]>
Commit | Line | Data |
---|---|---|
78368575 DB |
1 | /* |
2 | * QEMU block full disk encryption | |
3 | * | |
4 | * Copyright (c) 2015-2016 Red Hat, Inc. | |
5 | * | |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
61f3c91a | 9 | * version 2.1 of the License, or (at your option) any later version. |
78368575 DB |
10 | * |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. | |
18 | * | |
19 | */ | |
20 | ||
21 | #include "qemu/osdep.h" | |
22 | ||
23 | #include "block/block_int.h" | |
f853465a | 24 | #include "block/qdict.h" |
78368575 DB |
25 | #include "sysemu/block-backend.h" |
26 | #include "crypto/block.h" | |
27 | #include "qapi/opts-visitor.h" | |
9af23989 | 28 | #include "qapi/qapi-visit-crypto.h" |
306a06e5 | 29 | #include "qapi/qobject-input-visitor.h" |
78368575 | 30 | #include "qapi/error.h" |
0b8fa32f | 31 | #include "qemu/module.h" |
922a01a0 | 32 | #include "qemu/option.h" |
1bba30da | 33 | #include "qemu/cutils.h" |
5df022cf | 34 | #include "qemu/memalign.h" |
0d8c41da | 35 | #include "crypto.h" |
78368575 DB |
36 | |
37 | typedef struct BlockCrypto BlockCrypto; | |
38 | ||
39 | struct BlockCrypto { | |
40 | QCryptoBlock *block; | |
bbfdae91 | 41 | bool updating_keys; |
9ad5c4e7 | 42 | BdrvChild *header; /* Reference to the detached LUKS header */ |
78368575 DB |
43 | }; |
44 | ||
45 | ||
46 | static int block_crypto_probe_generic(QCryptoBlockFormat format, | |
47 | const uint8_t *buf, | |
48 | int buf_size, | |
49 | const char *filename) | |
50 | { | |
51 | if (qcrypto_block_has_format(format, buf, buf_size)) { | |
52 | return 100; | |
53 | } else { | |
54 | return 0; | |
55 | } | |
56 | } | |
57 | ||
58 | ||
757dda54 AF |
59 | static int block_crypto_read_func(QCryptoBlock *block, |
60 | size_t offset, | |
61 | uint8_t *buf, | |
62 | size_t buflen, | |
63 | void *opaque, | |
64 | Error **errp) | |
78368575 DB |
65 | { |
66 | BlockDriverState *bs = opaque; | |
9ad5c4e7 | 67 | BlockCrypto *crypto = bs->opaque; |
78368575 DB |
68 | ssize_t ret; |
69 | ||
1f051dcb KW |
70 | GLOBAL_STATE_CODE(); |
71 | GRAPH_RDLOCK_GUARD_MAINLOOP(); | |
72 | ||
9ad5c4e7 HH |
73 | ret = bdrv_pread(crypto->header ? crypto->header : bs->file, |
74 | offset, buflen, buf, 0); | |
78368575 DB |
75 | if (ret < 0) { |
76 | error_setg_errno(errp, -ret, "Could not read encryption header"); | |
77 | return ret; | |
78 | } | |
757dda54 | 79 | return 0; |
78368575 DB |
80 | } |
81 | ||
757dda54 AF |
82 | static int block_crypto_write_func(QCryptoBlock *block, |
83 | size_t offset, | |
84 | const uint8_t *buf, | |
85 | size_t buflen, | |
86 | void *opaque, | |
87 | Error **errp) | |
bbfdae91 ML |
88 | { |
89 | BlockDriverState *bs = opaque; | |
9ad5c4e7 | 90 | BlockCrypto *crypto = bs->opaque; |
bbfdae91 ML |
91 | ssize_t ret; |
92 | ||
1f051dcb KW |
93 | GLOBAL_STATE_CODE(); |
94 | GRAPH_RDLOCK_GUARD_MAINLOOP(); | |
95 | ||
9ad5c4e7 HH |
96 | ret = bdrv_pwrite(crypto->header ? crypto->header : bs->file, |
97 | offset, buflen, buf, 0); | |
bbfdae91 ML |
98 | if (ret < 0) { |
99 | error_setg_errno(errp, -ret, "Could not write encryption header"); | |
100 | return ret; | |
101 | } | |
757dda54 | 102 | return 0; |
bbfdae91 ML |
103 | } |
104 | ||
78368575 DB |
105 | |
106 | struct BlockCryptoCreateData { | |
78368575 DB |
107 | BlockBackend *blk; |
108 | uint64_t size; | |
672de729 | 109 | PreallocMode prealloc; |
78368575 DB |
110 | }; |
111 | ||
112 | ||
4db7ba3b KW |
113 | static int coroutine_fn GRAPH_UNLOCKED |
114 | block_crypto_create_write_func(QCryptoBlock *block, size_t offset, | |
115 | const uint8_t *buf, size_t buflen, void *opaque, | |
116 | Error **errp) | |
78368575 DB |
117 | { |
118 | struct BlockCryptoCreateData *data = opaque; | |
119 | ssize_t ret; | |
120 | ||
a9262f55 | 121 | ret = blk_pwrite(data->blk, offset, buflen, buf, 0); |
78368575 DB |
122 | if (ret < 0) { |
123 | error_setg_errno(errp, -ret, "Could not write encryption header"); | |
124 | return ret; | |
125 | } | |
757dda54 | 126 | return 0; |
78368575 DB |
127 | } |
128 | ||
4db7ba3b KW |
129 | static int coroutine_fn GRAPH_UNLOCKED |
130 | block_crypto_create_init_func(QCryptoBlock *block, size_t headerlen, | |
131 | void *opaque, Error **errp) | |
78368575 DB |
132 | { |
133 | struct BlockCryptoCreateData *data = opaque; | |
3d1900a4 ML |
134 | Error *local_error = NULL; |
135 | int ret; | |
78368575 | 136 | |
3d7ed9c4 | 137 | if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) { |
3d1900a4 ML |
138 | ret = -EFBIG; |
139 | goto error; | |
3d7ed9c4 KW |
140 | } |
141 | ||
78368575 DB |
142 | /* User provided size should reflect amount of space made |
143 | * available to the guest, so we must take account of that | |
144 | * which will be used by the crypto header | |
145 | */ | |
3d1900a4 ML |
146 | ret = blk_truncate(data->blk, data->size + headerlen, false, |
147 | data->prealloc, 0, &local_error); | |
148 | ||
