Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License version 2 and |
| 6 | * only version 2 as published by the Free Software Foundation. |
| 7 | * |
| 8 | * This program is distributed in the hope that it will be useful, |
| 9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 11 | * GNU General Public License for more details. |
| 12 | */ |
| 13 | |
| 14 | /* |
| 15 | * Per-File-Key (PFK). |
| 16 | * |
| 17 | * This driver is responsible for overall management of various |
| 18 | * Per File Encryption variants that work on top of or as part of different |
| 19 | * file systems. |
| 20 | * |
| 21 | * The driver has the following purpose : |
| 22 | * 1) Define priorities between PFE's if more than one is enabled |
| 23 | * 2) Extract key information from inode |
| 24 | * 3) Load and manage various keys in ICE HW engine |
| 25 | * 4) It should be invoked from various layers in FS/BLOCK/STORAGE DRIVER |
| 26 | * that need to take decision on HW encryption management of the data |
| 27 | * Some examples: |
| 28 | * BLOCK LAYER: when it takes decision on whether 2 chunks can be united |
| 29 | * to one encryption / decryption request sent to the HW |
| 30 | * |
| 31 | * UFS DRIVER: when it need to configure ICE HW with a particular key slot |
| 32 | * to be used for encryption / decryption |
| 33 | * |
| 34 | * PFE variants can differ on particular way of storing the cryptographic info |
| 35 | * inside inode, actions to be taken upon file operations, etc., but the common |
| 36 | * properties are described above |
| 37 | * |
| 38 | */ |
| 39 | |
| 40 | |
| 41 | /* Uncomment the line below to enable debug messages */ |
| 42 | /* #define DEBUG 1 */ |
| 43 | #define pr_fmt(fmt) "pfk [%s]: " fmt, __func__ |
| 44 | |
| 45 | #include <linux/module.h> |
| 46 | #include <linux/fs.h> |
| 47 | #include <linux/errno.h> |
| 48 | #include <linux/printk.h> |
| 49 | #include <linux/bio.h> |
| 50 | #include <linux/security.h> |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 51 | #include <crypto/algapi.h> |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 52 | #include <crypto/ice.h> |
| 53 | |
| 54 | #include <linux/pfk.h> |
| 55 | |
| 56 | #include "pfk_kc.h" |
| 57 | #include "objsec.h" |
| 58 | #include "pfk_ice.h" |
| 59 | #include "pfk_ext4.h" |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 60 | #include "pfk_f2fs.h" |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 61 | #include "pfk_internal.h" |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 62 | //#include "ext4.h" |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 63 | |
| 64 | static bool pfk_ready; |
| 65 | |
| 66 | |
| 67 | /* might be replaced by a table when more than one cipher is supported */ |
| 68 | #define PFK_SUPPORTED_KEY_SIZE 32 |
| 69 | #define PFK_SUPPORTED_SALT_SIZE 32 |
| 70 | |
| 71 | /* Various PFE types and function tables to support each one of them */ |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 72 | enum pfe_type {EXT4_CRYPT_PFE, F2FS_CRYPT_PFE, INVALID_PFE}; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 73 | |
| 74 | typedef int (*pfk_parse_inode_type)(const struct bio *bio, |
| 75 | const struct inode *inode, |
| 76 | struct pfk_key_info *key_info, |
| 77 | enum ice_cryto_algo_mode *algo, |
| 78 | bool *is_pfe); |
| 79 | |
| 80 | typedef bool (*pfk_allow_merge_bio_type)(const struct bio *bio1, |
| 81 | const struct bio *bio2, const struct inode *inode1, |
| 82 | const struct inode *inode2); |
| 83 | |
