From nobody Tue Nov 26 10:39:44 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CF90205144; Fri, 18 Oct 2024 18:45:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729277106; cv=none; b=lQJzVyi1cq3azXqmtf5G5vxZSC7TceVczyBTUswleWbzxOsRgT9Brljjf3mwgWZGc1QiWCAklHWhu0yh8p+hemChPEJ5Vk4iLL75Onx/SNhbajcWc6h92Iob3+tqUAyRnJgyYp4XYmR77PnSJGsygAv4cNpaOVGo0yn9XF7tXYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729277106; c=relaxed/simple; bh=YNR1kvNbQQR1kTa73HYuLBTBit5Z481N6jlagYv4A1E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m/Cq7RUK5mu+RkDKfrh++B2dnXi+HZZPuiRy8mCx47ZoKSTG6NAG2MDrORBdEBzIAL8cLOT/fGCQhPw1VMqrkHm0vmP82BCvXyX48jjMlXVz31NekNRQ3J52caCDKyF3UO2pDaTjEDhS6GMZpgl3RrE37hHYNz7fz1vPPgZ/2wo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KRKQQW8p; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KRKQQW8p" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81C65C4CED1; Fri, 18 Oct 2024 18:45:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729277105; bh=YNR1kvNbQQR1kTa73HYuLBTBit5Z481N6jlagYv4A1E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KRKQQW8pEO/NABbHS2/S6tF5Ns6Wcw72l1verXHlkOoePWdGLdJx8YemyTbEt/Pgv HepukA82wKyk+MdSlXPl56iBaLN4U2bFo/OGI/itBj4m6x04iDmXyIQA64/CGkz97b kt9cLFHxKdH2tYNH8yKsnq0DTcva0/xmWKtq5ZRBhGypPEmj4htU/dobtSC+OVI+P5 MG297Q+M/Zvm4n63veOmdl77xA/P+0WZetY+kckUo2X5rLGPvyGKniwsfw18ufo0Mt qLQq3z72PMF5nKU6qZAeXcYbCqUFgb2F8TVux4Tx+i1Sm/LUpMtMEmj8Iu/E9cPRlF voVi9dUmmMysw== From: Eric Biggers To: dm-devel@lists.linux.dev Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fscrypt@vger.kernel.org, linux-ext4@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, Md Sadre Alam , Israel Rukshin , Milan Broz , Mikulas Patocka , Adrian Vovk Subject: [RFC PATCH 3/4] dm-default-key: add target for filesystem metadata encryption Date: Fri, 18 Oct 2024 11:43:38 -0700 Message-ID: <20241018184339.66601-4-ebiggers@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20241018184339.66601-1-ebiggers@kernel.org> References: <20241018184339.66601-1-ebiggers@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Eric Biggers Add a new device-mapper target "dm-default-key" that is similar to dm-crypt but has two main differences: - It uses the blk-crypto API instead of the regular crypto API. This allows it to take advantage of inline encryption hardware such as that commonly built into UFS host controllers. - It supports a passthrough flag, which will be used by ext4 and f2fs to avoid double encryption of encrypted files. In this setup, dm-default-key provides the "metadata encryption" layer. The table syntax matches dm-crypt's, but for now only a stripped-down set of parameters is supported. Signed-off-by: Eric Biggers --- drivers/md/Kconfig | 20 ++ drivers/md/Makefile | 1 + drivers/md/dm-default-key.c | 431 ++++++++++++++++++++++++++++++++++++ 3 files changed, 452 insertions(+) create mode 100644 drivers/md/dm-default-key.c diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index 1e9db8e4acdf6..a9f35a8efbade 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -268,10 +268,30 @@ config DM_CRYPT To compile this code as a module, choose M here: the module will be called dm-crypt. =20 If unsure, say N. =20 +config DM_DEFAULT_KEY + tristate "Default-key target support" + depends on BLK_DEV_DM + depends on