]>
Commit | Line | Data |
---|---|---|
78368575 DB |
1 | /* |
2 | * QEMU block full disk encryption | |
3 | * | |
4 | * Copyright (c) 2015-2016 Red Hat, Inc. | |
5 | * | |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
9 | * version 2 of the License, or (at your option) any later version. | |
10 | * | |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. | |
18 | * | |
19 | */ | |
20 | ||
21 | #include "qemu/osdep.h" | |
22 | ||
23 | #include "block/block_int.h" | |
f853465a | 24 | #include "block/qdict.h" |
78368575 DB |
25 | #include "sysemu/block-backend.h" |
26 | #include "crypto/block.h" | |
27 | #include "qapi/opts-visitor.h" | |
9af23989 | 28 | #include "qapi/qapi-visit-crypto.h" |
306a06e5 | 29 | #include "qapi/qobject-input-visitor.h" |
78368575 | 30 | #include "qapi/error.h" |
0b8fa32f | 31 | #include "qemu/module.h" |
922a01a0 | 32 | #include "qemu/option.h" |
0d8c41da | 33 | #include "crypto.h" |
78368575 DB |
34 | |
35 | typedef struct BlockCrypto BlockCrypto; | |
36 | ||
37 | struct BlockCrypto { | |
38 | QCryptoBlock *block; | |
39 | }; | |
40 | ||
41 | ||
42 | static int block_crypto_probe_generic(QCryptoBlockFormat format, | |
43 | const uint8_t *buf, | |
44 | int buf_size, | |
45 | const char *filename) | |
46 | { | |
47 | if (qcrypto_block_has_format(format, buf, buf_size)) { | |
48 | return 100; | |
49 | } else { | |
50 | return 0; | |
51 | } | |
52 | } | |
53 | ||
54 | ||
55 | static ssize_t block_crypto_read_func(QCryptoBlock *block, | |
56 | size_t offset, | |
57 | uint8_t *buf, | |
58 | size_t buflen, | |
e4a3507e | 59 | void *opaque, |
37509233 | 60 | Error **errp) |
78368575 DB |
61 | { |
62 | BlockDriverState *bs = opaque; | |
63 | ssize_t ret; | |
64 | ||
cf2ab8fc | 65 | ret = bdrv_pread(bs->file, offset, buf, buflen); |
78368575 DB |
66 | if (ret < 0) { |
67 | error_setg_errno(errp, -ret, "Could not read encryption header"); | |
68 | return ret; | |
69 | } | |
70 | return ret; | |
71 | } | |
72 | ||
73 | ||
74 | struct BlockCryptoCreateData { | |
78368575 DB |
75 | BlockBackend *blk; |
76 | uint64_t size; | |
77 | }; | |
78 | ||
79 | ||
80 | static ssize_t block_crypto_write_func(QCryptoBlock *block, | |
81 | size_t offset, | |
82 | const uint8_t *buf, | |
83 | size_t buflen, | |
e4a3507e | 84 | void *opaque, |
37509233 | 85 | Error **errp) |
78368575 DB |
86 | { |
87 | struct BlockCryptoCreateData *data = opaque; | |
88 | ssize_t ret; | |
89 | ||
8341f00d | 90 | ret = blk_pwrite(data->blk, offset, buf, buflen, 0); |
78368575 DB |
91 | if (ret < 0) { |
92 | error_setg_errno(errp, -ret, "Could not write encryption header"); | |
93 | return ret; | |
94 | } | |
95 | return ret; | |
96 | } | |
97 | ||
98 | ||
99 | static ssize_t block_crypto_init_func(QCryptoBlock *block, | |
100 | size_t headerlen, | |
e4a3507e | 101 | void *opaque, |
37509233 | 102 | Error **errp) |
78368575 DB |
103 | { |
104 | struct BlockCryptoCreateData *data = opaque; | |
78368575 | 105 | |
3d7ed9c4 KW |
106 | if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) { |
107 | error_setg(errp, "The requested file size is too large"); | |
108 | return -EFBIG; | |
109 | } | |
110 | ||
78368575 DB |
111 | /* User provided size should reflect amount of space made |