| 84 | static const pfk_parse_inode_type pfk_parse_inode_ftable[] = { |
| 85 | /* EXT4_CRYPT_PFE */ &pfk_ext4_parse_inode, |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 86 | /* F2FS_CRYPT_PFE */ &pfk_f2fs_parse_inode, |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 87 | }; |
| 88 | |
| 89 | static const pfk_allow_merge_bio_type pfk_allow_merge_bio_ftable[] = { |
| 90 | /* EXT4_CRYPT_PFE */ &pfk_ext4_allow_merge_bio, |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 91 | /* F2FS_CRYPT_PFE */ &pfk_f2fs_allow_merge_bio, |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 92 | }; |
| 93 | |
| 94 | static void __exit pfk_exit(void) |
| 95 | { |
| 96 | pfk_ready = false; |
| 97 | pfk_ext4_deinit(); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 98 | pfk_f2fs_deinit(); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 99 | pfk_kc_deinit(); |
| 100 | } |
| 101 | |
| 102 | static int __init pfk_init(void) |
| 103 | { |
| 104 | |
| 105 | int ret = 0; |
| 106 | |
| 107 | ret = pfk_ext4_init(); |
| 108 | if (ret != 0) |
| 109 | goto fail; |
| 110 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 111 | ret = pfk_f2fs_init(); |
| 112 | if (ret != 0) |
| 113 | goto fail; |
| 114 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 115 | ret = pfk_kc_init(); |
| 116 | if (ret != 0) { |
| 117 | pr_err("could init pfk key cache, error %d\n", ret); |
| 118 | pfk_ext4_deinit(); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 119 | pfk_f2fs_deinit(); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 120 | goto fail; |
| 121 | } |
| 122 | |
| 123 | pfk_ready = true; |
| 124 | pr_info("Driver initialized successfully\n"); |
| 125 | |
| 126 | return 0; |
| 127 | |
| 128 | fail: |
| 129 | pr_err("Failed to init driver\n"); |
| 130 | return -ENODEV; |
| 131 | } |
| 132 | |
| 133 | /* |
| 134 | * If more than one type is supported simultaneously, this function will also |
| 135 | * set the priority between them |
| 136 | */ |
| 137 | static enum pfe_type pfk_get_pfe_type(const struct inode *inode) |
| 138 | { |
| 139 | if (!inode) |
| 140 | return INVALID_PFE; |
| 141 | |
| 142 | if (pfk_is_ext4_type(inode)) |
| 143 | return EXT4_CRYPT_PFE; |
| 144 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 145 | if (pfk_is_f2fs_type(inode)) |
| 146 | return F2FS_CRYPT_PFE; |
| 147 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 148 | return INVALID_PFE; |
| 149 | } |
| 150 | |
| 151 | /** |
| 152 | * inode_to_filename() - get the filename from inode pointer. |
| 153 | * @inode: inode pointer |
| 154 | * |
| 155 | * it is used for debug prints. |
| 156 | * |
| 157 | * Return: filename string or "unknown". |
| 158 | */ |
| 159 | char *inode_to_filename(const struct inode *inode) |
| 160 | { |
| 161 | struct dentry *dentry = NULL; |
| 162 | char *filename = NULL; |
| 163 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 164 | if (!inode) |
| 165 | return "NULL"; |
| 166 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 167 | if (hlist_empty(&inode->i_dentry)) |
| 168 | return "unknown"; |
| 169 | |
| 170 | dentry = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias); |
| 171 | filename = dentry->d_iname; |
| 172 | |
| 173 | return filename; |
| 174 | } |
| 175 | |
| 176 | /** |
| 177 | * pfk_is_ready() - driver is initialized and ready. |
| 178 | * |
| 179 | * Return: true if the driver is ready. |
| 180 | */ |
| 181 | static inline bool pfk_is_ready(void) |
| 182 | { |
| 183 | return pfk_ready; |
| 184 | } |
| 185 | |