149 | if (ret >= 0) { | |
757dda54 | 150 | return 0; |
3d1900a4 ML |
151 | } |
152 | ||
153 | error: | |
154 | if (ret == -EFBIG) { | |
155 | /* Replace the error message with a better one */ | |
156 | error_free(local_error); | |
157 | error_setg(errp, "The requested file size is too large"); | |
158 | } else { | |
159 | error_propagate(errp, local_error); | |
160 | } | |
161 | ||
162 | return ret; | |
78368575 DB |
163 | } |
164 | ||
d0112eb4 HH |
165 | static int coroutine_fn GRAPH_UNLOCKED |
166 | block_crypto_co_format_luks_payload(BlockdevCreateOptionsLUKS *luks_opts, | |
167 | Error **errp) | |
168 | { | |
169 | BlockDriverState *bs = NULL; | |
170 | BlockBackend *blk = NULL; | |
171 | Error *local_error = NULL; | |
172 | int ret; | |
173 | ||
174 | if (luks_opts->size > INT64_MAX) { | |
175 | return -EFBIG; | |
176 | } | |
177 | ||
178 | bs = bdrv_co_open_blockdev_ref(luks_opts->file, errp); | |
179 | if (bs == NULL) { | |
180 | return -EIO; | |
181 | } | |
182 | ||
183 | blk = blk_co_new_with_bs(bs, BLK_PERM_WRITE | BLK_PERM_RESIZE, | |
184 | BLK_PERM_ALL, errp); | |
185 | if (!blk) { | |
186 | ret = -EPERM; | |
187 | goto fail; | |
188 | } | |
189 | ||
190 | ret = blk_truncate(blk, luks_opts->size, true, | |
191 | luks_opts->preallocation, 0, &local_error); | |
192 | if (ret < 0) { | |
193 | if (ret == -EFBIG) { | |
194 | /* Replace the error message with a better one */ | |
195 | error_free(local_error); | |
196 | error_setg(errp, "The requested file size is too large"); | |
197 | } | |
198 | goto fail; | |
199 | } | |
200 | ||
201 | ret = 0; | |
202 | ||
203 | fail: | |
204 | bdrv_co_unref(bs); | |
205 | return ret; | |
206 | } | |
78368575 DB |
207 | |
208 | static QemuOptsList block_crypto_runtime_opts_luks = { | |
209 | .name = "crypto", | |
210 | .head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head), | |
211 | .desc = { | |
4a47f854 | 212 | BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""), |
78368575 DB |
213 | { /* end of list */ } |
214 | }, | |
215 | }; | |
216 | ||
217 | ||
218 | static QemuOptsList block_crypto_create_opts_luks = { | |
219 | .name = "crypto", | |
220 | .head = QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks.head), | |
221 | .desc = { | |
222 | { | |
223 | .name = BLOCK_OPT_SIZE, | |
224 | .type = QEMU_OPT_SIZE, | |
225 | .help = "Virtual disk size" | |
226 | }, | |
4a47f854 DB |
227 | BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""), |
228 | BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(""), | |
229 | BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(""), | |
230 | BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(""), | |
231 | BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(""), | |
232 | BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(""), | |
233 | BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""), | |
35286dae | 234 | BLOCK_CRYPTO_OPT_DEF_LUKS_DETACHED_HEADER(""), |
78368575 DB |
235 | { /* end of list */ } |
236 | }, | |
237 | }; | |
238 | ||
239 | ||
bbfdae91 ML |
240 | static QemuOptsList block_crypto_amend_opts_luks = { |
241 | .name = "crypto", | |
242 | .head = QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks.head), | |
243 | .desc = { | |
244 | BLOCK_CRYPTO_OPT_DEF_LUKS_STATE(""), | |
245 | BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT(""), | |
246 | BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET(""), | |
247 | BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET(""), | |
248 | BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""), | |
249 | { /* end of list */ } | |
250 | }, | |
251 | }; | |
252 | ||
306a06e5 | 253 | QCryptoBlockOpenOptions * |
796d3239 | 254 | block_crypto_open_opts_init(QDict *opts, Error **errp) |
78368575 | 255 | { |
09204eac | 256 | Visitor *v; |
796d3239 | 257 | QCryptoBlockOpenOptions *ret; |
78368575 | 258 | |
796d3239 | 259 | v = qobject_input_visitor_new_flat_confused(opts, errp); |
e6af90f3 | 260 | if (!v) { |
796d3239 | 261 | return NULL; |
f853465a | 262 | } |
78368575 | 263 | |
796d3239 | 264 | visit_type_QCryptoBlockOpenOptions(v, NULL, &ret, errp); |
78368575 | 265 | |
09204eac | 266 | visit_free(v); |
78368575 DB |
267 | return ret; |
268 | } | |
269 | ||
270 | ||
306a06e5 | 271 | QCryptoBlockCreateOptions * |
796d3239 | 272 | block_crypto_create_opts_init(QDict *opts, Error **errp) |
78368575 | 273 | { |
09204eac | 274 | Visitor *v; |
796d3239 | 275 | QCryptoBlockCreateOptions *ret; |
78368575 | 276 | |
796d3239 | 277 | v = qobject_input_visitor_new_flat_confused(opts, errp); |
e6af90f3 | 278 | if (!v) { |
796d3239 | 279 | return NULL; |
f853465a | 280 | } |
78368575 | 281 | |
796d3239 | 282 | visit_type_QCryptoBlockCreateOptions(v, NULL, &ret, errp); |
78368575 | 283 | |
09204eac | 284 | visit_free(v); |
78368575 DB |
285 | return ret; |
286 | } | |
287 | ||
43cbd06d ML |
288 | QCryptoBlockAmendOptions * |
