From nobody Wed Jun 10 10:18:44 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7E753AE19C for ; Thu, 30 Apr 2026 09:52:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542774; cv=none; b=ExMbVNH05zL5tCrdgSp01ebEuRDhaJ8v8ZuG1tXr+zA2G2hfQlZBZx21+bNURAtbBgEiMMlLfp7+yHO29mR9K7coKrJbATZ5ieqOXUSKlM9h+9ImbkQX0EQdShch4ITK7p0OTMwCA3gwnYUeYdLgodKQxI0h37WF2miqkqfsT3Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542774; c=relaxed/simple; bh=BITlx4Kwj5eBbWFc9rslpJa2+01NebOQNTaEdmYUQ24=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FG40yJ1unVw1mmIRNrAUwQd3i+ehJutoI+WUCHOv56K7rKbM94uwAydOshTQHSV1ZHyVzpNkHKx0mLQ7dfeXp20b+S6R6MpLg/yTfIHIgcaLzO6G8gqrF/11lETiXbFIt1MsTc0QmC36HE9rD5B91t2pg8P+XGNfA5StpicVX5k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oSbuh1pA; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=Xoi8ekw4; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oSbuh1pA"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="Xoi8ekw4" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63U44ZF52099577 for ; Thu, 30 Apr 2026 09:52:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=uShH14l/dWy 0o1Tl9pcZPJ74mlezSCjEKQRN2uJbI/U=; b=oSbuh1pAGJ91dHqjDfdkld745fk rJ4pwOX/oiny1ZzD4IXWlYfluSgA1pF4Q5mFM3L9Tt0HSeokdiHs2e/2SbAcXoJe +fCh6ZZxdFzMx4RpQ0XkG4nPMDV08lTngW4b9nOg8sEcwaNI2dKYaPMV2e+ctWOt aVn52BulA0gMpQa8A3F9/P4f5YNA4LZKloEY8IKjN9do5IAiOFMdT1wBsnevATy6 zudetqWzgAaNi91otASJJvpg1OvxzONFfwWE4IbHFQaLaBo3Iq08aJR+AriRcjqv 4vozA2t8vM504AGBHfgJunANPyWpPVHiTdOGkjb7rcl6C5o28JwGOXaIb6w== Received: from mail-dy1-f199.google.com (mail-dy1-f199.google.com [74.125.82.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4duyr416jr-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 30 Apr 2026 09:52:52 +0000 (GMT) Received: by mail-dy1-f199.google.com with SMTP id 5a478bee46e88-2bda35eab74so680060eec.0 for ; Thu, 30 Apr 2026 02:52:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1777542771; x=1778147571; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uShH14l/dWy0o1Tl9pcZPJ74mlezSCjEKQRN2uJbI/U=; b=Xoi8ekw4Rmb0e1+QBVKQnKhqTQpscrKk8g/6EbqqaF4gfinPgCwv0SXjGjsPOE3Abu GA++/0oOCL/loYxan6E1Dzn+Vbf5vrR0N9wfJtjJ26L2Bdd4zTcqQTWxX0idUBEpBAue BhWwPs74raY1qRzK5SFTZwh8s6KvxOoOqhgCJ/QNQL75Ck+U6a5Z/0veEevRZY+j6OR3 kziCA30b3EkYGVjx7yJVctOF3ixLnavTnE3xApMsG4fFxmov8D1h7kbBfDJcbbQ1cWlL olGPsZkdZ6DPCAaBQNMd9r3vb77388WKvZoqMiaIS5SzqIgYKtC6HP87bZ0f8Cx0yXHW b2RA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777542771; x=1778147571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=uShH14l/dWy0o1Tl9pcZPJ74mlezSCjEKQRN2uJbI/U=; b=QGHHXmG0uIPft4JUcaxQjAvHo+iRCdpkkaYtDuNOSXm8VSyBEhWiLhnxGv/QlWNScR TZYuESNv1vL9VZdrXdaEdw6pscqMurUewKslUdbVEWipmOVaZKHUMVBG3T5eAqWNRwXN zndmJZlO1VOOzKpv1exUD5g9gMUhQkZTKzNQylxOlkmLUOZyWIc9UjDaz57N1vM7FJxU 806TvvZrqx//1vS/caPNyq1JdeIHPxsNe7tNZTbWkT6SqZ/MCKcnQDiDxtUePF+qtmE+ 8jiN6kHC1k6LL/cRYcapkB85OyVGMO562ifjL69k9f9p/G+4HEo5cgYy0U0n8k3Rq153 5HmQ== X-Gm-Message-State: AOJu0YwLi5k64uWDIC7qvk0J9iS10hg9o7Qp+txQ5/3xYq9o0fDY+uMK IH8dTxs0TS9eCP6unhY8qa9RQriKpVz7O5swMFDDsKv8dCIeOUYUsn3+HM69K6GJnejZDdnaBTb jnHySdxdzvxN6gB3/LzS4LZZJHksIicLHbJFO1aOZLzJtX27kTAxdANGPBvwcidlLlKk= X-Gm-Gg: AeBDiev1AUbyA3ezA0pQbpgg3wdc7R1FeTsDlQYe0cQgTvoFyIsg7NpkJioGleIn/d/ uAEFON2vHyDkjKmVBZhlTWxrxjrmnUshKPVdy7HOC0cQg4AZ3bpButHfK8AXYLd+ReUa6R0ipna ikv2XuoMYeIL4vDp4oNNyMIn2NLIiBfpopZzaIeRz42omj8t+ttQ1VkSKU+aYixXyhz/jya8Y7S 1IY3wF+ZkATt8Uk5IvlLsaIYQmd3tXmiwgy0GN/QIwxEGaDw+7CLf25G9ZPwli+K4Rz5Dk6q3ap