| 186 | /** |
| 187 | * pfk_bio_get_inode() - get the inode from a bio. |
| 188 | * @bio: Pointer to BIO structure. |
| 189 | * |
| 190 | * Walk the bio struct links to get the inode. |
| 191 | * Please note, that in general bio may consist of several pages from |
| 192 | * several files, but in our case we always assume that all pages come |
| 193 | * from the same file, since our logic ensures it. That is why we only |
| 194 | * walk through the first page to look for inode. |
| 195 | * |
| 196 | * Return: pointer to the inode struct if successful, or NULL otherwise. |
| 197 | * |
| 198 | */ |
| 199 | static struct inode *pfk_bio_get_inode(const struct bio *bio) |
| 200 | { |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 201 | if (!bio) |
| 202 | return NULL; |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 203 | if (!bio_has_data((struct bio *)bio)) |
| 204 | return NULL; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 205 | if (!bio->bi_io_vec) |
| 206 | return NULL; |
| 207 | if (!bio->bi_io_vec->bv_page) |
| 208 | return NULL; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 209 | |
| 210 | if (PageAnon(bio->bi_io_vec->bv_page)) { |
| 211 | struct inode *inode; |
| 212 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 213 | /* Using direct-io (O_DIRECT) without page cache */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 214 | inode = dio_bio_get_inode((struct bio *)bio); |
| 215 | pr_debug("inode on direct-io, inode = 0x%pK.\n", inode); |
| 216 | |
| 217 | return inode; |
| 218 | } |
| 219 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 220 | if (!page_mapping(bio->bi_io_vec->bv_page)) |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 221 | return NULL; |
| 222 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 223 | if (!bio->bi_io_vec->bv_page->mapping->host) |
| 224 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 225 | return NULL; |
| 226 | |
| 227 | return bio->bi_io_vec->bv_page->mapping->host; |
| 228 | } |
| 229 | |
| 230 | /** |
| 231 | * pfk_key_size_to_key_type() - translate key size to key size enum |
| 232 | * @key_size: key size in bytes |
| 233 | * @key_size_type: pointer to store the output enum (can be null) |
| 234 | * |
| 235 | * return 0 in case of success, error otherwise (i.e not supported key size) |
| 236 | */ |
| 237 | int pfk_key_size_to_key_type(size_t key_size, |
| 238 | enum ice_crpto_key_size *key_size_type) |
| 239 | { |
| 240 | /* |
| 241 | * currently only 32 bit key size is supported |
| 242 | * in the future, table with supported key sizes might |
| 243 | * be introduced |
| 244 | */ |
| 245 | |
| 246 | if (key_size != PFK_SUPPORTED_KEY_SIZE) { |
| 247 | pr_err("not supported key size %zu\n", key_size); |
| 248 | return -EINVAL; |
| 249 | } |
| 250 | |
| 251 | if (key_size_type) |
| 252 | *key_size_type = ICE_CRYPTO_KEY_SIZE_256; |
| 253 | |
| 254 | return 0; |
| 255 | } |
| 256 | |
| 257 | /* |
| 258 | * Retrieves filesystem type from inode's superblock |
| 259 | */ |
| 260 | bool pfe_is_inode_filesystem_type(const struct inode *inode, |
| 261 | const char *fs_type) |
| 262 | { |
| 263 | if (!inode || !fs_type) |
| 264 | return false; |
| 265 | |
| 266 | if (!inode->i_sb) |
| 267 | return false; |
| 268 | |
| 269 | if (!inode->i_sb->s_type) |
| 270 | return false; |
| 271 | |
| 272 | return (strcmp(inode->i_sb->s_type->name, fs_type) == 0); |
| 273 | } |
| 274 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 275 | /** |