112 | * available to the guest, so we must take account of that | |
113 | * which will be used by the crypto header | |
114 | */ | |
3b5a1f6a KW |
115 | return blk_truncate(data->blk, data->size + headerlen, PREALLOC_MODE_OFF, |
116 | errp); | |
78368575 DB |
117 | } |
118 | ||
119 | ||
120 | static QemuOptsList block_crypto_runtime_opts_luks = { | |
121 | .name = "crypto", | |
122 | .head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head), | |
123 | .desc = { | |
4a47f854 | 124 | BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""), |
78368575 DB |
125 | { /* end of list */ } |
126 | }, | |
127 | }; | |
128 | ||
129 | ||
130 | static QemuOptsList block_crypto_create_opts_luks = { | |
131 | .name = "crypto", | |
132 | .head = QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks.head), | |
133 | .desc = { | |
134 | { | |
135 | .name = BLOCK_OPT_SIZE, | |
136 | .type = QEMU_OPT_SIZE, | |
137 | .help = "Virtual disk size" | |
138 | }, | |
4a47f854 DB |
139 | BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""), |
140 | BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(""), | |
141 | BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(""), | |
142 | BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(""), | |
143 | BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(""), | |
144 | BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(""), | |
145 | BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""), | |
78368575 DB |
146 | { /* end of list */ } |
147 | }, | |
148 | }; | |
149 | ||
150 | ||
306a06e5 | 151 | QCryptoBlockOpenOptions * |
796d3239 | 152 | block_crypto_open_opts_init(QDict *opts, Error **errp) |
78368575 | 153 | { |
09204eac | 154 | Visitor *v; |
796d3239 | 155 | QCryptoBlockOpenOptions *ret; |
78368575 | 156 | |
796d3239 | 157 | v = qobject_input_visitor_new_flat_confused(opts, errp); |
e6af90f3 | 158 | if (!v) { |
796d3239 | 159 | return NULL; |
f853465a | 160 | } |
78368575 | 161 | |
796d3239 | 162 | visit_type_QCryptoBlockOpenOptions(v, NULL, &ret, errp); |
78368575 | 163 | |
09204eac | 164 | visit_free(v); |
78368575 DB |
165 | return ret; |
166 | } | |
167 | ||
168 | ||
306a06e5 | 169 | QCryptoBlockCreateOptions * |
796d3239 | 170 | block_crypto_create_opts_init(QDict *opts, Error **errp) |
78368575 | 171 | { |
09204eac | 172 | Visitor *v; |
796d3239 | 173 | QCryptoBlockCreateOptions *ret; |
78368575 | 174 | |
796d3239 | 175 | v = qobject_input_visitor_new_flat_confused(opts, errp); |
e6af90f3 | 176 | if (!v) { |
796d3239 | 177 | return NULL; |
f853465a | 178 | } |
78368575 | 179 | |
796d3239 | 180 | visit_type_QCryptoBlockCreateOptions(v, NULL, &ret, errp); |
78368575 | 181 | |
09204eac | 182 | visit_free(v); |
78368575 DB |
183 | return ret; |
184 | } | |
185 | ||
186 | ||
187 | static int block_crypto_open_generic(QCryptoBlockFormat format, | |
188 | QemuOptsList *opts_spec, | |
189 | BlockDriverState *bs, | |
190 | QDict *options, | |
191 | int flags, | |
192 | Error **errp) | |
193 | { | |
194 | BlockCrypto *crypto = bs->opaque; | |
195 | QemuOpts *opts = NULL; | |
196 | Error *local_err = NULL; | |
197 | int ret = -EINVAL; | |
198 | QCryptoBlockOpenOptions *open_opts = NULL; | |
199 | unsigned int cflags = 0; | |
306a06e5 | 200 | QDict *cryptoopts = NULL; |