289 | block_crypto_amend_opts_init(QDict *opts, Error **errp) | |
290 | { | |
291 | Visitor *v; | |
292 | QCryptoBlockAmendOptions *ret; | |
293 | ||
294 | v = qobject_input_visitor_new_flat_confused(opts, errp); | |
295 | if (!v) { | |
296 | return NULL; | |
297 | } | |
298 | ||
299 | visit_type_QCryptoBlockAmendOptions(v, NULL, &ret, errp); | |
300 | ||
301 | visit_free(v); | |
302 | return ret; | |
303 | } | |
304 | ||
78368575 DB |
305 | |
306 | static int block_crypto_open_generic(QCryptoBlockFormat format, | |
307 | QemuOptsList *opts_spec, | |
308 | BlockDriverState *bs, | |
309 | QDict *options, | |
310 | int flags, | |
311 | Error **errp) | |
312 | { | |
9ad5c4e7 HH |
313 | ERRP_GUARD(); |
314 | ||
78368575 DB |
315 | BlockCrypto *crypto = bs->opaque; |
316 | QemuOpts *opts = NULL; | |
83930780 | 317 | int ret; |
78368575 DB |
318 | QCryptoBlockOpenOptions *open_opts = NULL; |
319 | unsigned int cflags = 0; | |
306a06e5 | 320 | QDict *cryptoopts = NULL; |
78368575 | 321 | |
a4b740db KW |
322 | GLOBAL_STATE_CODE(); |
323 | ||
83930780 VSO |
324 | ret = bdrv_open_file_child(NULL, options, "file", bs, errp); |
325 | if (ret < 0) { | |
326 | return ret; | |
4e4bf5c4 KW |
327 | } |
328 | ||
9ad5c4e7 HH |
329 | crypto->header = bdrv_open_child(NULL, options, "header", bs, |
330 | &child_of_bds, BDRV_CHILD_METADATA, | |
331 | true, errp); | |
332 | if (*errp != NULL) { | |
333 | return -EINVAL; | |
334 | } | |
335 | ||
a4b740db KW |
336 | GRAPH_RDLOCK_GUARD_MAINLOOP(); |
337 | ||
d67a6b09 DB |
338 | bs->supported_write_flags = BDRV_REQ_FUA & |
339 | bs->file->bs->supported_write_flags; | |
340 | ||
78368575 | 341 | opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort); |
af175e85 | 342 | if (!qemu_opts_absorb_qdict(opts, options, errp)) { |
83930780 | 343 | ret = -EINVAL; |
78368575 DB |
344 | goto cleanup; |
345 | } | |
346 | ||
306a06e5 | 347 | cryptoopts = qemu_opts_to_qdict(opts, NULL); |
796d3239 | 348 | qdict_put_str(cryptoopts, "format", QCryptoBlockFormat_str(format)); |
306a06e5 | 349 | |
796d3239 | 350 | open_opts = block_crypto_open_opts_init(cryptoopts, errp); |
78368575 | 351 | if (!open_opts) { |
83930780 | 352 | ret = -EINVAL; |
78368575 DB |
353 | goto cleanup; |
354 | } | |
355 | ||
356 | if (flags & BDRV_O_NO_IO) { | |
357 | cflags |= QCRYPTO_BLOCK_OPEN_NO_IO; | |
358 | } | |
9ad5c4e7 HH |
359 | if (crypto->header != NULL) { |
360 | cflags |= QCRYPTO_BLOCK_OPEN_DETACHED; | |
361 | } | |
1cd9a787 | 362 | crypto->block = qcrypto_block_open(open_opts, NULL, |
78368575 DB |
363 | block_crypto_read_func, |
364 | bs, | |
365 | cflags, | |
c972fa12 | 366 | 1, |
78368575 DB |
367 | errp); |
368 | ||
369 | if (!crypto->block) { | |
370 | ret = -EIO; | |
371 | goto cleanup; | |
372 | } | |
373 | ||
54115412 | 374 | bs->encrypted = true; |
78368575 DB |
375 | |
376 | ret = 0; | |
377 | cleanup: | |
cb3e7f08 | 378 | qobject_unref(cryptoopts); |
78368575 DB |
379 | qapi_free_QCryptoBlockOpenOptions(open_opts); |
380 | return ret; | |
381 | } | |
382 | ||
383 | ||
4db7ba3b | 384 | static int coroutine_fn GRAPH_UNLOCKED |
91817e9c KW |
385 | block_crypto_co_create_generic(BlockDriverState *bs, int64_t size, |
386 | QCryptoBlockCreateOptions *opts, | |
d0112eb4 HH |
387 | PreallocMode prealloc, |
388 | unsigned int flags, | |
389 | Error **errp) | |
78368575 | 390 | { |
1ec4f416 KW |
391 | int ret; |
392 | BlockBackend *blk; | |
78368575 | 393 | QCryptoBlock *crypto = NULL; |
1ec4f416 | 394 | struct BlockCryptoCreateData data; |
306a06e5 | 395 | |
91817e9c KW |
396 | blk = blk_co_new_with_bs(bs, BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL, |
397 | errp); | |
a3aeeab5 EB |
398 | if (!blk) { |
399 | ret = -EPERM; | |
1ec4f416 | 400 | goto cleanup; |
3b5a1f6a KW |
401 | } |
402 | ||
672de729 ML |
403 | if (prealloc == PREALLOC_MODE_METADATA) { |
404 | prealloc = PREALLOC_MODE_OFF; | |
405 | } | |
406 | ||
1ec4f416 KW |
407 | data = (struct BlockCryptoCreateData) { |
408 | .blk = blk, | |
35286dae | 409 | .size = flags & QCRYPTO_BLOCK_CREATE_DETACHED ? 0 : size, |
672de729 | 410 | .prealloc = prealloc, |
1ec4f416 | 411 | }; |
3b5a1f6a | 412 | |
1ec4f416 | 413 | crypto = qcrypto_block_create(opts, NULL, |
e0d0ddc5 ML |
414 | block_crypto_create_init_func, |
415 | block_crypto_create_write_func, | |
78368575 | 416 | &data, |
d0112eb4 | 417 | flags, |
78368575 DB |
418 | errp); |
419 | ||
420 | if (!crypto) { | |
421 | ret = -EIO; | |
422 | goto cleanup; | |
423 | } | |
424 | ||
425 | ret = 0; | |
426 | cleanup: | |
427 | qcrypto_block_free(crypto); | |
b2ab5f54 | 428 | blk_co_unref(blk); |
78368575 DB |
429 | return ret; |
430 | } | |
431 | ||
c2b8e315 | 432 | static int coroutine_fn GRAPH_RDLOCK |
c80d8b06 | 433 | block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact, |
92b92799 KW |
434 | PreallocMode prealloc, BdrvRequestFlags flags, |
435 | Error **errp) | |
78368575 DB |
