr_err("could init pfk key cache, error %d\n", ret); |
| 119 | pfk_ext4_deinit(); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 120 | pfk_f2fs_deinit(); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 121 | goto fail; |
| 122 | } |
| 123 | |
| 124 | pfk_ready = true; |
| 125 | pr_info("Driver initialized successfully\n"); |
| 126 | |
| 127 | return 0; |
| 128 | |
| 129 | fail: |
| 130 | pr_err("Failed to init driver\n"); |
| 131 | return -ENODEV; |
| 132 | } |
| 133 | |
| 134 | /* |
| 135 | * If more than one type is supported simultaneously, this function will also |
| 136 | * set the priority between them |
| 137 | */ |
| 138 | static enum pfe_type pfk_get_pfe_type(const struct inode *inode) |
| 139 | { |
| 140 | if (!inode) |
| 141 | return INVALID_PFE; |
| 142 | |
| 143 | if (pfk_is_ext4_type(inode)) |
| 144 | return EXT4_CRYPT_PFE; |
| 145 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 146 | if (pfk_is_f2fs_type(inode)) |
| 147 | return F2FS_CRYPT_PFE; |
| 148 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 149 | return INVALID_PFE; |
| 150 | } |
| 151 | |
| 152 | /** |
| 153 | * inode_to_filename() - get the filename from inode pointer. |
| 154 | * @inode: inode pointer |
| 155 | * |
| 156 | * it is used for debug prints. |
| 157 | * |
| 158 | * Return: filename string or "unknown". |
| 159 | */ |
| 160 | char *inode_to_filename(const struct inode *inode) |
| 161 | { |
| 162 | struct dentry *dentry = NULL; |
| 163 | char *filename = NULL; |
| 164 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 165 | if (!inode) |
| 166 | return "NULL"; |
| 167 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 168 | if (hlist_empty(&inode->i_dentry)) |
| 169 | return "unknown"; |
| 170 | |
| 171 | dentry = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias); |
| 172 | filename = dentry->d_iname; |
| 173 | |
| 174 | return filename; |
| 175 | } |
| 176 | |
| 177 | /** |
| 178 | * pfk_is_ready() - driver is initialized and ready. |
| 179 | * |
| 180 | * Return: true if the driver is ready. |
| 181 | */ |
| 182 | static inline bool pfk_is_ready(void) |
| 183 | { |
| 184 | return pfk_ready; |
| 185 | } |
| 186 | |
| 187 | /** |
| 188 | * pfk_bio_get_inode() - get the inode from a bio. |
| 189 | * @bio: Pointer to BIO structure. |
| 190 | * |
| 191 | * Walk the bio struct links to get the inode. |
| 192 | * Please note, that in general bio may consist of several pages from |
| 193 | * several files, but in our case we always assume that all pages come |
| 194 | * from the same file, since our logic ensures it. That is why we only |
| 195 | * walk through the first page to look for inode. |
| 196 | * |
| 197 | * Return: pointer to the inode struct if successful, or NULL otherwise. |
| 198 | * |
| 199 | */ |
| 200 | static struct inode *pfk_bio_get_inode(const struct bio *bio) |
| 201 | { |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 202 | if (!bio) |
| 203 | return NULL; |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 204 | if (!bio_has_data((struct bio *)bio)) |
| 205 | return NULL; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 206 | if (!bio->bi_io_vec) |
| 207 | return NULL; |
| 208 | if (!bio->bi_io_vec->bv_page) |
| 209 | return NULL; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 210 | |
| 211 | if (PageAnon(bio->bi_io_vec->bv_page)) { |
| 212 | struct inode *inode; |
| 213 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 214 | /* Using direct-io (O_DIRECT) without page cache */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 215 | inode = dio_bio_get_inode((struct bio *)bio); |