78368575 | 201 | |
4e4bf5c4 KW |
202 | bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, |
203 | false, errp); | |
204 | if (!bs->file) { | |
205 | return -EINVAL; | |
206 | } | |
207 | ||
d67a6b09 DB |
208 | bs->supported_write_flags = BDRV_REQ_FUA & |
209 | bs->file->bs->supported_write_flags; | |
210 | ||
78368575 DB |
211 | opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort); |
212 | qemu_opts_absorb_qdict(opts, options, &local_err); | |
213 | if (local_err) { | |
214 | error_propagate(errp, local_err); | |
215 | goto cleanup; | |
216 | } | |
217 | ||
306a06e5 | 218 | cryptoopts = qemu_opts_to_qdict(opts, NULL); |
796d3239 | 219 | qdict_put_str(cryptoopts, "format", QCryptoBlockFormat_str(format)); |
306a06e5 | 220 | |
796d3239 | 221 | open_opts = block_crypto_open_opts_init(cryptoopts, errp); |
78368575 DB |
222 | if (!open_opts) { |
223 | goto cleanup; | |
224 | } | |
225 | ||
226 | if (flags & BDRV_O_NO_IO) { | |
227 | cflags |= QCRYPTO_BLOCK_OPEN_NO_IO; | |
228 | } | |
1cd9a787 | 229 | crypto->block = qcrypto_block_open(open_opts, NULL, |
78368575 DB |
230 | block_crypto_read_func, |
231 | bs, | |
232 | cflags, | |
c972fa12 | 233 | 1, |
78368575 DB |
234 | errp); |
235 | ||
236 | if (!crypto->block) { | |
237 | ret = -EIO; | |
238 | goto cleanup; | |
239 | } | |
240 | ||
54115412 | 241 | bs->encrypted = true; |
78368575 DB |
242 | |
243 | ret = 0; | |
244 | cleanup: | |
cb3e7f08 | 245 | qobject_unref(cryptoopts); |
78368575 DB |
246 | qapi_free_QCryptoBlockOpenOptions(open_opts); |
247 | return ret; | |
248 | } | |
249 | ||
250 | ||
1ec4f416 KW |
251 | static int block_crypto_co_create_generic(BlockDriverState *bs, |
252 | int64_t size, | |
253 | QCryptoBlockCreateOptions *opts, | |
254 | Error **errp) | |
78368575 | 255 | { |
1ec4f416 KW |
256 | int ret; |
257 | BlockBackend *blk; | |
78368575 | 258 | QCryptoBlock *crypto = NULL; |
1ec4f416 | 259 | struct BlockCryptoCreateData data; |
306a06e5 | 260 | |
d861ab3a KW |
261 | blk = blk_new(bdrv_get_aio_context(bs), |
262 | BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL); | |
78368575 | 263 | |
1ec4f416 | 264 | ret = blk_insert_bs(blk, bs, errp); |
3b5a1f6a | 265 | if (ret < 0) { |
1ec4f416 | 266 | goto cleanup; |
3b5a1f6a KW |
267 | } |
268 | ||
1ec4f416 KW |
269 | data = (struct BlockCryptoCreateData) { |
270 | .blk = blk, | |
271 | .size = size, | |
272 | }; | |
3b5a1f6a | 273 | |
1ec4f416 | 274 | crypto = qcrypto_block_create(opts, NULL, |
78368575 DB |
275 | block_crypto_init_func, |
276 | block_crypto_write_func, | |
277 | &data, | |
278 | errp); | |
279 | ||
280 | if (!crypto) { | |
281 | ret = -EIO; | |
282 | goto cleanup; | |
283 | } | |
284 | ||
285 | ret = 0; | |
286 | cleanup: | |
287 | qcrypto_block_free(crypto); | |
1ec4f416 | 288 | blk_unref(blk); |
78368575 DB |
289 | return ret; |
290 | } | |
291 | ||
061ca8a3 KW |
292 | static int coroutine_fn |
293 | block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, | |
294 | PreallocMode prealloc, Error **errp) | |
78368575 DB |
295 | { |
296 | BlockCrypto *crypto = bs->opaque; | |
31376555 | 297 | uint64_t payload_offset = |
78368575 | 298 | qcrypto_block_get_payload_offset(crypto->block); |
120bc742 KW |
299 | |
300 | if (payload_offset > INT64_MAX - offset) { | |