BLK_INLINE_ENCRYPTION + # dm-default-key doesn't require -o inlinecrypt, but it does currently + # rely on the inline encryption hooks being built into the kernel. + depends on FS_ENCRYPTION_INLINE_CRYPT + help + This device-mapper target allows you to create a device that + assigns a default encryption key to bios that aren't for the + contents of an encrypted file. + + This ensures that all blocks on-disk will be encrypted with + some key, without the performance hit of file contents being + encrypted twice when fscrypt is used. + + It is only appropriate to use dm-default-key when key + configuration is tightly controlled such that all fscrypt keys + are at least as hard to compromise as the default key. + config DM_SNAPSHOT tristate "Snapshot target" depends on BLK_DEV_DM select DM_BUFIO help diff --git a/drivers/md/Makefile b/drivers/md/Makefile index 476a214e4bdc2..1dc4b20b506db 100644 --- a/drivers/md/Makefile +++ b/drivers/md/Makefile @@ -49,10 +49,11 @@ obj-$(CONFIG_BLK_DEV_DM) +=3D dm-mod.o obj-$(CONFIG_BLK_DEV_DM_BUILTIN) +=3D dm-builtin.o obj-$(CONFIG_DM_UNSTRIPED) +=3D dm-unstripe.o obj-$(CONFIG_DM_BUFIO) +=3D dm-bufio.o obj-$(CONFIG_DM_BIO_PRISON) +=3D dm-bio-prison.o obj-$(CONFIG_DM_CRYPT) +=3D dm-crypt.o +obj-$(CONFIG_DM_DEFAULT_KEY) +=3D dm-default-key.o obj-$(CONFIG_DM_DELAY) +=3D dm-delay.o obj-$(CONFIG_DM_DUST) +=3D dm-dust.o obj-$(CONFIG_DM_FLAKEY) +=3D dm-flakey.o obj-$(CONFIG_DM_MULTIPATH) +=3D dm-multipath.o dm-round-robin.o obj-$(CONFIG_DM_MULTIPATH_QL) +=3D dm-queue-length.o diff --git a/drivers/md/dm-default-key.c b/drivers/md/dm-default-key.c new file mode 100644 index 0000000000000..f5533418b4456 --- /dev/null +++ b/drivers/md/dm-default-key.c @@ -0,0 +1,431 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright 2024 Google LLC + */ + +#include +#include +#include + +#define DM_MSG_PREFIX "default-key" + +static const struct dm_default_key_cipher { + const char *name; + enum blk_crypto_mode_num mode_num; + int key_size; +} dm_default_key_ciphers[] =3D { + { + .name =3D "aes-xts-plain64", + .mode_num =3D BLK_ENCRYPTION_MODE_AES_256_XTS, + .key_size =3D 64, + }, { + .name =3D "xchacha12,aes-adiantum-plain64", + .mode_num =3D BLK_ENCRYPTION_MODE_ADIANTUM, + .key_size =3D 32, + }, +}; + +/** + * struct dm_default_c - private data of a default-key target + * @dev: the underlying device + * @start: starting sector of the range of @dev which this target actually= maps. + * For this purpose a "sector" is 512 bytes. + * @cipher_string: the name of the encryption algorithm being used + * @iv_offset: starting offset for IVs. IVs are generated as if the targe= t were + * preceded by @iv_offset 512-byte sectors. + * @sector_size: crypto sector size in bytes (usually 4096) + * @sector_bits: log2(sector_size) + * @key: the encryption key to use + * @max_dun: the maximum DUN that may be used (computed from other params) + */ +struct default_key_c { + struct dm_dev *dev; + sector_t start; + const char *cipher_string; + u64 iv_offset; + unsigned int sector_size; + unsigned int sector_bits; + struct blk_crypto_key key; + u64 max_dun; +}; + +static const struct dm_default_key_cipher * +lookup_cipher(const char *cipher_string) +{ + int i; + + for (i =3D 0; i < ARRAY_SIZE(dm_default_key_ciphers); i++) { + if (strcmp(cipher_string, dm_default_key_ciphers[i].name) =3D=3D 