LNbZyj+Gz6lo21Z9oBBdxVHrWWLj4kSyqT4Bsfyr21rl3fRcG3um7mb+OK0HHLV9jKiGGxuk0o/ 7n3zn2BYPIas8ZCYVOWT1Y+psCbct5SQ7Lu7Da8sPKsKj/CiqKNucdd3WBKkQA4bSDkZTeIBV+c oUX92BLIi0Tasf/bI= X-Received: by 2002:a05:7301:3c0c:b0:2ed:e16:6b38 with SMTP id 5a478bee46e88-2ed4f2e650cmr704624eec.16.1777542771165; Thu, 30 Apr 2026 02:52:51 -0700 (PDT) X-Received: by 2002:a05:7301:3c0c:b0:2ed:e16:6b38 with SMTP id 5a478bee46e88-2ed4f2e650cmr704612eec.16.1777542770669; Thu, 30 Apr 2026 02:52:50 -0700 (PDT) Received: from u20-san1p10573.qualcomm.com (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2ed1c0d218dsm5885804eec.27.2026.04.30.02.52.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Apr 2026 02:52:50 -0700 (PDT) From: Linlin Zhang To: linux-block@vger.kernel.org, ebiggers@kernel.org, mpatocka@redhat.com, gmazyland@gmail.com, bmarzins@redhat.com Cc: linux-kernel@vger.kernel.org, adrianvovk@gmail.com, dm-devel@lists.linux.dev, quic_mdalam@quicinc.com, israelr@nvidia.com, hch@infradead.org, axboe@kernel.dk Subject: [PATCH v3 1/3] block: export blk-crypto symbols required by dm-inlinecrypt Date: Thu, 30 Apr 2026 02:52:42 -0700 Message-Id: <20260430095244.3352446-2-linlin.zhang@oss.qualcomm.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> References: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=bJcm5v+Z c=1 sm=1 tr=0 ts=69f32674 cx=c_pps a=cFYjgdjTJScbgFmBucgdfQ==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=1XWaLZrsAAAA:8 a=pkKqxYWgxMMasECMkqIA:9 a=scEy_gLbYbu1JhEsrz4S:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDA5OSBTYWx0ZWRfX/tMp+VUfxE39 6x5hXoh3IketZHOwNzLIBCcyiwEb8pVcJZfHg+PeFNI5+XIoKJ6K/g7qjQDCiW+f7g2ZIsBpwCm oVefclsypNoWEipFVMzu7egls2+naTiu8OjcYdyYZ99CuTFpL++es6CR753BvNRsn3+nJxXSHx1 I7segUa8TdsuQaVdTCZDySLm3RJ7F/OjR3ehWjkmPmFW2u9U6esS98c1dPaj4B3mccac9QQwXMy mGWMkabB90cVt0oMpcw/rDOWorDYzcCQUI6KVmOy1nBz3rREB2+s0eKCTDjAOHA/V4E9v4OoWnJ Fn8E6LtVaYFMQEPU94ykCvteN4QF4dUxPPGu/k95UY5+BH3wpZsh7NYusGRAbdp9g+gqARD6KRI kRQK9mWiCRnJUNI6Tf13u+NHq98ZcZxOzxAHFj3jOWKBBcYsuvabi7AhTe6SQ5CwtM+de6W48n2 7Q2TViJUNTe5hGID9YQ== X-Proofpoint-GUID: VsKMahoqBsK1ImS8UGrBk8nFaYvlb6RK X-Proofpoint-ORIG-GUID: VsKMahoqBsK1ImS8UGrBk8nFaYvlb6RK X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 suspectscore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 phishscore=0 malwarescore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604200000 definitions=main-2604300099 Content-Type: text/plain; charset="utf-8" From: Eric Biggers bio_crypt_set_ctx(), blk_crypto_init_key(), and blk_crypto_start_using_key() are needed to use inline encryption; see Documentation/block/inline-encryption.rst. Export them so that dm-inlinecrypt can use them. The only reason these weren't exported before was that inline encryption was previously used only by fs/crypto/ which is built-in code. Signed-off-by: Eric Biggers --- block/blk-crypto.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/blk-crypto.c b/block/blk-crypto.c index 856d3c5b1fa0..40a99a859748 100644 --- a/block/blk-crypto.c +++ b/block/blk-crypto.c @@ -116,6 +116,7 @@ void bio_crypt_set_ctx(struct bio *bio, const struct bl= k_crypto_key *key, =20 bio->bi_crypt_context =3D bc; } +EXPORT_SYMBOL_GPL(bio_crypt_set_ctx); =20 void __bio_crypt_free_ctx(struct bio *bio) { @@ -349,6 +350,7 @@ int blk_crypto_init_key(struct blk_crypto_key *blk_key, =20 return 0; } +EXPORT_SYMBOL_GPL(blk_crypto_init_key); =20 bool blk_crypto_config_supported_natively(struct block_device *bdev, const struct blk_crypto_config *cfg) @@ -399,6 +401,7 @@ int blk_crypto_start_using_key(struct block_device *bde= v, } return blk_crypto_fallback_start_using_mode(key->crypto_cfg.crypto_mode); } +EXPORT_SYMBOL_GPL(blk_crypto_start_using_key); =20 /** * blk_crypto_evict_key() - Evict a blk_crypto_key from a block_device --=20 2.34.1 From nobody Wed Jun 10 10:18:44 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2DE63FF8BA for ; Thu, 30 Apr 2026 09:52:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542777; cv=none; b=EjmOh8L6czyUijGhOFCm7HGiHIpOJJ6RlpB0vXxHDgjlIfD6L1gw6l+UjZu9y59GIG3Lxs2tBChLCG2bGb/aWBySHM7vDzTz+mS29rW4RHmzuZJrLVStEBN5caB89lkH045e90xxT4SNT9h4nLLc62XWqOSMsWuoUtHhgCBNeMw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542777; c=relaxed/simple; bh=YF7mURPly9luEsPxd0rpKTFco4gAFRISoSHLxhzDTGs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=UCnMgP8zsXpbC59iFizRNzTQCF6MPSqmlGyJUhbbTVollCoLlAWOw6BW8DQ5v/crz0Ns/8IzP8hFg2CYc1U5RIX+MaqNjYZW0pCOOrOoxC92xxzAOlh0AOOBVl0U1yk/mrcQzk9cWRQTR81gCIH+5QN4/eclP5T6gcpd/N0a9zs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ka4CJ1Wo; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=eb2ZskhI; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ka4CJ1Wo"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="eb2ZskhI" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63U8F6VJ3636516 for ; Thu, 30 Apr 2026 09:52:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=P9J2qAFZbtJ tMoP6ap6YXCFw/ZbSjLrqCW/4CstPghA=; b=ka4CJ1WoR6wbSKINquA4bMpqL1F X3P8HJzIAc1XwYaBPagk1NJPbTAMUgrAgKRrYij0bhQKilyTYg2pS+sCzHCeWhdh pM1ZFYBR3yxnLEQ6cJVVFtvFTA074isbVuEM+8FKyKk9Gbdt13rqXSfMRsr5ynJu ZxSnpgN0ppWTNqe3mqa23+WLszb2GKNswELcubTLKICcAnvDpayhO5pdIRNEhGbe ZLnEXXslLy7xeE4Xa6CReFENH9ZgcS3zW1xHrMaldP7yMEKAasP04RfPiSCOVyTb HnW8XRmS6fPGKpv9f2VBGpo1E/M03956A6v1QdBXaiQX9vnHrVPHdJfGZ7A== Received: from mail-dy1-f198.google.com (mail-dy1-f198.google.com [74.125.82.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4duv3q1x73-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 30 Apr 2026 09:52:53 +0000 (GMT) Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-2da19227bc1so2846826eec.1 for ; Thu, 30 Apr 2026 02:52:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1777542772; x=1778147572; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=P9J2qAFZbtJtMoP6ap6YXCFw/ZbSjLrqCW/4CstPghA=; b=eb2ZskhI4Wpv9+PzB/fRxQ61/FWIOby4NJCxKkec9F1xuDx2ZF0IISfUgWoehanI5F 0BvFmHiMOp8SVg9ALRM1JcF33zoQ3bw6H+F1o4+E415X/xHsv7l5BCUWy0sW8RC9F1m4 +8jYrvVw8xlmaNCYQUBaVVKCHLWjMFvd7VF/joG/pXIx7/d9B+nK5mig4t0ckG7UGrtd UuyQdjIdS7QnJjOg5V2FGLAYmhjmwGBa+a9Dp+X6fXwm/yyzPgmH55hp1rT7TGL1PKFs +8Rt6v+3krY8/CLrcjDWyusA5zHSD8FnqsCOWRC/XjjJPJmHkv5RzfagLRLbTxTPquCf 33NQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777542772; x=1778147572; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=P9J2qAFZbtJtMoP6ap6YXCFw/ZbSjLrqCW/4CstPghA=; b=YRODS6KN58GB6oUaBZfwkXVBfB1LZ0RYU0F/QcgcFnT2M+e7/wY8kaL2Kc7o6CVuPV 7nYFJjisWCwlQVYnr5vp7amZnhUm0LyqAIGgMxLVAzSJhbb5xkwiqedY6kq/oqNzaq+W x+AxWTJJBRr1jvpPUQXOXsydqqHTfKrr5Osf8UH2htwOFTV2Y6KO/GYQK+fImK/W2e9m e0bWzaSH/wvmqo+5cBdHOAR+Sgn8aHr5zN/nv45zvzDILxvxU4/J3YeMghLW76cXHafu AXQn5RpYkGSTr2V0QtVLSSOMdedQt3xlwneeAA0JqIxmNaWOrYzxuZIVzlc2jT8W6QRn XOgw== X-Gm-Message-State: AOJu0Yw/tJtk6LPgyxth3ZlWg+tujCIp83tK8cxpEoSF+jN6+k3Uhgxy NUWJhCt9jENKOPEEofRhy41mSx0O0xp8YL4VML/zBwvxdSKFyOnYKPtFIb7AilggJ3o0xZI3UFQ 