301 | error_setg(errp, "The requested file size is too large"); | |
302 | return -EFBIG; | |
303 | } | |
78368575 DB |
304 | |
305 | offset += payload_offset; | |
306 | ||
061ca8a3 | 307 | return bdrv_co_truncate(bs->file, offset, prealloc, errp); |
78368575 DB |
308 | } |
309 | ||
310 | static void block_crypto_close(BlockDriverState *bs) | |
311 | { | |
312 | BlockCrypto *crypto = bs->opaque; | |
313 | qcrypto_block_free(crypto->block); | |
314 | } | |
315 | ||
f87e08f9 DB |
316 | static int block_crypto_reopen_prepare(BDRVReopenState *state, |
317 | BlockReopenQueue *queue, Error **errp) | |
318 | { | |
319 | /* nothing needs checking */ | |
320 | return 0; | |
321 | } | |
78368575 | 322 | |
161253e2 DB |
323 | /* |
324 | * 1 MB bounce buffer gives good performance / memory tradeoff | |
325 | * when using cache=none|directsync. | |
326 | */ | |
327 | #define BLOCK_CRYPTO_MAX_IO_SIZE (1024 * 1024) | |
78368575 DB |
328 | |
329 | static coroutine_fn int | |
a73466fb DB |
330 | block_crypto_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes, |
331 | QEMUIOVector *qiov, int flags) | |
78368575 DB |
332 | { |
333 | BlockCrypto *crypto = bs->opaque; | |
a73466fb | 334 | uint64_t cur_bytes; /* number of bytes in current iteration */ |
78368575 DB |
335 | uint64_t bytes_done = 0; |
336 | uint8_t *cipher_data = NULL; | |
337 | QEMUIOVector hd_qiov; | |
338 | int ret = 0; | |
a73466fb DB |
339 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); |
340 | uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block); | |
a73466fb DB |
341 | |
342 | assert(!flags); | |
343 | assert(payload_offset < INT64_MAX); | |
344 | assert(QEMU_IS_ALIGNED(offset, sector_size)); | |
345 | assert(QEMU_IS_ALIGNED(bytes, sector_size)); | |
78368575 DB |
346 | |
347 | qemu_iovec_init(&hd_qiov, qiov->niov); | |
348 | ||
161253e2 DB |
349 | /* Bounce buffer because we don't wish to expose cipher text |
350 | * in qiov which points to guest memory. | |
78368575 DB |
351 | */ |
352 | cipher_data = | |
161253e2 | 353 | qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE, |
78368575 DB |
354 | qiov->size)); |
355 | if (cipher_data == NULL) { | |
356 | ret = -ENOMEM; | |
357 | goto cleanup; | |
358 | } | |
359 | ||
a73466fb DB |
360 | while (bytes) { |
361 | cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE); | |
78368575 DB |
362 | |
363 | qemu_iovec_reset(&hd_qiov); | |
a73466fb | 364 | qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes); |
78368575 | 365 | |
a73466fb DB |
366 | ret = bdrv_co_preadv(bs->file, payload_offset + offset + bytes_done, |
367 | cur_bytes, &hd_qiov, 0); | |
78368575 DB |
368 | if (ret < 0) { |
369 | goto cleanup; | |
370 | } | |
371 | ||
4609742a DB |
372 | if (qcrypto_block_decrypt(crypto->block, offset + bytes_done, |
373 | cipher_data, cur_bytes, NULL) < 0) { | |
78368575 DB |
374 | ret = -EIO; |
375 | goto cleanup; | |
376 | } | |
377 | ||
a73466fb | 378 | qemu_iovec_from_buf(qiov, bytes_done, cipher_data, cur_bytes); |
78368575 | 379 | |
a73466fb DB |
380 | bytes -= cur_bytes; |
381 | bytes_done += cur_bytes; | |
78368575 DB |
382 | } |
383 | ||
384 | cleanup: | |
385 | qemu_iovec_destroy(&hd_qiov); | |
386 | qemu_vfree(cipher_data); | |
387 | ||