0) + return &dm_default_key_ciphers[i]; + } + return NULL; +} + +static void default_key_dtr(struct dm_target *ti) +{ + struct default_key_c *dkc =3D ti->private; + + if (dkc->dev) { + if (dkc->key.size) + blk_crypto_evict_key(dkc->dev->bdev, &dkc->key); + dm_put_device(ti, dkc->dev); + } + kfree_sensitive(dkc->cipher_string); + kfree_sensitive(dkc); +} + +static int default_key_ctr_optional(struct dm_target *ti, + unsigned int argc, char **argv) +{ + struct default_key_c *dkc =3D ti->private; + struct dm_arg_set as; + static const struct dm_arg _args[] =3D { + {0, 3, "Invalid number of feature args"}, + }; + unsigned int opt_params; + const char *opt_string; + bool iv_large_sectors =3D false; + char dummy; + int err; + + as.argc =3D argc; + as.argv =3D argv; + + err =3D dm_read_arg_group(_args, &as, &opt_params, &ti->error); + if (err) + return err; + + while (opt_params--) { + opt_string =3D dm_shift_arg(&as); + if (!opt_string) { + ti->error =3D "Not enough feature arguments"; + return -EINVAL; + } + if (!strcmp(opt_string, "allow_discards")) { + ti->num_discard_bios =3D 1; + } else if (sscanf(opt_string, "sector_size:%u%c", + &dkc->sector_size, &dummy) =3D=3D 1) { + if (dkc->sector_size < SECTOR_SIZE || + dkc->sector_size > 4096 || + !is_power_of_2(dkc->sector_size)) { + ti->error =3D "Invalid sector_size"; + return -EINVAL; + } + } else if (!strcmp(opt_string, "iv_large_sectors")) { + iv_large_sectors =3D true; + } else { + ti->error =3D "Invalid feature arguments"; + return -EINVAL; + } + } + + /* dm-default-key doesn't implement iv_large_sectors=3Dfalse. */ + if (dkc->sector_size !=3D SECTOR_SIZE && !iv_large_sectors) { + ti->error =3D "iv_large_sectors must be specified"; + return -EINVAL; + } + + return 0; +} + +/* + * Construct a default-key mapping: + * + * + * This syntax matches dm-crypt's, but the set of supported functionality = has + * been stripped down. + */ +static int default_key_ctr(struct dm_target *ti, unsigned int argc, char *= *argv) +{ + struct default_key_c *dkc; + const struct dm_default_key_cipher *cipher; + u8 raw_key[BLK_CRYPTO_MAX_KEY_SIZE]; + unsigned int dun_bytes; + unsigned long long tmpll; + char dummy; + int err; + + if (argc < 5) { + ti->error =3D "Not enough arguments"; + return -EINVAL; + } + + dkc =3D kzalloc(sizeof(*dkc), GFP_KERNEL); + if (!dkc) { + ti->error =3D "Out of memory"; + return -ENOMEM; + } + ti->private =3D dkc; + + /* */ + dkc->cipher_string =3D kstrdup(argv[0], GFP_KERNEL); + if (!dkc->cipher_string) { + ti->error =3D "Out of memory"; + err =3D -ENOMEM; + goto bad; + } + cipher =3D lookup_cipher(dkc->cipher_string); + if (!cipher) { + ti->error =3D "Unsupported cipher"; + err =3D -EINVAL; + goto bad; + } + + /* */ + if (strlen(argv[1]) !=3D 2 * cipher->key_size) { + ti->error =3D "Incorrect key size for cipher"; + err =3D -EINVAL; + goto bad; + } + if (hex2bin(raw_key, argv[1], cipher->key_size) !=3D 0) { + ti->error =3D "Malformed key string"; + err =3D -EINVAL; + goto bad; + } + + /* */ + if (sscanf(argv[2], "%llu%c", &dkc->iv_offset, &dummy) !=3D 1) { + ti->error =3D "Invalid iv_offset sector"; + err =3D -EINVAL; + goto bad; + } + + /* */ + err =3D dm_get_device(ti, argv[3], dm_table_get_mode(ti->table), + &dkc->dev); + if (err) { + ti->error =3D "Device lookup failed"; + goto bad; + } + + /* */ + if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) !