436 | { |
437 | BlockCrypto *crypto = bs->opaque; | |
31376555 | 438 | uint64_t payload_offset = |
78368575 | 439 | qcrypto_block_get_payload_offset(crypto->block); |
120bc742 KW |
440 | |
441 | if (payload_offset > INT64_MAX - offset) { | |
442 | error_setg(errp, "The requested file size is too large"); | |
443 | return -EFBIG; | |
444 | } | |
78368575 DB |
445 | |
446 | offset += payload_offset; | |
447 | ||
7b8e4857 | 448 | return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp); |
78368575 DB |
449 | } |
450 | ||
451 | static void block_crypto_close(BlockDriverState *bs) | |
452 | { | |
453 | BlockCrypto *crypto = bs->opaque; | |
454 | qcrypto_block_free(crypto->block); | |
455 | } | |
456 | ||
f87e08f9 DB |
457 | static int block_crypto_reopen_prepare(BDRVReopenState *state, |
458 | BlockReopenQueue *queue, Error **errp) | |
459 | { | |
460 | /* nothing needs checking */ | |
461 | return 0; | |
462 | } | |
78368575 | 463 | |
161253e2 DB |
464 | /* |
465 | * 1 MB bounce buffer gives good performance / memory tradeoff | |
466 | * when using cache=none|directsync. | |
467 | */ | |
468 | #define BLOCK_CRYPTO_MAX_IO_SIZE (1024 * 1024) | |
78368575 | 469 | |
b9b10c35 | 470 | static int coroutine_fn GRAPH_RDLOCK |
f7ef38dd VSO |
471 | block_crypto_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes, |
472 | QEMUIOVector *qiov, BdrvRequestFlags flags) | |
78368575 DB |
473 | { |
474 | BlockCrypto *crypto = bs->opaque; | |
a73466fb | 475 | uint64_t cur_bytes; /* number of bytes in current iteration */ |
78368575 DB |
476 | uint64_t bytes_done = 0; |
477 | uint8_t *cipher_data = NULL; | |
478 | QEMUIOVector hd_qiov; | |
479 | int ret = 0; | |
a73466fb DB |
480 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); |
481 | uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block); | |
a73466fb | 482 | |
a73466fb DB |
483 | assert(payload_offset < INT64_MAX); |
484 | assert(QEMU_IS_ALIGNED(offset, sector_size)); | |
485 | assert(QEMU_IS_ALIGNED(bytes, sector_size)); | |
78368575 DB |
486 | |
487 | qemu_iovec_init(&hd_qiov, qiov->niov); | |
488 | ||
161253e2 DB |
489 | /* Bounce buffer because we don't wish to expose cipher text |
490 | * in qiov which points to guest memory. | |
78368575 DB |
491 | */ |
492 | cipher_data = | |
161253e2 | 493 | qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE, |
78368575 DB |
494 | qiov->size)); |
495 | if (cipher_data == NULL) { | |
496 | ret = -ENOMEM; | |
497 | goto cleanup; | |
498 | } | |
499 | ||
a73466fb DB |
500 | while (bytes) { |
501 | cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE); | |
78368575 DB |
502 | |
503 | qemu_iovec_reset(&hd_qiov); | |
a73466fb | 504 | qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes); |
78368575 | 505 | |
a73466fb DB |
506 | ret = bdrv_co_preadv(bs->file, payload_offset + offset + bytes_done, |
507 | cur_bytes, &hd_qiov, 0); | |
78368575 DB |
508 | if (ret < 0) { |
509 | goto cleanup; | |
510 | } | |
511 | ||
4609742a DB |
512 | if (qcrypto_block_decrypt(crypto->block, offset + bytes_done, |
513 | cipher_data, cur_bytes, NULL) < 0) { | |
78368575 DB |
514 | ret = -EIO; |
515 | goto cleanup; | |
516 | } | |
517 | ||
a73466fb | 518 | qemu_iovec_from_buf(qiov, bytes_done, cipher_data, cur_bytes); |
78368575 | 519 | |
a73466fb DB |
520 | bytes -= cur_bytes; |
521 | bytes_done += cur_bytes; | |
78368575 DB |
522 | } |
523 | ||
524 | cleanup: | |
525 | qemu_iovec_destroy(&hd_qiov); | |
526 | qemu_vfree(cipher_data); | |
527 | ||
528 | return ret; | |
529 | } | |
530 | ||
531 | ||
b9b10c35 | 532 | static int coroutine_fn GRAPH_RDLOCK |
e75abeda VSO |
533 | block_crypto_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes, |
534 | QEMUIOVector *qiov, BdrvRequestFlags flags) | |
78368575 DB |
535 | { |
536 | BlockCrypto *crypto = bs->opaque; | |
a73466fb | 537 | uint64_t cur_bytes; /* number of bytes in current iteration */ |
78368575 DB |
538 | uint64_t bytes_done = 0; |
539 | uint8_t *cipher_data = NULL; | |
540 | QEMUIOVector hd_qiov; | |
541 | int ret = 0; | |
a73466fb DB |
542 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); |
543 | uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block); | |
a73466fb | 544 | |
e8b65355 SH |
545 | flags &= ~BDRV_REQ_REGISTERED_BUF; |
546 | ||
a73466fb DB |
547 | assert(payload_offset < INT64_MAX); |
548 | assert(QEMU_IS_ALIGNED(offset, sector_size)); | |
549 | assert(QEMU_IS_ALIGNED(bytes, sector_size)); | |
78368575 DB |
550 | |
551 | qemu_iovec_init(&hd_qiov, qiov->niov); | |
552 | ||
161253e2 DB |
553 | /* Bounce buffer because we're not permitted to touch |
554 | * contents of qiov - it points to guest memory. | |
78368575 DB |
555 | */ |
556 | cipher_data = | |
161253e2 | 557 | qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE, |
78368575 DB |
558 | qiov->size)); |
559 | if (cipher_data == NULL) { | |
560 | ret = -ENOMEM; | |
561 | goto cleanup; | |