388 | return ret; | |
389 | } | |
390 | ||
391 | ||
392 | static coroutine_fn int | |
a73466fb DB |
393 | block_crypto_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes, |
394 | QEMUIOVector *qiov, int flags) | |
78368575 DB |
395 | { |
396 | BlockCrypto *crypto = bs->opaque; | |
a73466fb | 397 | uint64_t cur_bytes; /* number of bytes in current iteration */ |
78368575 DB |
398 | uint64_t bytes_done = 0; |
399 | uint8_t *cipher_data = NULL; | |
400 | QEMUIOVector hd_qiov; | |
401 | int ret = 0; | |
a73466fb DB |
402 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); |
403 | uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block); | |
a73466fb | 404 | |
d67a6b09 | 405 | assert(!(flags & ~BDRV_REQ_FUA)); |
a73466fb DB |
406 | assert(payload_offset < INT64_MAX); |
407 | assert(QEMU_IS_ALIGNED(offset, sector_size)); | |
408 | assert(QEMU_IS_ALIGNED(bytes, sector_size)); | |
78368575 DB |
409 | |
410 | qemu_iovec_init(&hd_qiov, qiov->niov); | |
411 | ||
161253e2 DB |
412 | /* Bounce buffer because we're not permitted to touch |
413 | * contents of qiov - it points to guest memory. | |
78368575 DB |
414 | */ |
415 | cipher_data = | |
161253e2 | 416 | qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE, |
78368575 DB |
417 | qiov->size)); |
418 | if (cipher_data == NULL) { | |
419 | ret = -ENOMEM; | |
420 | goto cleanup; | |
421 | } | |
422 | ||
a73466fb DB |
423 | while (bytes) { |
424 | cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE); | |
78368575 | 425 | |
a73466fb | 426 | qemu_iovec_to_buf(qiov, bytes_done, cipher_data, cur_bytes); |
78368575 | 427 | |
4609742a DB |
428 | if (qcrypto_block_encrypt(crypto->block, offset + bytes_done, |
429 | cipher_data, cur_bytes, NULL) < 0) { | |
78368575 DB |
430 | ret = -EIO; |
431 | goto cleanup; | |
432 | } | |
433 | ||
434 | qemu_iovec_reset(&hd_qiov); | |
a73466fb | 435 | qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes); |
78368575 | 436 | |
a73466fb | 437 | ret = bdrv_co_pwritev(bs->file, payload_offset + offset + bytes_done, |
d67a6b09 | 438 | cur_bytes, &hd_qiov, flags); |
78368575 DB |
439 | if (ret < 0) { |
440 | goto cleanup; | |
441 | } | |
442 | ||
a73466fb DB |
443 | bytes -= cur_bytes; |
444 | bytes_done += cur_bytes; | |
78368575 DB |
445 | } |
446 | ||
447 | cleanup: | |
448 | qemu_iovec_destroy(&hd_qiov); | |
449 | qemu_vfree(cipher_data); | |
450 | ||
451 | return ret; | |
452 | } | |
453 | ||
a73466fb DB |
454 | static void block_crypto_refresh_limits(BlockDriverState *bs, Error **errp) |
455 | { | |
456 | BlockCrypto *crypto = bs->opaque; | |
457 | uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block); | |
458 | bs->bl.request_alignment = sector_size; /* No sub-sector I/O */ | |
459 | } | |
460 | ||
78368575 DB |
461 | |
462 | static int64_t block_crypto_getlength(BlockDriverState *bs) | |
463 | { | |
464 | BlockCrypto *crypto = bs->opaque; | |
465 | int64_t len = bdrv_getlength(bs->file->bs); | |
466 | ||
31376555 DB |
467 | uint64_t offset = qcrypto_block_get_payload_offset(crypto->block); |
468 | assert(offset < INT64_MAX); | |
e39e959e KW |
469 | |
470 | if (offset > len) { | |
471 | return -EIO; | |
472 | } | |
78368575 DB |
473 | |
474 | len -= offset; | |
475 | ||
476 | return len; | |