| 216 | pr_debug("inode on direct-io, inode = 0x%pK.\n", inode); |
| 217 | |
| 218 | return inode; |
| 219 | } |
| 220 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 221 | if (!page_mapping(bio->bi_io_vec->bv_page)) |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 222 | return NULL; |
| 223 | |
Jaegeuk Kim | 1158db3 | 2018-03-08 10:54:26 -0800 | [diff] [blame] | 224 | return page_mapping(bio->bi_io_vec->bv_page)->host; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 225 | } |
| 226 | |
| 227 | /** |
| 228 | * pfk_key_size_to_key_type() - translate key size to key size enum |
| 229 | * @key_size: key size in bytes |
| 230 | * @key_size_type: pointer to store the output enum (can be null) |
| 231 | * |
| 232 | * return 0 in case of success, error otherwise (i.e not supported key size) |
| 233 | */ |
| 234 | int pfk_key_size_to_key_type(size_t key_size, |
| 235 | enum ice_crpto_key_size *key_size_type) |
| 236 | { |
| 237 | /* |
| 238 | * currently only 32 bit key size is supported |
| 239 | * in the future, table with supported key sizes might |
| 240 | * be introduced |
| 241 | */ |
| 242 | |
| 243 | if (key_size != PFK_SUPPORTED_KEY_SIZE) { |
| 244 | pr_err("not supported key size %zu\n", key_size); |
| 245 | return -EINVAL; |
| 246 | } |
| 247 | |
| 248 | if (key_size_type) |
| 249 | *key_size_type = ICE_CRYPTO_KEY_SIZE_256; |
| 250 | |
| 251 | return 0; |
| 252 | } |
| 253 | |
| 254 | /* |
| 255 | * Retrieves filesystem type from inode's superblock |
| 256 | */ |
| 257 | bool pfe_is_inode_filesystem_type(const struct inode *inode, |
| 258 | const char *fs_type) |
| 259 | { |
| 260 | if (!inode || !fs_type) |
| 261 | return false; |
| 262 | |
| 263 | if (!inode->i_sb) |
| 264 | return false; |
| 265 | |
| 266 | if (!inode->i_sb->s_type) |
| 267 | return false; |
| 268 | |
| 269 | return (strcmp(inode->i_sb->s_type->name, fs_type) == 0); |
| 270 | } |
| 271 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 272 | /** |
| 273 | * pfk_get_key_for_bio() - get the encryption key to be used for a bio |
| 274 | * |
| 275 | * @bio: pointer to the BIO |
| 276 | * @key_info: pointer to the key information which will be filled in |
| 277 | * @algo_mode: optional pointer to the algorithm identifier which will be set |
| 278 | * @is_pfe: will be set to false if the BIO should be left unencrypted |
| 279 | * |
| 280 | * Return: 0 if a key is being used, otherwise a -errno value |
| 281 | */ |
| 282 | static int pfk_get_key_for_bio(const struct bio *bio, |
| 283 | struct pfk_key_info *key_info, |
| 284 | enum ice_cryto_algo_mode *algo_mode, |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 285 | bool *is_pfe, unsigned int *data_unit) |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 286 | { |
| 287 | const struct inode *inode; |
| 288 | enum pfe_type which_pfe; |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 289 | char *s_type = NULL; |
Jaegeuk Kim | 3bd012f | 2018-04-20 19:26:09 -0700 | [diff] [blame] | 290 | const struct blk_encryption_key *key = NULL; |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 291 | |
| 292 | inode = pfk_bio_get_inode(bio); |
| 293 | which_pfe = pfk_get_pfe_type(inode); |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 294 | s_type = (char *)pfk_kc_get_storage_type(); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 295 | |
Neeraj Soni | 75e59c9 | 2018-10-22 20:07:50 +0530 | [diff] [blame] | 296 | if (data_unit && (bio_dun(bio) || |
| 297 | !memcmp(s_type, "ufs", strlen("ufs")))) |
| 298 | *data_unit = 1 << ICE_CRYPTO_DATA_UNIT_4_KB; |
| 299 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 300 | if (which_pfe != INVALID_PFE) { |