| 276 | * pfk_get_key_for_bio() - get the encryption key to be used for a bio |
| 277 | * |
| 278 | * @bio: pointer to the BIO |
| 279 | * @key_info: pointer to the key information which will be filled in |
| 280 | * @algo_mode: optional pointer to the algorithm identifier which will be set |
| 281 | * @is_pfe: will be set to false if the BIO should be left unencrypted |
| 282 | * |
| 283 | * Return: 0 if a key is being used, otherwise a -errno value |
| 284 | */ |
| 285 | static int pfk_get_key_for_bio(const struct bio *bio, |
| 286 | struct pfk_key_info *key_info, |
| 287 | enum ice_cryto_algo_mode *algo_mode, |
| 288 | bool *is_pfe) |
| 289 | { |
| 290 | const struct inode *inode; |
| 291 | enum pfe_type which_pfe; |
| 292 | const struct blk_encryption_key *key; |
| 293 | |
| 294 | inode = pfk_bio_get_inode(bio); |
| 295 | which_pfe = pfk_get_pfe_type(inode); |
| 296 | |
| 297 | if (which_pfe != INVALID_PFE) { |
| 298 | /* Encrypted file; override ->bi_crypt_key */ |
| 299 | pr_debug("parsing inode %lu with PFE type %d\n", |
| 300 | inode->i_ino, which_pfe); |
| 301 | return (*(pfk_parse_inode_ftable[which_pfe])) |
| 302 | (bio, inode, key_info, algo_mode, is_pfe); |
| 303 | } |
| 304 | |
| 305 | /* |
| 306 | * bio is not for an encrypted file. Use ->bi_crypt_key if it was set. |
| 307 | * Otherwise, don't encrypt/decrypt the bio. |
| 308 | */ |
| 309 | key = bio->bi_crypt_key; |
| 310 | if (!key) { |
| 311 | *is_pfe = false; |
| 312 | return -EINVAL; |
| 313 | } |
| 314 | |
| 315 | /* Note: the "salt" is really just the second half of the XTS key. */ |
| 316 | BUILD_BUG_ON(sizeof(key->raw) != |
| 317 | PFK_SUPPORTED_KEY_SIZE + PFK_SUPPORTED_SALT_SIZE); |
| 318 | key_info->key = &key->raw[0]; |
| 319 | key_info->key_size = PFK_SUPPORTED_KEY_SIZE; |
| 320 | key_info->salt = &key->raw[PFK_SUPPORTED_KEY_SIZE]; |
| 321 | key_info->salt_size = PFK_SUPPORTED_SALT_SIZE; |
| 322 | if (algo_mode) |
| 323 | *algo_mode = ICE_CRYPTO_ALGO_MODE_AES_XTS; |
| 324 | return 0; |
| 325 | } |
| 326 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 327 | |
| 328 | /** |
| 329 | * pfk_load_key_start() - loads PFE encryption key to the ICE |
| 330 | * Can also be invoked from non |
| 331 | * PFE context, in this case it |
| 332 | * is not relevant and is_pfe |
| 333 | * flag is set to false |
| 334 | * |
| 335 | * @bio: Pointer to the BIO structure |
| 336 | * @ice_setting: Pointer to ice setting structure that will be filled with |
| 337 | * ice configuration values, including the index to which the key was loaded |
| 338 | * @is_pfe: will be false if inode is not relevant to PFE, in such a case |
| 339 | * it should be treated as non PFE by the block layer |
| 340 | * |
| 341 | * Returns the index where the key is stored in encryption hw and additional |
| 342 | * information that will be used later for configuration of the encryption hw. |
| 343 | * |
| 344 | * Must be followed by pfk_load_key_end when key is no longer used by ice |
| 345 | * |
| 346 | */ |
| 347 | int pfk_load_key_start(const struct bio *bio, |
| 348 | struct ice_crypto_setting *ice_setting, bool *is_pfe, |
| 349 | bool async) |
| 350 | { |
| 351 | int ret = 0; |
| 352 | struct pfk_key_info key_info = {NULL, NULL, 0, 0}; |
| 353 | enum ice_cryto_algo_mode algo_mode = ICE_CRYPTO_ALGO_MODE_AES_XTS; |
| 354 | enum ice_crpto_key_size key_size_type = 0; |
| 355 | u32 key_index = 0; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 356 | |
| 357 | if (!is_pfe) { |
| 358 | pr_err("is_pfe is NULL\n"); |