5A4XZvY4/ORWEEX0VBGIIYzJN+jRzrLRvObFyroSRhgLcq3KsRCp9gpxqQYuDTmrLAH+GoA9Bis U= X-Gm-Gg: AeBDiesbN2pzmEWzl+fVH9Dn5xGx7A8tKFGyl/ry+HvxlLlnCXA52Q7grDQr68Uuuoj MThGmfGsxuN8WKPpd1JhaZand549z5nHqQPs56gdMtL3EuUEhoVUapYy3nIw4z08q478Hg/en6c JozIQHS9zeX6XntImGJRk+1iR8AVwKoaP2ur10bdaneewg0vI+3h7tTejmTl1l05bfkCR2NU2uN eCIzE+k7tg1S3nyl3jCz1XVnOAy7RAB2u5TluXIF/TQ+Bdo9WRxzkPX0+ZuQ5u8xUv38VNJfAuF cw1TmfYN9ktcm27PiuW9Sa3zDIEcMjwKj9WsOW+k0SaoW4zB0MyOVxKKgQiV1dQIYg+UQ6CpSUy +ia0Lrl/6WhCQ/bbDLJ7QYom3vo10p2FmphB43RTz4ESTvxmxjopzW1P94aMyA6qYrBKXh2pFf6 VDWRRVw5rY3Trd8LU= X-Received: by 2002:a05:7301:5809:b0:2d2:129a:1682 with SMTP id 5a478bee46e88-2ed3dea4fc4mr943463eec.16.1777542772270; Thu, 30 Apr 2026 02:52:52 -0700 (PDT) X-Received: by 2002:a05:7301:5809:b0:2d2:129a:1682 with SMTP id 5a478bee46e88-2ed3dea4fc4mr943439eec.16.1777542771537; Thu, 30 Apr 2026 02:52:51 -0700 (PDT) Received: from u20-san1p10573.qualcomm.com (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2ed1c0d218dsm5885804eec.27.2026.04.30.02.52.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Apr 2026 02:52:51 -0700 (PDT) From: Linlin Zhang To: linux-block@vger.kernel.org, ebiggers@kernel.org, mpatocka@redhat.com, gmazyland@gmail.com, bmarzins@redhat.com Cc: linux-kernel@vger.kernel.org, adrianvovk@gmail.com, dm-devel@lists.linux.dev, quic_mdalam@quicinc.com, israelr@nvidia.com, hch@infradead.org, axboe@kernel.dk Subject: [PATCH v3 2/3] dm-inlinecrypt: add target for inline block device encryption Date: Thu, 30 Apr 2026 02:52:43 -0700 Message-Id: <20260430095244.3352446-3-linlin.zhang@oss.qualcomm.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> References: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: HcShEYsAS1WQukD4K_Q9O0Rk-ETc11WY X-Authority-Analysis: v=2.4 cv=dOyWXuZb c=1 sm=1 tr=0 ts=69f32675 cx=c_pps a=wEP8DlPgTf/vqF+yE6f9lg==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=1XWaLZrsAAAA:8 a=EUspDBNiAAAA:8 a=pgp9PnljQXxSUQaNOToA:9 a=bBxd6f-gb0O0v-kibOvt:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDA5OSBTYWx0ZWRfXwQ5SEWz/rVD5 a8RaKzwaSTDcH/RqCYPhtS2S8zGjd4feCy/eGK/Sokr35AANmCNOIMX3unAruBOpxo9bT6yTIMM wuKbAfht+7LM/Gou49/hWVSgKQpK1tUe4MP3cIEnlTTAfGzsPTVyPcqv1HNENLQ47QNN69Cf4Ta p4ziyCUKtKDlEw4SaBwg5xYgpGnCwNyjeaGys9Tn1i+Uo+ITXCTcJdDaZurwWg2CtLU2x1zSmmg XBzriYB8B6N7mG2RrzJ8i+8TP5urbAef2dByiRh2pBEg7OPwJev6/UDBUTD3tpHcJ0gjCwKCZht z7PQc+wXKxqdh+q6jiFeWWAkfbTop8XrtETycLBRcEkz03qpBq5BtB6VHy2ZTnuNfC0skZhafyi as1S9fhXjoCr89Si+ZvwcGRid5M89V2S+nJkXycOAD0HKql71f0Wql3qiZpkKReaxqCwn/+Ce5D 1qP0k3El1w9I3FQWkcA== X-Proofpoint-ORIG-GUID: HcShEYsAS1WQukD4K_Q9O0Rk-ETc11WY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 adultscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 priorityscore=1501 phishscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604200000 definitions=main-2604300099 Content-Type: text/plain; charset="utf-8" From: Eric Biggers Add a new device-mapper target "dm-inlinecrypt" that is similar to dm-crypt but uses the blk-crypto API instead of the regular crypto API. This allows it to take advantage of inline encryption hardware such as that commonly built into UFS host controllers. The table syntax matches dm-crypt's, but for now only a stripped-down set of parameters is supported. For example, for now AES-256-XTS is the only supported cipher. dm-inlinecrypt is based on Android's dm-default-key with the controversial passthrough support removed. Note that due to the removal of passthrough support, use of dm-inlinecrypt in combination