562 | } | |
563 | ||
a73466fb DB |
564 | while (bytes) { |
565 | cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE); | |
78368575 | 566 | |
a73466fb | 567 | qemu_iovec_to_buf(qiov, bytes_done, cipher_data, cur_bytes); |
78368575 | 568 | |
4609742a DB |
569 | if (qcrypto_block_encrypt(crypto->block, offset + bytes_done, |
570 | cipher_data, cur_bytes, NULL) < 0) { | |
78368575 DB |
571 | ret = -EIO; |
572 | goto cleanup; | |
573 | } | |
574 | ||
575 | qemu_iovec_reset(&hd_qiov); | |
a73466fb | 576 | qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes); |
78368575 | 577 | |
a73466fb | 578 | ret = bdrv_co_pwritev(bs->file, payload_offset + offset + bytes_done, |
d67a6b09 | 579 | cur_bytes, &hd_qiov, flags); |
78368575 DB |
580 | if (ret < 0) { |
581 | goto cleanup; | |
582 | } | |
583 | ||
a73466fb DB |
584 | bytes -= cur_bytes; |
585 | bytes_done += cur_bytes; | |
78368575 DB |
586 | } |
587 | ||
588 | cleanup: | |
589 | qemu_iovec_destroy(&hd_qiov); | |
590 | qemu_vfree(cipher_data); | |
591 | ||
592 | return ret; | |
593 | } | |
594 | ||
a73466fb DB |
595 | static void block_crypto_refresh_limits(BlockDriverState *bs, Error **errp) |
596 | { | |
597 | BlockCrypto *crypto = bs->opaque; | |
598 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); | |
599 | bs->bl.request_alignment = sector_size; /* No sub-sector I/O */ | |
600 | } | |
601 | ||
78368575 | 602 | |
8ab8140a KW |
603 | static int64_t coroutine_fn GRAPH_RDLOCK |
604 | block_crypto_co_getlength(BlockDriverState *bs) | |
78368575 DB |
605 | { |
606 | BlockCrypto *crypto = bs->opaque; | |
c86422c5 | 607 | int64_t len = bdrv_co_getlength(bs->file->bs); |
78368575 | 608 | |
31376555 DB |
609 | uint64_t offset = qcrypto_block_get_payload_offset(crypto->block); |
610 | assert(offset < INT64_MAX); | |
e39e959e KW |
611 | |
612 | if (offset > len) { | |
613 | return -EIO; | |
614 | } | |
78368575 DB |
615 | |
616 | len -= offset; | |
617 | ||
618 | return len; | |
619 | } | |
620 | ||
621 | ||
a9da6e49 SH |
622 | static BlockMeasureInfo *block_crypto_measure(QemuOpts *opts, |
623 | BlockDriverState *in_bs, | |
624 | Error **errp) | |
625 | { | |
626 | g_autoptr(QCryptoBlockCreateOptions) create_opts = NULL; | |
627 | Error *local_err = NULL; | |
628 | BlockMeasureInfo *info; | |
629 | uint64_t size; | |
630 | size_t luks_payload_size; | |
631 | QDict *cryptoopts; | |
632 | ||
633 | /* | |
634 | * Preallocation mode doesn't affect size requirements but we must consume | |
635 | * the option. | |
636 | */ | |
637 | g_free(qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC)); | |
638 | ||
639 | size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0); | |
640 | ||
641 | if (in_bs) { | |
642 | int64_t ssize = bdrv_getlength(in_bs); | |
643 | ||
644 | if (ssize < 0) { | |
645 | error_setg_errno(&local_err, -ssize, | |
646 | "Unable to get image virtual_size"); | |
647 | goto err; | |
648 | } | |
649 | ||
650 | size = ssize; | |
651 | } | |
652 | ||
653 | cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL, | |
654 | &block_crypto_create_opts_luks, true); | |
655 | qdict_put_str(cryptoopts, "format", "luks"); | |
656 | create_opts = block_crypto_create_opts_init(cryptoopts, &local_err); | |
657 | qobject_unref(cryptoopts); | |
658 | if (!create_opts) { | |
659 | goto err; | |
660 | } | |
661 | ||
662 | if (!qcrypto_block_calculate_payload_offset(create_opts, NULL, | |
663 | &luks_payload_size, | |
664 | &local_err)) { | |
665 | goto err; | |
666 | } | |
667 | ||
668 | /* | |
669 | * Unallocated blocks are still encrypted so allocation status makes no | |
670 | * difference to the file size. | |
671 | */ | |
5d72c68b | 672 | info = g_new0(BlockMeasureInfo, 1); |
a9da6e49 SH |
673 | info->fully_allocated = luks_payload_size + size; |
674 | info->required = luks_payload_size + size; | |
675 | return info; | |
676 | ||
677 | err: | |
678 | error_propagate(errp, local_err); | |
679 | return NULL; | |
680 | } | |
681 | ||
682 | ||
78368575 DB |
683 | static int block_crypto_probe_luks(const uint8_t *buf, |
684 | int buf_size, | |
685 | const char *filename) { | |
686 | return block_crypto_probe_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
687 | buf, buf_size, filename); | |
688 | } | |
689 | ||
690 | static int block_crypto_open_luks(BlockDriverState *bs, | |
691 | QDict *options, | |
692 | int flags, | |
693 | Error **errp) | |
694 | { | |
695 | return block_crypto_open_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
696 | &block_crypto_runtime_opts_luks, | |
697 | bs, options, flags, errp); | |
698 | } | |
699 | ||
4db7ba3b | 700 | static int coroutine_fn GRAPH_UNLOCKED |
1bedcaf1 KW |
701 | block_crypto_co_create_luks(BlockdevCreateOptions *create_options, Error **errp) |
702 | { | |
703 | BlockdevCreateOptionsLUKS *luks_opts; | |
d0112eb4 | 704 | BlockDriverState *hdr_bs = NULL; |
1bedcaf1 KW |