| 359 | return -EINVAL; |
| 360 | } |
| 361 | |
| 362 | /* |
| 363 | * only a few errors below can indicate that |
| 364 | * this function was not invoked within PFE context, |
| 365 | * otherwise we will consider it PFE |
| 366 | */ |
| 367 | *is_pfe = true; |
| 368 | |
| 369 | if (!pfk_is_ready()) |
| 370 | return -ENODEV; |
| 371 | |
| 372 | if (!ice_setting) { |
| 373 | pr_err("ice setting is NULL\n"); |
| 374 | return -EINVAL; |
| 375 | } |
| 376 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 377 | ret = pfk_get_key_for_bio(bio, &key_info, &algo_mode, is_pfe); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 378 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 379 | if (ret != 0) |
| 380 | return ret; |
| 381 | |
| 382 | ret = pfk_key_size_to_key_type(key_info.key_size, &key_size_type); |
| 383 | if (ret != 0) |
| 384 | return ret; |
| 385 | |
| 386 | ret = pfk_kc_load_key_start(key_info.key, key_info.key_size, |
| 387 | key_info.salt, key_info.salt_size, &key_index, async); |
| 388 | if (ret) { |
| 389 | if (ret != -EBUSY && ret != -EAGAIN) |
| 390 | pr_err("start: could not load key into pfk key cache, error %d\n", |
| 391 | ret); |
| 392 | |
| 393 | return ret; |
| 394 | } |
| 395 | |
| 396 | ice_setting->key_size = key_size_type; |
| 397 | ice_setting->algo_mode = algo_mode; |
| 398 | /* hardcoded for now */ |
| 399 | ice_setting->key_mode = ICE_CRYPTO_USE_LUT_SW_KEY; |
| 400 | ice_setting->key_index = key_index; |
| 401 | |
| 402 | pr_debug("loaded key for file %s key_index %d\n", |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 403 | inode_to_filename(pfk_bio_get_inode(bio)), key_index); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 404 | |
| 405 | return 0; |
| 406 | } |
| 407 | |
| 408 | /** |
| 409 | * pfk_load_key_end() - marks the PFE key as no longer used by ICE |
| 410 | * Can also be invoked from non |
| 411 | * PFE context, in this case it is not |
| 412 | * relevant and is_pfe flag is |
| 413 | * set to false |
| 414 | * |
| 415 | * @bio: Pointer to the BIO structure |
| 416 | * @is_pfe: Pointer to is_pfe flag, which will be true if function was invoked |
| 417 | * from PFE context |
| 418 | */ |
| 419 | int pfk_load_key_end(const struct bio *bio, bool *is_pfe) |
| 420 | { |
| 421 | int ret = 0; |
| 422 | struct pfk_key_info key_info = {NULL, NULL, 0, 0}; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 423 | |
| 424 | if (!is_pfe) { |
| 425 | pr_err("is_pfe is NULL\n"); |
| 426 | return -EINVAL; |
| 427 | } |
| 428 | |
| 429 | /* only a few errors below can indicate that |
| 430 | * this function was not invoked within PFE context, |
| 431 | * otherwise we will consider it PFE |
| 432 | */ |
| 433 | *is_pfe = true; |
| 434 | |
| 435 | if (!pfk_is_ready()) |
| 436 | return -ENODEV; |
| 437 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 438 | ret = pfk_get_key_for_bio(bio, &key_info, NULL, is_pfe); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 439 | if (ret != 0) |
| 440 | return ret; |
| 441 | |
| 442 | pfk_kc_load_key_end(key_info.key, key_info.key_size, |
| 443 | key_info.salt, key_info.salt_size); |
| 444 | |
| 445 | pr_debug("finished using key for file %s\n", |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 446 | inode_to_filename(pfk_bio_get_inode(bio))); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 447 | |
| 448 | return 0; |
| 449 | } |
| 450 | |
| 451 | /** |
| 452 | * pfk_allow_merge_bio() - Check if 2 BIOs can be merged. |
| 453 | * @bio1: Pointer to first BIO structure. |