| 301 | /* Encrypted file; override ->bi_crypt_key */ |
| 302 | pr_debug("parsing inode %lu with PFE type %d\n", |
| 303 | inode->i_ino, which_pfe); |
| 304 | return (*(pfk_parse_inode_ftable[which_pfe])) |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 305 | (bio, inode, key_info, algo_mode, is_pfe, |
Neeraj Soni | 75e59c9 | 2018-10-22 20:07:50 +0530 | [diff] [blame] | 306 | (const char *)s_type); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 307 | } |
| 308 | |
| 309 | /* |
| 310 | * bio is not for an encrypted file. Use ->bi_crypt_key if it was set. |
| 311 | * Otherwise, don't encrypt/decrypt the bio. |
| 312 | */ |
Jaegeuk Kim | 3bd012f | 2018-04-20 19:26:09 -0700 | [diff] [blame] | 313 | #ifdef CONFIG_DM_DEFAULT_KEY |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 314 | key = bio->bi_crypt_key; |
Jaegeuk Kim | 3bd012f | 2018-04-20 19:26:09 -0700 | [diff] [blame] | 315 | #endif |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 316 | if (!key) { |
| 317 | *is_pfe = false; |
| 318 | return -EINVAL; |
| 319 | } |
| 320 | |
| 321 | /* Note: the "salt" is really just the second half of the XTS key. */ |
| 322 | BUILD_BUG_ON(sizeof(key->raw) != |
| 323 | PFK_SUPPORTED_KEY_SIZE + PFK_SUPPORTED_SALT_SIZE); |
| 324 | key_info->key = &key->raw[0]; |
| 325 | key_info->key_size = PFK_SUPPORTED_KEY_SIZE; |
| 326 | key_info->salt = &key->raw[PFK_SUPPORTED_KEY_SIZE]; |
| 327 | key_info->salt_size = PFK_SUPPORTED_SALT_SIZE; |
| 328 | if (algo_mode) |
| 329 | *algo_mode = ICE_CRYPTO_ALGO_MODE_AES_XTS; |
| 330 | return 0; |
| 331 | } |
| 332 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 333 | |
| 334 | /** |
| 335 | * pfk_load_key_start() - loads PFE encryption key to the ICE |
| 336 | * Can also be invoked from non |
| 337 | * PFE context, in this case it |
| 338 | * is not relevant and is_pfe |
| 339 | * flag is set to false |
| 340 | * |
| 341 | * @bio: Pointer to the BIO structure |
| 342 | * @ice_setting: Pointer to ice setting structure that will be filled with |
| 343 | * ice configuration values, including the index to which the key was loaded |
| 344 | * @is_pfe: will be false if inode is not relevant to PFE, in such a case |
| 345 | * it should be treated as non PFE by the block layer |
| 346 | * |
| 347 | * Returns the index where the key is stored in encryption hw and additional |
| 348 | * information that will be used later for configuration of the encryption hw. |
| 349 | * |
| 350 | * Must be followed by pfk_load_key_end when key is no longer used by ice |
| 351 | * |
| 352 | */ |
| 353 | int pfk_load_key_start(const struct bio *bio, |
| 354 | struct ice_crypto_setting *ice_setting, bool *is_pfe, |
Neeraj Soni | e3af8d5 | 2018-09-05 14:32:49 +0530 | [diff] [blame] | 355 | bool async, int ice_rev) |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 356 | { |
| 357 | int ret = 0; |
| 358 | struct pfk_key_info key_info = {NULL, NULL, 0, 0}; |
| 359 | enum ice_cryto_algo_mode algo_mode = ICE_CRYPTO_ALGO_MODE_AES_XTS; |
| 360 | enum ice_crpto_key_size key_size_type = 0; |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 361 | unsigned int data_unit = 1 << ICE_CRYPTO_DATA_UNIT_512_B; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 362 | u32 key_index = 0; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 363 | |
| 364 | if (!is_pfe) { |
| 365 | pr_err("is_pfe is NULL\n"); |
| 366 | return -EINVAL; |
| 367 | } |
| 368 | |
| 369 | /* |
| 370 | * only a few errors below can indicate that |
| 371 | * this function was not invoked within PFE context, |
| 372 | * otherwise we will consider it PFE |
| 373 | */ |
| 374 | *is_pfe = true; |