=3D 1 || + tmpll !=3D (sector_t)tmpll) { + ti->error =3D "Invalid start sector"; + err =3D -EINVAL; + goto bad; + } + dkc->start =3D tmpll; + + if (bdev_is_zoned(dkc->dev->bdev)) { + /* + * dm-default-key needs proper sector numbers because they + * determine the IVs with which the data is encrypted. + */ + DMDEBUG("Zone append operations will be emulated"); + ti->emulate_zone_append =3D true; + } + + /* optional arguments */ + dkc->sector_size =3D SECTOR_SIZE; + if (argc > 5) { + err =3D default_key_ctr_optional(ti, argc - 5, &argv[5]); + if (err) + goto bad; + } + dkc->sector_bits =3D ilog2(dkc->sector_size); + if (ti->len & ((dkc->sector_size >> SECTOR_SHIFT) - 1)) { + ti->error =3D "Device size is not a multiple of sector_size"; + err =3D -EINVAL; + goto bad; + } + + dkc->max_dun =3D (dkc->iv_offset + ti->len - 1) >> + (dkc->sector_bits - SECTOR_SHIFT); + dun_bytes =3D DIV_ROUND_UP(fls64(dkc->max_dun), 8); + + err =3D blk_crypto_init_key(&dkc->key, raw_key, cipher->mode_num, + dun_bytes, dkc->sector_size); + if (err) { + ti->error =3D "Error initializing blk-crypto key"; + goto bad; + } + + err =3D blk_crypto_start_using_key(dkc->dev->bdev, &dkc->key); + if (err) { + ti->error =3D "Error starting to use blk-crypto"; + goto bad; + } + + ti->num_flush_bios =3D 1; + + err =3D 0; + goto out; + +bad: + default_key_dtr(ti); +out: + memzero_explicit(raw_key, sizeof(raw_key)); + return err; +} + +static int default_key_map(struct dm_target *ti, struct bio *bio) +{ + const struct default_key_c *dkc =3D ti->private; + sector_t sector_in_target; + u64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE] =3D {}; + + bio_set_dev(bio, dkc->dev->bdev); + + /* + * If the bio is a device-level request which doesn't target a specific + * sector, there's nothing more to do. + */ + if (bio_sectors(bio) =3D=3D 0) + return DM_MAPIO_REMAPPED; + + /* Map the bio's sector to the underlying device. (512-byte sectors) */ + sector_in_target =3D dm_target_offset(ti, bio->bi_iter.bi_sector); + bio->bi_iter.bi_sector =3D dkc->start + sector_in_target; + + /* + * If the bio should skip dm-default-key (i.e. if it's for an encrypted + * file's contents), or if it doesn't have any data (e.g. if it's a + * DISCARD request), there's nothing more to do. + */ + if (bio_should_skip_dm_default_key(bio) || !bio_has_data(bio)) + return DM_MAPIO_REMAPPED; + + /* + * Else, dm-default-key needs to set this bio's encryption context. + * It must not already have one. + */ + if (WARN_ON_ONCE(bio_has_crypt_ctx(bio))) + return DM_MAPIO_KILL; + + /* Calculate the DUN and enforce data-unit (crypto sector) alignment. */ + dun[0] =3D dkc->iv_offset + sector_in_target; /* 512-byte sectors */ + if (dun[0] & ((dkc->sector_size >> SECTOR_SHIFT) - 1)) + return DM_MAPIO_KILL; + dun[0] >>=3D dkc->sector_bits - SECTOR_SHIFT; /* crypto sectors */ + + /* + * This check isn't necessary as we should have calculated max_dun + * correctly, but be safe. + */ + if (WARN_ON_ONCE(dun[0] > dkc->max_dun)) + return DM_MAPIO_KILL; + + bio_crypt_set_ctx(bio, &dkc->key, dun, GFP_NOIO); + + return DM_MAPIO_REMAPPED; +} + +static void default_key_status(struct dm_target *ti, status_type_t type, + unsigned int