| 454 | * @bio2: Pointer to second BIO structure. |
| 455 | * |
| 456 | * Prevent merging of BIOs from encrypted and non-encrypted |
| 457 | * files, or files encrypted with different key. |
| 458 | * Also prevent non encrypted and encrypted data from the same file |
| 459 | * to be merged (ecryptfs header if stored inside file should be non |
| 460 | * encrypted) |
| 461 | * This API is called by the file system block layer. |
| 462 | * |
| 463 | * Return: true if the BIOs allowed to be merged, false |
| 464 | * otherwise. |
| 465 | */ |
| 466 | bool pfk_allow_merge_bio(const struct bio *bio1, const struct bio *bio2) |
| 467 | { |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 468 | const struct blk_encryption_key *key1; |
| 469 | const struct blk_encryption_key *key2; |
| 470 | const struct inode *inode1; |
| 471 | const struct inode *inode2; |
| 472 | enum pfe_type which_pfe1; |
| 473 | enum pfe_type which_pfe2; |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 474 | |
| 475 | if (!pfk_is_ready()) |
| 476 | return false; |
| 477 | |
| 478 | if (!bio1 || !bio2) |
| 479 | return false; |
| 480 | |
| 481 | if (bio1 == bio2) |
| 482 | return true; |
| 483 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 484 | key1 = bio1->bi_crypt_key; |
| 485 | key2 = bio2->bi_crypt_key; |
| 486 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 487 | inode1 = pfk_bio_get_inode(bio1); |
| 488 | inode2 = pfk_bio_get_inode(bio2); |
| 489 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 490 | which_pfe1 = pfk_get_pfe_type(inode1); |
| 491 | which_pfe2 = pfk_get_pfe_type(inode2); |
| 492 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 493 | /* |
| 494 | * If one bio is for an encrypted file and the other is for a different |
| 495 | * type of encrypted file or for blocks that are not part of an |
| 496 | * encrypted file, do not merge. |
| 497 | */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 498 | if (which_pfe1 != which_pfe2) |
| 499 | return false; |
| 500 | |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 501 | if (which_pfe1 != INVALID_PFE) { |
| 502 | /* Both bios are for the same type of encrypted file. */ |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 503 | return (*(pfk_allow_merge_bio_ftable[which_pfe1]))(bio1, bio2, |
| 504 | inode1, inode2); |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 505 | } |
| 506 | |
| 507 | /* |
| 508 | * Neither bio is for an encrypted file. Merge only if the default keys |
| 509 | * are the same (or both are NULL). |
| 510 | */ |
| 511 | return key1 == key2 || |
| 512 | (key1 && key2 && |
| 513 | !crypto_memneq(key1->raw, key2->raw, sizeof(key1->raw))); |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 514 | } |
Neeraj Soni | 36c6512 | 2018-04-18 21:04:46 +0530 | [diff] [blame] | 515 | |
Neeraj Soni | c692cb9 | 2018-04-18 17:20:22 +0530 | [diff] [blame] | 516 | /** |
| 517 | * Flush key table on storage core reset. During core reset key configuration |
| 518 | * is lost in ICE. We need to flash the cache, so that the keys will be |
| 519 | * reconfigured again for every subsequent transaction |
| 520 | */ |
| 521 | void pfk_clear_on_reset(void) |
| 522 | { |
| 523 | if (!pfk_is_ready()) |
| 524 | return; |
| 525 | |
| 526 | pfk_kc_clear_on_reset(); |
| 527 | } |
| 528 | |
| 529 | module_init(pfk_init); |
| 530 | module_exit(pfk_exit); |
| 531 | |
| 532 | MODULE_LICENSE("GPL v2"); |
| 533 | MODULE_DESCRIPTION("Per-File-Key driver"); |