with fscrypt causes double encryption of file contents (similar to dm-crypt + fscrypt), with the fscrypt layer not being able to use the inline encryption hardware. This makes dm-inlinecrypt unusable on systems such as Android that use fscrypt and where a more optimized approach is needed. It is however suitable as a replacement for dm-crypt. dm-inlinecrypt supports both keyring key and hex key, the former avoids the key to be exposed in dm-table message. Similar to dm-default-key in Android, it will fallabck to the software block crypto once the inline crypto hardware cannot support the expected cipher. Test: dmsetup create inlinecrypt_logon --table "0 `blockdev --getsz $1` \ inlinecrypt aes-xts-plain64 :64:logon:fde:dminlinecrypt_test_key 0 $1 0" Signed-off-by: Eric Biggers Signed-off-by: Linlin Zhang --- drivers/md/Kconfig | 11 + drivers/md/Makefile | 1 + drivers/md/dm-inlinecrypt.c | 596 ++++++++++++++++++++++++++++++++++++ 3 files changed, 608 insertions(+) create mode 100644 drivers/md/dm-inlinecrypt.c diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index c58a9a8ea54e..260c9c5e51bd 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -313,6 +313,17 @@ config DM_CRYPT =20 If unsure, say N. =20 +config DM_INLINECRYPT + tristate "Inline encryption target support" + depends on BLK_DEV_DM + depends on (KEYS || KEYS=3Dn) + depends on BLK_INLINE_ENCRYPTION + help + This device-mapper target is similar to dm-crypt, but it uses the + blk-crypto API instead of the regular crypto API. This allows it to + take advantage of inline encryption hardware such as that commonly + built into UFS host controllers. + config DM_SNAPSHOT tristate "Snapshot target" depends on BLK_DEV_DM diff --git a/drivers/md/Makefile b/drivers/md/Makefile index c338cc6fbe2e..517d1f7d8288 100644 --- a/drivers/md/Makefile +++ b/drivers/md/Makefile @@ -55,6 +55,7 @@ obj-$(CONFIG_DM_UNSTRIPED) +=3D dm-unstripe.o obj-$(CONFIG_DM_BUFIO) +=3D dm-bufio.o obj-$(CONFIG_DM_BIO_PRISON) +=3D dm-bio-prison.o obj-$(CONFIG_DM_CRYPT) +=3D dm-crypt.o +obj-$(CONFIG_DM_INLINECRYPT) +=3D dm-inlinecrypt.o obj-$(CONFIG_DM_DELAY) +=3D dm-delay.o obj-$(CONFIG_DM_DUST) +=3D dm-dust.o obj-$(CONFIG_DM_FLAKEY) +=3D dm-flakey.o diff --git a/drivers/md/dm-inlinecrypt.c b/drivers/md/dm-inlinecrypt.c new file mode 100644 index 000000000000..6f804f5a4be6 --- /dev/null +++ b/drivers/md/dm-inlinecrypt.c @@ -0,0 +1,596 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright 2024 Google LLC + */ + +#include +#include +#include +#include +#include +#include + +#define DM_MSG_PREFIX "inlinecrypt" + +static const struct dm_inlinecrypt_cipher { + const char *name; + enum blk_crypto_mode_num mode_num; +} dm_inlinecrypt_ciphers[] =3D { + { + .name =3D "aes-xts-plain64", + .mode_num =3D BLK_ENCRYPTION_MODE_AES_256_XTS, + }, +}; + +/** + * struct inlinecrypt_ctx - private data of an inlinecrypt target + * @dev: the underlying device + * @start: starting sector of the range of @dev which this target actually= maps. + * For this purpose a "sector" is 512 bytes. + * @cipher_string: the name of the encryption algorithm being used + * @iv_offset: starting offset for IVs. IVs are generated as if the targe= t were + * preceded by @iv_offset 512-byte sectors. + * @sector_size: crypto sector size in bytes (usually 4096) + * @sector_bits: log2(sector_size) + * @key: the encryption key to use + * @max_dun: the maximum DUN that may be used (computed from other