| 375 | |
| 376 | if (!pfk_is_ready()) |
| 377 | return -ENODEV; |
| 378 | |
| 379 | if (!ice_setting) { |
| 380 | pr_err("ice setting is NULL\n"); |
| 381 | return -EINVAL; |
| 382 | } |
| 383 | |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 384 | ret = pfk_get_key_for_bio(bio, &key_info, &algo_mode, is_pfe, |
| 385 | &data_unit); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 386 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 387 | if (ret != 0) |
| 388 | return ret; |
| 389 | |
| 390 | ret = pfk_key_size_to_key_type(key_info.key_size, &key_size_type); |
| 391 | if (ret != 0) |
| 392 | return ret; |
| 393 | |
| 394 | ret = pfk_kc_load_key_start(key_info.key, key_info.key_size, |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 395 | key_info.salt, key_info.salt_size, &key_index, async, |
Neeraj Soni | e3af8d5 | 2018-09-05 14:32:49 +0530 | [diff] [blame] | 396 | data_unit, ice_rev); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 397 | if (ret) { |
| 398 | if (ret != -EBUSY && ret != -EAGAIN) |
| 399 | pr_err("start: could not load key into pfk key cache, error %d\n", |
| 400 | ret); |
| 401 | |
| 402 | return ret; |
| 403 | } |
| 404 | |
| 405 | ice_setting->key_size = key_size_type; |
| 406 | ice_setting->algo_mode = algo_mode; |
| 407 | /* hardcoded for now */ |
| 408 | ice_setting->key_mode = ICE_CRYPTO_USE_LUT_SW_KEY; |
| 409 | ice_setting->key_index = key_index; |
| 410 | |
| 411 | pr_debug("loaded key for file %s key_index %d\n", |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 412 | inode_to_filename(pfk_bio_get_inode(bio)), key_index); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 413 | |
| 414 | return 0; |
| 415 | } |
| 416 | |
| 417 | /** |
| 418 | * pfk_load_key_end() - marks the PFE key as no longer used by ICE |
| 419 | * Can also be invoked from non |
| 420 | * PFE context, in this case it is not |
| 421 | * relevant and is_pfe flag is |
| 422 | * set to false |
| 423 | * |
| 424 | * @bio: Pointer to the BIO structure |
| 425 | * @is_pfe: Pointer to is_pfe flag, which will be true if function was invoked |
| 426 | * from PFE context |
| 427 | */ |
| 428 | int pfk_load_key_end(const struct bio *bio, bool *is_pfe) |
| 429 | { |
| 430 | int ret = 0; |
| 431 | struct pfk_key_info key_info = {NULL, NULL, 0, 0}; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 432 | |
| 433 | if (!is_pfe) { |
| 434 | pr_err("is_pfe is NULL\n"); |
| 435 | return -EINVAL; |
| 436 | } |
| 437 | |
| 438 | /* only a few errors below can indicate that |
| 439 | * this function was not invoked within PFE context, |
| 440 | * otherwise we will consider it PFE |
| 441 | */ |
| 442 | *is_pfe = true; |
| 443 | |
| 444 | if (!pfk_is_ready()) |
| 445 | return -ENODEV; |
| 446 | |
Neeraj Soni | efb3311 | 2018-08-17 20:39:35 +0530 | [diff] [blame] | 447 | ret = pfk_get_key_for_bio(bio, &key_info, NULL, is_pfe, NULL); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 448 | if (ret != 0) |
| 449 | return ret; |
| 450 | |
| 451 | pfk_kc_load_key_end(key_info.key, key_info.key_size, |
| 452 | key_info.salt, key_info.salt_size); |
| 453 | |
| 454 | pr_debug("finished using key for file %s\n", |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 455 | inode_to_filename(pfk_bio_get_inode(bio))); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 456 | |
| 457 | return 0; |
| 458 | } |
| 459 | |
| 460 | /** |
| 461 | * pfk_allow_merge_bio() - Check if 2 BIOs can be merged. |
| 462 | * @bio1: Pointer to first BIO structure. |
| 463 | * @bio2: Pointer to second BIO structure. |
| 464 | * |
| 465 | * Prevent merging of BIOs from encrypted and non-encrypted |