status_flags, char *result, + unsigned int maxlen) +{ + const struct default_key_c *dkc =3D ti->private; + unsigned int sz =3D 0; + int num_feature_args =3D 0; + + switch (type) { + case STATUSTYPE_INFO: + case STATUSTYPE_IMA: + result[0] =3D '\0'; + break; + + case STATUSTYPE_TABLE: + /* Omit the key for now. */ + DMEMIT("%s - %llu %s %llu", dkc->cipher_string, dkc->iv_offset, + dkc->dev->name, (unsigned long long)dkc->start); + + num_feature_args +=3D !!ti->num_discard_bios; + if (dkc->sector_size !=3D SECTOR_SIZE) + num_feature_args +=3D 2; + if (num_feature_args !=3D 0) { + DMEMIT(" %d", num_feature_args); + if (ti->num_discard_bios) + DMEMIT(" allow_discards"); + if (dkc->sector_size !=3D SECTOR_SIZE) { + DMEMIT(" sector_size:%u", dkc->sector_size); + DMEMIT(" iv_large_sectors"); + } + } + break; + } +} + +static int default_key_prepare_ioctl(struct dm_target *ti, + struct block_device **bdev) +{ + const struct default_key_c *dkc =3D ti->private; + const struct dm_dev *dev =3D dkc->dev; + + *bdev =3D dev->bdev; + + /* Only pass ioctls through if the device sizes match exactly. */ + return dkc->start !=3D 0 || ti->len !=3D bdev_nr_sectors(dev->bdev); +} + +static int default_key_iterate_devices(struct dm_target *ti, + iterate_devices_callout_fn fn, + void *data) +{ + const struct default_key_c *dkc =3D ti->private; + + return fn(ti, dkc->dev, dkc->start, ti->len, data); +} + +#ifdef CONFIG_BLK_DEV_ZONED +static int default_key_report_zones(struct dm_target *ti, + struct dm_report_zones_args *args, + unsigned int nr_zones) +{ + const struct default_key_c *dkc =3D ti->private; + + return dm_report_zones(dkc->dev->bdev, dkc->start, + dkc->start + dm_target_offset(ti, args->next_sector), + args, nr_zones); +} +#else +#define default_key_report_zones NULL +#endif + +static void default_key_io_hints(struct dm_target *ti, + struct queue_limits *limits) +{ + const struct default_key_c *dkc =3D ti->private; + const unsigned int sector_size =3D dkc->sector_size; + + limits->logical_block_size =3D + max_t(unsigned int, limits->logical_block_size, sector_size); + limits->physical_block_size =3D + max_t(unsigned int, limits->physical_block_size, sector_size); + limits->io_min =3D max_t(unsigned int, limits->io_min, sector_size); + limits->dma_alignment =3D limits->logical_block_size - 1; +} + +static struct target_type default_key_target =3D { + .name =3D "default-key", + .version =3D {1, 0, 0}, + .features =3D DM_TARGET_PASSES_CRYPTO | DM_TARGET_ZONED_HM, + .module =3D THIS_MODULE, + .ctr =3D default_key_ctr, + .dtr =3D default_key_dtr, + .map =3D default_key_map, + .status =3D default_key_status, + .prepare_ioctl =3D default_key_prepare_ioctl, + .iterate_devices =3D default_key_iterate_devices, + .report_zones =3D default_key_report_zones, + .io_hints =3D default_key_io_hints, +}; + +static int __init dm_default_key_init(void) +{ + return dm_register_target(&default_key_target); +} + +static void __exit dm_default_key_exit(void) +{ + dm_unregister_target(&default_key_target); +} + +module_init(dm_default_key_init); +module_exit(dm_default_key_exit); + +MODULE_AUTHOR("Paul Lawrence "); +MODULE_AUTHOR("Paul Crowley "); +MODULE_AUTHOR("Eric Biggers "); +MODULE_DESCRIPTION(DM_NAME " target for encrypting filesystem metadata"); +MODULE_LICENSE("GPL"); --=20 2.47.0