params) + */ +struct inlinecrypt_ctx { + struct dm_dev *dev; + sector_t start; + const char *cipher_string; + unsigned int key_size; + u64 iv_offset; + unsigned int sector_size; + unsigned int sector_bits; + struct blk_crypto_key key; + u64 max_dun; +}; + +static const struct dm_inlinecrypt_cipher * +lookup_cipher(const char *cipher_string) +{ + int i; + + for (i =3D 0; i < ARRAY_SIZE(dm_inlinecrypt_ciphers); i++) { + if (strcmp(cipher_string, dm_inlinecrypt_ciphers[i].name) =3D=3D 0) + return &dm_inlinecrypt_ciphers[i]; + } + return NULL; +} + +static void inlinecrypt_dtr(struct dm_target *ti) +{ + struct inlinecrypt_ctx *ctx =3D ti->private; + + if (ctx->dev) { + if (ctx->key.size) + blk_crypto_evict_key(ctx->dev->bdev, &ctx->key); + dm_put_device(ti, ctx->dev); + } + kfree_sensitive(ctx->cipher_string); + kfree_sensitive(ctx); +} + +#ifdef CONFIG_KEYS + +static bool contains_whitespace(const char *str) +{ + while (*str) + if (isspace(*str++)) + return true; + return false; +} + +static int set_key_user(struct key *key, char *bin_key, + const unsigned int bin_key_size) +{ + const struct user_key_payload *ukp; + + ukp =3D user_key_payload_locked(key); + if (!ukp) + return -EKEYREVOKED; + + if (bin_key_size !=3D ukp->datalen) + return -EINVAL; + + memcpy(bin_key, ukp->data, bin_key_size); + + return 0; +} + +static int inlinecrypt_get_keyring_key(const char *key_string, u8 *bin_key, + const unsigned int bin_key_size) +{ + char *key_desc; + int ret; + struct key_type *type; + struct key *key; + int (*set_key)(struct key *key, char *bin_key, + const unsigned int bin_key_size); + + /* + * Reject key_string with whitespace. dm core currently lacks code for + * proper whitespace escaping in arguments on DM_TABLE_STATUS path. + */ + if (contains_whitespace(key_string)) { + DMERR("whitespace chars not allowed in key string"); + return -EINVAL; + } + + /* look for next ':' separating key_type from key_description */ + key_desc =3D strchr(key_string, ':'); + if (!key_desc || key_desc =3D=3D key_string || !strlen(key_desc + 1)) + return -EINVAL; + + if (!strncmp(key_string, "logon:", key_desc - key_string + 1)) { + type =3D &key_type_logon; + set_key =3D set_key_user; + } else { + return -EINVAL; + } + + key =3D request_key(type, key_desc + 1, NULL); + if (IS_ERR(key)) + return PTR_ERR(key); + + down_read(&key->sem); + + ret =3D set_key(key, (char *)bin_key, bin_key_size); + + up_read(&key->sem); + key_put(key); + + return ret; +} + +static int get_key_size(char **key_string) +{ + char *colon, dummy; + int ret; + + if (*key_string[0] !=3D ':') { + ret =3D strlen(*key_string); + + if (ret > 2 * BLK_CRYPTO_MAX_ANY_KEY_SIZE + || ret % 2 + || !ret) { + DMERR("Invalid keysize"); + return -EINVAL; + } + return ret >> 1; + } + + /* look for next ':' in key string */ + colon =3D strpbrk(*key_string + 1, ":"); + if (!colon) + return -EINVAL; + + if (sscanf(*key_string + 1, "%u%c", &ret, &dummy) !=3D 2 || dummy !