| 466 | * files, or files encrypted with different key. |
| 467 | * Also prevent non encrypted and encrypted data from the same file |
| 468 | * to be merged (ecryptfs header if stored inside file should be non |
| 469 | * encrypted) |
| 470 | * This API is called by the file system block layer. |
| 471 | * |
| 472 | * Return: true if the BIOs allowed to be merged, false |
| 473 | * otherwise. |
| 474 | */ |
| 475 | bool pfk_allow_merge_bio(const struct bio *bio1, const struct bio *bio2) |
| 476 | { |
Jaegeuk Kim | 3bd012f | 2018-04-20 19:26:09 -0700 | [diff] [blame] | 477 | const struct blk_encryption_key *key1 = NULL; |
| 478 | const struct blk_encryption_key *key2 = NULL; |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 479 | const struct inode *inode1; |
| 480 | const struct inode *inode2; |
| 481 | enum pfe_type which_pfe1; |
| 482 | enum pfe_type which_pfe2; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 483 | |
Jaegeuk Kim | 3bd012f | 2018-04-20 19:26:09 -0700 | [diff] [blame] | 484 | #ifdef CONFIG_DM_DEFAULT_KEY |
| 485 | key1 = bio1->bi_crypt_key; |
| 486 | key2 = bio2->bi_crypt_key; |
| 487 | #endif |
| 488 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 489 | if (!pfk_is_ready()) |
| 490 | return false; |
| 491 | |
| 492 | if (!bio1 || !bio2) |
| 493 | return false; |
| 494 | |
| 495 | if (bio1 == bio2) |
| 496 | return true; |
| 497 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 498 | key1 = bio1->bi_crypt_key; |
| 499 | key2 = bio2->bi_crypt_key; |
| 500 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 501 | inode1 = pfk_bio_get_inode(bio1); |
| 502 | inode2 = pfk_bio_get_inode(bio2); |
| 503 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 504 | which_pfe1 = pfk_get_pfe_type(inode1); |
| 505 | which_pfe2 = pfk_get_pfe_type(inode2); |
| 506 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 507 | /* |
| 508 | * If one bio is for an encrypted file and the other is for a different |
| 509 | * type of encrypted file or for blocks that are not part of an |
| 510 | * encrypted file, do not merge. |
| 511 | */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 512 | if (which_pfe1 != which_pfe2) |
| 513 | return false; |
| 514 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 515 | if (which_pfe1 != INVALID_PFE) { |
| 516 | /* Both bios are for the same type of encrypted file. */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 517 | return (*(pfk_allow_merge_bio_ftable[which_pfe1]))(bio1, bio2, |
| 518 | inode1, inode2); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 519 | } |
| 520 | |
| 521 | /* |
| 522 | * Neither bio is for an encrypted file. Merge only if the default keys |
| 523 | * are the same (or both are NULL). |
| 524 | */ |
| 525 | return key1 == key2 || |
| 526 | (key1 && key2 && |
| 527 | !crypto_memneq(key1->raw, key2->raw, sizeof(key1->raw))); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 528 | } |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 529 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 530 | /** |
| 531 | * Flush key table on storage core reset. During core reset key configuration |
| 532 | * is lost in ICE. We need to flash the cache, so that the keys will be |
| 533 | * reconfigured again for every subsequent transaction |
| 534 | */ |
| 535 | void pfk_clear_on_reset(void) |
| 536 | { |
| 537 | if (!pfk_is_ready()) |
| 538 | return; |
| 539 | |
| 540 | pfk_kc_clear_on_reset(); |
| 541 | } |
| 542 | |
| 543 | module_init(pfk_init); |
| 544 | module_exit(pfk_exit); |
| 545 | |
| 546 | MODULE_LICENSE("GPL v2"); |
| 547 | MODULE_DESCRIPTION("Per-File-Key driver"); |