477 | } | |
478 | ||
479 | ||
480 | static int block_crypto_probe_luks(const uint8_t *buf, | |
481 | int buf_size, | |
482 | const char *filename) { | |
483 | return block_crypto_probe_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
484 | buf, buf_size, filename); | |
485 | } | |
486 | ||
487 | static int block_crypto_open_luks(BlockDriverState *bs, | |
488 | QDict *options, | |
489 | int flags, | |
490 | Error **errp) | |
491 | { | |
492 | return block_crypto_open_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
493 | &block_crypto_runtime_opts_luks, | |
494 | bs, options, flags, errp); | |
495 | } | |
496 | ||
1bedcaf1 KW |
497 | static int coroutine_fn |
498 | block_crypto_co_create_luks(BlockdevCreateOptions *create_options, Error **errp) | |
499 | { | |
500 | BlockdevCreateOptionsLUKS *luks_opts; | |
501 | BlockDriverState *bs = NULL; | |
502 | QCryptoBlockCreateOptions create_opts; | |
503 | int ret; | |
504 | ||
505 | assert(create_options->driver == BLOCKDEV_DRIVER_LUKS); | |
506 | luks_opts = &create_options->u.luks; | |
507 | ||
508 | bs = bdrv_open_blockdev_ref(luks_opts->file, errp); | |
509 | if (bs == NULL) { | |
510 | return -EIO; | |
511 | } | |
512 | ||
513 | create_opts = (QCryptoBlockCreateOptions) { | |
514 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
515 | .u.luks = *qapi_BlockdevCreateOptionsLUKS_base(luks_opts), | |
516 | }; | |
517 | ||
518 | ret = block_crypto_co_create_generic(bs, luks_opts->size, &create_opts, | |
519 | errp); | |
520 | if (ret < 0) { | |
521 | goto fail; | |
522 | } | |
523 | ||
524 | ret = 0; | |
525 | fail: | |
526 | bdrv_unref(bs); | |
527 | return ret; | |
528 | } | |
529 | ||
efc75e2a SH |
530 | static int coroutine_fn block_crypto_co_create_opts_luks(const char *filename, |
531 | QemuOpts *opts, | |
532 | Error **errp) | |
78368575 | 533 | { |
1ec4f416 KW |
534 | QCryptoBlockCreateOptions *create_opts = NULL; |
535 | BlockDriverState *bs = NULL; | |
536 | QDict *cryptoopts; | |
537 | int64_t size; | |
538 | int ret; | |
539 | ||
540 | /* Parse options */ | |
541 | size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0); | |
542 | ||
543 | cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL, | |
544 | &block_crypto_create_opts_luks, | |
545 | true); | |
546 | ||
796d3239 MA |
547 | qdict_put_str(cryptoopts, "format", "luks"); |
548 | create_opts = block_crypto_create_opts_init(cryptoopts, errp); | |
1ec4f416 KW |
549 | if (!create_opts) { |
550 | ret = -EINVAL; | |
551 | goto fail; | |
552 | } | |
553 | ||
554 | /* Create protocol layer */ | |
555 | ret = bdrv_create_file(filename, opts, errp); | |
556 | if (ret < 0) { | |
0b68589d | 557 | goto fail; |
1ec4f416 KW |
558 | } |
559 | ||
560 | bs = bdrv_open(filename, NULL, NULL, | |
561 | BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp); | |
562 | if (!bs) { | |
563 | ret = -EINVAL; | |
564 | goto fail; | |
565 | } | |
566 | ||
567 | /* Create format layer */ | |
568 | ret = block_crypto_co_create_generic(bs, size, create_opts, errp); | |
569 | if (ret < 0) { | |
570 | goto fail; | |
571 | } | |
572 | ||
573 | ret = 0; | |
574 | fail: | |
575 | bdrv_unref(bs); | |
576 | qapi_free_QCryptoBlockCreateOptions(create_opts); | |
cb3e7f08 | 577 | qobject_unref(cryptoopts); |