=3D ':= ') + return -EINVAL; + + /* remaining key string should be :: */ + *key_string =3D colon; + + return ret; +} + +#else + +static int inlinecrypt_get_keyring_key(const char *key_string, u8 *bin_key, + const unsigned int bin_key_size) +{ + return -EINVAL; +} + +static int get_key_size(char **key_string) +{ + int key_hex_size =3D strlen(*key_string); + + if (*key_string[0] =3D=3D ':') + return -EINVAL; + + if (key_hex_size > 2 * BLK_CRYPTO_MAX_ANY_KEY_SIZE + || key_hex_size % 2 + || !key_hex_size) { + DMERR("Invalid keysize"); + return -EINVAL; + } + + return key_hex_size >> 1; +} + +#endif /* CONFIG_KEYS */ + +static int inlinecrypt_get_key(const char *key_string, + u8 key[BLK_CRYPTO_MAX_ANY_KEY_SIZE], + const unsigned int key_size) +{ + int ret =3D 0; + + if (key_size > BLK_CRYPTO_MAX_ANY_KEY_SIZE) { + DMERR("Invalid keysize"); + return -EINVAL; + } + + /* ':' means the key is in kernel keyring, short-circuit normal key proce= ssing */ + if (key_string[0] =3D=3D ':') { + /* key string should be :: */ + ret =3D inlinecrypt_get_keyring_key(key_string + 1, key, key_size); + goto out; + } + + if (hex2bin(key, key_string, key_size) !=3D 0) + ret =3D -EINVAL; + +out: + return ret; +} + +static int inlinecrypt_ctr_optional(struct dm_target *ti, + unsigned int argc, char **argv) +{ + struct inlinecrypt_ctx *ctx =3D ti->private; + struct dm_arg_set as; + static const struct dm_arg _args[] =3D { + {0, 3, "Invalid number of feature args"}, + }; + unsigned int opt_params; + const char *opt_string; + bool iv_large_sectors =3D false; + char dummy; + int err; + + as.argc =3D argc; + as.argv =3D argv; + + err =3D dm_read_arg_group(_args, &as, &opt_params, &ti->error); + if (err) + return err; + + while (opt_params--) { + opt_string =3D dm_shift_arg(&as); + if (!opt_string) { + ti->error =3D "Not enough feature arguments"; + return -EINVAL; + } + if (!strcmp(opt_string, "allow_discards")) { + ti->num_discard_bios =3D 1; + } else if (sscanf(opt_string, "sector_size:%u%c", + &ctx->sector_size, &dummy) =3D=3D 1) { + if (ctx->sector_size < SECTOR_SIZE || + ctx->sector_size > 4096 || + !is_power_of_2(ctx->sector_size)) { + ti->error =3D "Invalid sector_size"; + return -EINVAL; + } + } else if (!strcmp(opt_string, "iv_large_sectors")) { + iv_large_sectors =3D true; + } else { + ti->error =3D "Invalid feature arguments"; + return -EINVAL; + } + } + + /* dm-inlinecrypt doesn't implement iv_large_sectors=3Dfalse. */ + if (ctx->sector_size !=3D SECTOR_SIZE && !iv_large_sectors) { + ti->error =3D "iv_large_sectors must be specified"; + return -EINVAL; + } + + return 0; +} + +/* + * Construct an inlinecrypt mapping: + * [|:::] + * + * This syntax matches dm-crypt's, but the set of supported functionality = has + * been stripped down. + */ +static int inlinecrypt_ctr(struct dm_target *ti, unsigned int argc, char *= *argv) +{ + struct inlinecrypt_ctx *ctx; + const struct dm_inlinecrypt_cipher *cipher; + u8 raw_key[BLK_CRYPTO_MAX_ANY_KEY_SIZE]; + unsigned int dun_bytes; + unsigned long long tmpll; + char dummy; + int err; + + if (argc < 5) { + ti->error =3D "Not enough arguments"; + return -EINVAL; + } + + ctx =3D kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) { + ti->error =3D "Out of memory"; + return -ENOMEM; + } + ti->private =3D ctx; + + /* */ + ctx->cipher_string =3D kstrdup(argv[0], GFP_KERNEL); + if (!ctx->cipher_string) { + ti->error =3D "Out of memory"; + err =3D -ENOMEM; + goto bad; + } + cipher =3D lookup_cipher(ctx->cipher_string); + if (!cipher) { + ti->error =3D "Unsupported cipher"; + err =3D -EINVAL; + goto bad; + } + + /* */ + ctx->key_size =3D get_key_size(&argv[1]); + if (ctx->key_size < 0) { + ti->error =3D "Cannot parse key size"; + return -EINVAL; + } + err =3D inlinecrypt_get_key(argv[1], raw_key, ctx->key_size); + if (err) { + ti->error =3D "Malformed key string"; + goto bad; + } + + /* */ + if (sscanf(argv[2], "%llu%c", &ctx->iv_offset, &dummy) !