705 | BlockDriverState *bs = NULL; |
706 | QCryptoBlockCreateOptions create_opts; | |
672de729 | 707 | PreallocMode preallocation = PREALLOC_MODE_OFF; |
d0112eb4 | 708 | unsigned int cflags = 0; |
1bedcaf1 KW |
709 | int ret; |
710 | ||
711 | assert(create_options->driver == BLOCKDEV_DRIVER_LUKS); | |
712 | luks_opts = &create_options->u.luks; | |
713 | ||
d0112eb4 HH |
714 | if (luks_opts->header == NULL && luks_opts->file == NULL) { |
715 | error_setg(errp, "Either the parameter 'header' or 'file' must " | |
716 | "be specified"); | |
717 | return -EINVAL; | |
718 | } | |
719 | ||
720 | if ((luks_opts->preallocation != PREALLOC_MODE_OFF) && | |
721 | (luks_opts->file == NULL)) { | |
722 | error_setg(errp, "Parameter 'preallocation' requires 'file' to be " | |
723 | "specified for formatting LUKS disk"); | |
433957bb | 724 | return -EINVAL; |
1bedcaf1 KW |
725 | } |
726 | ||
727 | create_opts = (QCryptoBlockCreateOptions) { | |
728 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
729 | .u.luks = *qapi_BlockdevCreateOptionsLUKS_base(luks_opts), | |
730 | }; | |
731 | ||
672de729 ML |
732 | if (luks_opts->has_preallocation) { |
733 | preallocation = luks_opts->preallocation; | |
734 | } | |
735 | ||
d0112eb4 HH |
736 | if (luks_opts->header) { |
737 | /* LUKS volume with detached header */ | |
738 | hdr_bs = bdrv_co_open_blockdev_ref(luks_opts->header, errp); | |
739 | if (hdr_bs == NULL) { | |
740 | return -EIO; | |
741 | } | |
742 | ||
743 | cflags |= QCRYPTO_BLOCK_CREATE_DETACHED; | |
744 | ||
745 | /* Format the LUKS header node */ | |
746 | ret = block_crypto_co_create_generic(hdr_bs, 0, &create_opts, | |
747 | PREALLOC_MODE_OFF, cflags, errp); | |
748 | if (ret < 0) { | |
749 | goto fail; | |
750 | } | |
751 | ||
752 | /* Format the LUKS payload node */ | |
753 | if (luks_opts->file) { | |
754 | ret = block_crypto_co_format_luks_payload(luks_opts, errp); | |
755 | if (ret < 0) { | |
756 | goto fail; | |
757 | } | |
758 | } | |
759 | } else if (luks_opts->file) { | |
760 | /* LUKS volume with none-detached header */ | |
433957bb HH |
761 | bs = bdrv_co_open_blockdev_ref(luks_opts->file, errp); |
762 | if (bs == NULL) { | |
763 | return -EIO; | |
764 | } | |
765 | ||
766 | ret = block_crypto_co_create_generic(bs, luks_opts->size, &create_opts, | |
d0112eb4 | 767 | preallocation, cflags, errp); |
433957bb HH |
768 | if (ret < 0) { |
769 | goto fail; | |
770 | } | |
1bedcaf1 KW |
771 | } |
772 | ||
773 | ret = 0; | |
774 | fail: | |
d0112eb4 HH |
775 | if (hdr_bs != NULL) { |
776 | bdrv_co_unref(hdr_bs); | |
777 | } | |
778 | ||
779 | if (bs != NULL) { | |
780 | bdrv_co_unref(bs); | |
781 | } | |
1bedcaf1 KW |
782 | return ret; |
783 | } | |
784 | ||
4db7ba3b | 785 | static int coroutine_fn GRAPH_UNLOCKED |
4ec8df01 KW |
786 | block_crypto_co_create_opts_luks(BlockDriver *drv, const char *filename, |
787 | QemuOpts *opts, Error **errp) | |
78368575 | 788 | { |
1ec4f416 KW |
789 | QCryptoBlockCreateOptions *create_opts = NULL; |
790 | BlockDriverState *bs = NULL; | |
791 | QDict *cryptoopts; | |
672de729 ML |
792 | PreallocMode prealloc; |
793 | char *buf = NULL; | |
1ec4f416 | 794 | int64_t size; |
35286dae HH |
795 | bool detached_hdr = |
796 | qemu_opt_get_bool(opts, "detached-header", false); | |
797 | unsigned int cflags = 0; | |
1ec4f416 | 798 | int ret; |
672de729 | 799 | Error *local_err = NULL; |
1ec4f416 KW |
800 | |
801 | /* Parse options */ | |
802 | size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0); | |
803 | ||
672de729 ML |
804 | buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC); |
805 | prealloc = qapi_enum_parse(&PreallocMode_lookup, buf, | |
806 | PREALLOC_MODE_OFF, &local_err); | |
807 | g_free(buf); | |
808 | if (local_err) { | |
809 | error_propagate(errp, local_err); | |
810 | return -EINVAL; | |
811 | } | |
812 | ||
1ec4f416 KW |
813 | cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL, |
814 | &block_crypto_create_opts_luks, | |
815 | true); | |
816 | ||
796d3239 MA |
817 | qdict_put_str(cryptoopts, "format", "luks"); |
818 | create_opts = block_crypto_create_opts_init(cryptoopts, errp); | |
1ec4f416 KW |
819 | if (!create_opts) { |
820 | ret = -EINVAL; | |
821 | goto fail; | |
822 | } | |
823 | ||
824 | /* Create protocol layer */ | |
2475a0d0 | 825 | ret = bdrv_co_create_file(filename, opts, errp); |
1ec4f416 | 826 | if (ret < 0) { |
0b68589d | 827 | goto fail; |
1ec4f416 KW |
828 | } |
829 | ||
91817e9c KW |
830 | bs = bdrv_co_open(filename, NULL, NULL, |
831 | BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp); | |
1ec4f416 KW |
832 | if (!bs) { |
833 | ret = -EINVAL; | |
834 | goto fail; | |
835 | } | |
836 | ||
35286dae HH |
837 | if (detached_hdr) { |
838 | cflags |= QCRYPTO_BLOCK_CREATE_DETACHED; | |
839 | } | |
840 | ||
1ec4f416 | 841 | /* Create format layer */ |
d0112eb4 | 842 | ret = block_crypto_co_create_generic(bs, size, create_opts, |