1ec4f416 | 578 | return ret; |
78368575 DB |
579 | } |
580 | ||
c7c4cf49 DB |
581 | static int block_crypto_get_info_luks(BlockDriverState *bs, |
582 | BlockDriverInfo *bdi) | |
583 | { | |
584 | BlockDriverInfo subbdi; | |
585 | int ret; | |
586 | ||
587 | ret = bdrv_get_info(bs->file->bs, &subbdi); | |
588 | if (ret != 0) { | |
589 | return ret; | |
590 | } | |
591 | ||
592 | bdi->unallocated_blocks_are_zero = false; | |
c7c4cf49 DB |
593 | bdi->cluster_size = subbdi.cluster_size; |
594 | ||
595 | return 0; | |
596 | } | |
597 | ||
598 | static ImageInfoSpecific * | |
1bf6e9ca | 599 | block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp) |
c7c4cf49 DB |
600 | { |
601 | BlockCrypto *crypto = bs->opaque; | |
602 | ImageInfoSpecific *spec_info; | |
603 | QCryptoBlockInfo *info; | |
604 | ||
1bf6e9ca | 605 | info = qcrypto_block_get_info(crypto->block, errp); |
c7c4cf49 DB |
606 | if (!info) { |
607 | return NULL; | |
608 | } | |
1bf6e9ca | 609 | assert(info->format == Q_CRYPTO_BLOCK_FORMAT_LUKS); |
c7c4cf49 DB |
610 | |
611 | spec_info = g_new(ImageInfoSpecific, 1); | |
612 | spec_info->type = IMAGE_INFO_SPECIFIC_KIND_LUKS; | |
613 | spec_info->u.luks.data = g_new(QCryptoBlockInfoLUKS, 1); | |
614 | *spec_info->u.luks.data = info->u.luks; | |
615 | ||
616 | /* Blank out pointers we've just stolen to avoid double free */ | |
617 | memset(&info->u.luks, 0, sizeof(info->u.luks)); | |
618 | ||
619 | qapi_free_QCryptoBlockInfo(info); | |
620 | ||
621 | return spec_info; | |
622 | } | |
623 | ||
2654267c HR |
624 | static const char *const block_crypto_strong_runtime_opts[] = { |
625 | BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET, | |
626 | ||
627 | NULL | |
628 | }; | |
629 | ||
782b9d06 | 630 | static BlockDriver bdrv_crypto_luks = { |
78368575 DB |
631 | .format_name = "luks", |
632 | .instance_size = sizeof(BlockCrypto), | |
633 | .bdrv_probe = block_crypto_probe_luks, | |
634 | .bdrv_open = block_crypto_open_luks, | |
635 | .bdrv_close = block_crypto_close, | |
497da823 FZ |
636 | /* This driver doesn't modify LUKS metadata except when creating image. |
637 | * Allow share-rw=on as a special case. */ | |
638 | .bdrv_child_perm = bdrv_filter_default_perms, | |
1bedcaf1 | 639 | .bdrv_co_create = block_crypto_co_create_luks, |
efc75e2a | 640 | .bdrv_co_create_opts = block_crypto_co_create_opts_luks, |
061ca8a3 | 641 | .bdrv_co_truncate = block_crypto_co_truncate, |
78368575 DB |
642 | .create_opts = &block_crypto_create_opts_luks, |
643 | ||
f87e08f9 | 644 | .bdrv_reopen_prepare = block_crypto_reopen_prepare, |
a73466fb DB |
645 | .bdrv_refresh_limits = block_crypto_refresh_limits, |
646 | .bdrv_co_preadv = block_crypto_co_preadv, | |
647 | .bdrv_co_pwritev = block_crypto_co_pwritev, | |
78368575 | 648 | .bdrv_getlength = block_crypto_getlength, |
c7c4cf49 DB |
649 | .bdrv_get_info = block_crypto_get_info_luks, |
650 | .bdrv_get_specific_info = block_crypto_get_specific_info_luks, | |
2654267c HR |
651 | |
652 | .strong_runtime_opts = block_crypto_strong_runtime_opts, | |
78368575 DB |
653 | }; |
654 | ||
655 | static void block_crypto_init(void) | |
656 | { | |
657 | bdrv_register(&bdrv_crypto_luks); | |
658 | } | |
659 | ||
660 | block_init(block_crypto_init); |