35286dae | 843 | prealloc, cflags, errp); |
1ec4f416 KW |
844 | if (ret < 0) { |
845 | goto fail; | |
846 | } | |
847 | ||
848 | ret = 0; | |
849 | fail: | |
1bba30da DHB |
850 | /* |
851 | * If an error occurred, delete 'filename'. Even if the file existed | |
852 | * beforehand, it has been truncated and corrupted in the process. | |
853 | */ | |
a890f08e | 854 | if (ret) { |
4db7ba3b | 855 | bdrv_graph_co_rdlock(); |
a890f08e | 856 | bdrv_co_delete_file_noerr(bs); |
4db7ba3b | 857 | bdrv_graph_co_rdunlock(); |
1bba30da DHB |
858 | } |
859 | ||
b2ab5f54 | 860 | bdrv_co_unref(bs); |
1ec4f416 | 861 | qapi_free_QCryptoBlockCreateOptions(create_opts); |
cb3e7f08 | 862 | qobject_unref(cryptoopts); |
1ec4f416 | 863 | return ret; |
78368575 DB |
864 | } |
865 | ||
a00e70c0 | 866 | static int coroutine_fn GRAPH_RDLOCK |
3d47eb0a | 867 | block_crypto_co_get_info_luks(BlockDriverState *bs, BlockDriverInfo *bdi) |
c7c4cf49 DB |
868 | { |
869 | BlockDriverInfo subbdi; | |
870 | int ret; | |
871 | ||
3d47eb0a | 872 | ret = bdrv_co_get_info(bs->file->bs, &subbdi); |
c7c4cf49 DB |
873 | if (ret != 0) { |
874 | return ret; | |
875 | } | |
876 | ||
c7c4cf49 DB |
877 | bdi->cluster_size = subbdi.cluster_size; |
878 | ||
879 | return 0; | |
880 | } | |
881 | ||
882 | static ImageInfoSpecific * | |
1bf6e9ca | 883 | block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp) |
c7c4cf49 DB |
884 | { |
885 | BlockCrypto *crypto = bs->opaque; | |
886 | ImageInfoSpecific *spec_info; | |
887 | QCryptoBlockInfo *info; | |
888 | ||
1bf6e9ca | 889 | info = qcrypto_block_get_info(crypto->block, errp); |
c7c4cf49 DB |
890 | if (!info) { |
891 | return NULL; | |
892 | } | |
1bf6e9ca | 893 | assert(info->format == Q_CRYPTO_BLOCK_FORMAT_LUKS); |
c7c4cf49 DB |
894 | |
895 | spec_info = g_new(ImageInfoSpecific, 1); | |
896 | spec_info->type = IMAGE_INFO_SPECIFIC_KIND_LUKS; | |
897 | spec_info->u.luks.data = g_new(QCryptoBlockInfoLUKS, 1); | |
898 | *spec_info->u.luks.data = info->u.luks; | |
899 | ||
900 | /* Blank out pointers we've just stolen to avoid double free */ | |
901 | memset(&info->u.luks, 0, sizeof(info->u.luks)); | |
902 | ||
903 | qapi_free_QCryptoBlockInfo(info); | |
904 | ||
905 | return spec_info; | |
906 | } | |
907 | ||
3804e3cf | 908 | static int GRAPH_RDLOCK |
c1019d16 EGE |
909 | block_crypto_amend_prepare(BlockDriverState *bs, Error **errp) |
910 | { | |
911 | BlockCrypto *crypto = bs->opaque; | |
912 | int ret; | |
913 | ||
914 | /* apply for exclusive read/write permissions to the underlying file */ | |
915 | crypto->updating_keys = true; | |
916 | ret = bdrv_child_refresh_perms(bs, bs->file, errp); | |
917 | if (ret < 0) { | |
918 | /* Well, in this case we will not be updating any keys */ | |
919 | crypto->updating_keys = false; | |
920 | } | |
921 | return ret; | |
922 | } | |
923 | ||
3804e3cf | 924 | static void GRAPH_RDLOCK |
c1019d16 EGE |
925 | block_crypto_amend_cleanup(BlockDriverState *bs) |
926 | { | |
927 | BlockCrypto *crypto = bs->opaque; | |
928 | Error *errp = NULL; | |
929 | ||
930 | /* release exclusive read/write permissions to the underlying file */ | |
931 | crypto->updating_keys = false; | |
932 | bdrv_child_refresh_perms(bs, bs->file, &errp); | |
933 | ||
934 | if (errp) { | |
935 | error_report_err(errp); | |
936 | } | |
937 | } | |
938 | ||
bbfdae91 | 939 | static int |
30da9dd8 ML |
940 | block_crypto_amend_options_generic_luks(BlockDriverState *bs, |
941 | QCryptoBlockAmendOptions *amend_options, | |
942 | bool force, | |
943 | Error **errp) | |
bbfdae91 ML |
944 | { |
945 | BlockCrypto *crypto = bs->opaque; | |
bbfdae91 ML |
946 | |
947 | assert(crypto); | |
948 | assert(crypto->block); | |
bbfdae91 | 949 | |
dae84929 EGE |
950 | return qcrypto_block_amend_options(crypto->block, |
951 | block_crypto_read_func, | |
952 | block_crypto_write_func, | |
953 | bs, | |
954 | amend_options, | |
955 | force, | |
956 | errp); | |
30da9dd8 ML |
957 | } |
958 | ||
bd131d67 | 959 | static int GRAPH_RDLOCK |
30da9dd8 ML |
960 | block_crypto_amend_options_luks(BlockDriverState *bs, |
961 | QemuOpts *opts, | |
962 | BlockDriverAmendStatusCB *status_cb, | |
963 | void *cb_opaque, | |
964 | bool force, | |
965 | Error **errp) | |
966 | { | |
967 | BlockCrypto *crypto = bs->opaque; | |
968 | QDict *cryptoopts = NULL; | |
969 | QCryptoBlockAmendOptions *amend_options = NULL; | |
970 | int ret = -EINVAL; | |
971 | ||
972 | assert(crypto); | |
973 | assert(crypto->block); | |
974 | ||
975 | cryptoopts = qemu_opts_to_qdict(opts, NULL); | |
976 | qdict_put_str(cryptoopts, "format", "luks"); | |
977 | amend_options = block_crypto_amend_opts_init(cryptoopts, errp); | |
bbfdae91 | 978 | qobject_unref(cryptoopts); |
30da9dd8 ML |
979 | if (!amend_options) { |
980 | goto cleanup; | |
981 | } | |
dae84929 EGE |
982 | |
983 | ret = block_crypto_amend_prepare(bs, errp); | |
984 | if (ret) { | |
985 | goto perm_cleanup; | |
986 | } | |
30da9dd8 ML |
987 | ret = block_crypto_amend_options_generic_luks(bs, amend_options, |
988 | force, errp); | |
dae84929 EGE |
989 | |
990 | perm_cleanup: | |
991 | block_crypto_amend_cleanup(bs); | |
30da9dd8 ML |
992 | cleanup: |
993 | qapi_free_QCryptoBlockAmendOptions(amend_options); | |
bbfdae91 ML |
994 | return ret; |
995 | } | |
996 | ||
30da9dd8 ML |
997 | static int |
998 | coroutine_fn block_crypto_co_amend_luks(BlockDriverState *bs, | |
999 | BlockdevAmendOptions *opts, | |
1000 | bool force, | |
1001 | Error **errp) | |
1002 | { | |
1003 | QCryptoBlockAmendOptions amend_opts; | |
1004 | ||
1005 | amend_opts = (QCryptoBlockAmendOptions) { | |
1006 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
1007 | .u.luks = *qapi_BlockdevAmendOptionsLUKS_base(&opts->u.luks), | |
1008 | }; | |
1009 | return block_crypto_amend_options_generic_luks(bs, &amend_opts, | |
1010 | force, errp); | |
1011 | } | |
bbfdae91 ML |
1012 | |
1013 | static void | |
1014 | block_crypto_child_perms(BlockDriverState *bs, BdrvChild *c, | |
1015 | const BdrvChildRole role, | |
1016 | BlockReopenQueue *reopen_queue, | |
1017 | uint64_t perm, uint64_t shared, | |
1018 | uint64_t *nperm, uint64_t *nshared) | |
1019 | { | |
1020 | ||
1021 | BlockCrypto *crypto = bs->opaque; | |
1022 | ||
1023 | bdrv_default_perms(bs, c, role, reopen_queue, perm, shared, nperm, nshared); | |
1024 | ||
1025 | /* | |
1026 | * For backward compatibility, manually share the write | |
1027 | * and resize permission | |
1028 | */ | |
662d0c53 | 1029 | *nshared |= shared & (BLK_PERM_WRITE | BLK_PERM_RESIZE); |
bbfdae91 ML |
1030 | /* |
1031 | * Since we are not fully a format driver, don't always request | |
1032 | * the read/resize permission but only when explicitly | |
1033 | * requested | |
1034 | */ | |
1035 | *nperm &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE); | |
1036 | *nperm |= perm & (BLK_PERM_WRITE | BLK_PERM_RESIZE); | |
1037 | ||
1038 | /* | |
1039 | * This driver doesn't modify LUKS metadata except | |
1040 | * when updating the encryption slots. | |
1041 | * Thus unlike a proper format driver we don't ask for | |
1042 | * shared write/read permission. However we need it | |
1043 | * when we are updating the keys, to ensure that only we | |
1044 | * have access to the device. | |
1045 | * | |
1046 | * Encryption update will set the crypto->updating_keys | |
1047 | * during that period and refresh permissions | |
1048 | * | |
1049 | */ | |
1050 | if (crypto->updating_keys) { | |
1051 | /* need exclusive write access for header update */ | |
1052 | *nperm |= BLK_PERM_WRITE; | |
1053 | /* unshare read and write permission */ | |
1054 | *nshared &= ~(BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE); | |
1055 | } | |
1056 | } | |
1057 | ||
1058 | ||
2654267c HR |
1059 | static const char *const block_crypto_strong_runtime_opts[] = { |
1060 | BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET, | |
1061 | ||
1062 | NULL | |
1063 | }; | |
1064 | ||
782b9d06 | 1065 | static BlockDriver bdrv_crypto_luks = { |
78368575 DB |
1066 | .format_name = "luks", |
1067 | .instance_size = sizeof(BlockCrypto), | |
1068 | .bdrv_probe = block_crypto_probe_luks, | |
1069 | .bdrv_open = block_crypto_open_luks, | |
1070 | .bdrv_close = block_crypto_close, | |
bbfdae91 | 1071 | .bdrv_child_perm = block_crypto_child_perms, |
1bedcaf1 | 1072 | .bdrv_co_create = block_crypto_co_create_luks, |
efc75e2a | 1073 | .bdrv_co_create_opts = block_crypto_co_create_opts_luks, |
061ca8a3 | 1074 | .bdrv_co_truncate = block_crypto_co_truncate, |
78368575 | 1075 | .create_opts = &block_crypto_create_opts_luks, |
bbfdae91 | 1076 | .amend_opts = &block_crypto_amend_opts_luks, |
78368575 | 1077 | |
f87e08f9 | 1078 | .bdrv_reopen_prepare = block_crypto_reopen_prepare, |
a73466fb DB |
1079 | .bdrv_refresh_limits = block_crypto_refresh_limits, |
1080 | .bdrv_co_preadv = block_crypto_co_preadv, | |
1081 | .bdrv_co_pwritev = block_crypto_co_pwritev, | |
c86422c5 | 1082 | .bdrv_co_getlength = block_crypto_co_getlength, |
a9da6e49 | 1083 | .bdrv_measure = block_crypto_measure, |
3d47eb0a | 1084 | .bdrv_co_get_info = block_crypto_co_get_info_luks, |
c7c4cf49 | 1085 | .bdrv_get_specific_info = block_crypto_get_specific_info_luks, |
bbfdae91 | 1086 | .bdrv_amend_options = block_crypto_amend_options_luks, |
30da9dd8 | 1087 | .bdrv_co_amend = block_crypto_co_amend_luks, |
c1019d16 EGE |
1088 | .bdrv_amend_pre_run = block_crypto_amend_prepare, |
1089 | .bdrv_amend_clean = block_crypto_amend_cleanup, | |
2654267c | 1090 | |
d67066d8 HR |
1091 | .is_format = true, |
1092 | ||
2654267c | 1093 | .strong_runtime_opts = block_crypto_strong_runtime_opts, |
78368575 DB |
1094 | }; |
1095 | ||
1096 | static void block_crypto_init(void) | |
1097 | { | |
1098 | bdrv_register(&bdrv_crypto_luks); | |
1099 | } | |
1100 | ||
1101 | block_init(block_crypto_init); |