=3D 1) { + ti->error =3D "Invalid iv_offset sector"; + err =3D -EINVAL; + goto bad; + } + + /* */ + err =3D dm_get_device(ti, argv[3], dm_table_get_mode(ti->table), + &ctx->dev); + if (err) { + ti->error =3D "Device lookup failed"; + goto bad; + } + + /* */ + if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) !=3D 1 || + tmpll !=3D (sector_t)tmpll) { + ti->error =3D "Invalid start sector"; + err =3D -EINVAL; + goto bad; + } + ctx->start =3D tmpll; + + /* optional arguments */ + ctx->sector_size =3D SECTOR_SIZE; + if (argc > 5) { + err =3D inlinecrypt_ctr_optional(ti, argc - 5, &argv[5]); + if (err) + goto bad; + } + ctx->sector_bits =3D ilog2(ctx->sector_size); + if (ti->len & ((ctx->sector_size >> SECTOR_SHIFT) - 1)) { + ti->error =3D "Device size is not a multiple of sector_size"; + err =3D -EINVAL; + goto bad; + } + if (ctx->iv_offset & ((ctx->sector_size >> SECTOR_SHIFT) - 1)) { + ti->error =3D "Wrong alignment of iv_offset sector"; + err =3D -EINVAL; + } + + ctx->max_dun =3D (ctx->iv_offset + ti->len - 1) >> + (ctx->sector_bits - SECTOR_SHIFT); + dun_bytes =3D DIV_ROUND_UP(fls64(ctx->max_dun), 8); + + err =3D blk_crypto_init_key(&ctx->key, raw_key, ctx->key_size, + BLK_CRYPTO_KEY_TYPE_RAW, + cipher->mode_num, dun_bytes, + ctx->sector_size); + if (err) { + ti->error =3D "Error initializing blk-crypto key"; + goto bad; + } + + err =3D blk_crypto_start_using_key(ctx->dev->bdev, &ctx->key); + if (err) { + ti->error =3D "Error starting to use blk-crypto"; + goto bad; + } + + ti->num_flush_bios =3D 1; + + err =3D 0; + goto out; + +bad: + inlinecrypt_dtr(ti); +out: + memzero_explicit(raw_key, sizeof(raw_key)); + return err; +} + +static int inlinecrypt_map(struct dm_target *ti, struct bio *bio) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + sector_t sector_in_target; + u64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE] =3D {}; + + bio_set_dev(bio, ctx->dev->bdev); + + /* + * If the bio is a device-level request which doesn't target a specific + * sector, there's nothing more to do. + */ + if (bio_sectors(bio) =3D=3D 0) + return DM_MAPIO_REMAPPED; + + /* + * The bio should never have an encryption context already, since + * dm-inlinecrypt doesn't pass through any inline encryption + * capabilities to the layer above it. + */ + if (WARN_ON_ONCE(bio_has_crypt_ctx(bio))) + return DM_MAPIO_KILL; + + /* Map the bio's sector to the underlying device. (512-byte sectors) */ + sector_in_target =3D dm_target_offset(ti, bio->bi_iter.bi_sector); + bio->bi_iter.bi_sector =3D ctx->start + sector_in_target; + /* + * If the bio doesn't have any data (e.g. if it's a DISCARD request), + * there's nothing more to do. + */ + if (!bio_has_data(bio)) + return DM_MAPIO_REMAPPED; + + /* Calculate the DUN and enforce data-unit (crypto sector) alignment. */ + dun[0] =3D ctx->iv_offset + sector_in_target; /* 512-byte sectors */ + if (dun[0] & ((ctx->sector_size >> SECTOR_SHIFT) - 1)) + return DM_MAPIO_KILL; + dun[0] >>=3D ctx->sector_bits - SECTOR_SHIFT; /* crypto sectors */ + + /* + * This check isn't necessary as we should have calculated max_dun + * correctly, but be safe. + */ + if (WARN_ON_ONCE(dun[0] > ctx->max_dun)) + return DM_MAPIO_KILL; + + bio_crypt_set_ctx(bio, &ctx->key, dun, GFP_NOIO); + + /* + * Since we've added an encryption context to the bio and + * blk-crypto-fallback may be needed to process it, it's necessary to + * use the fallback-aware bio submission code rather than + * unconditionally returning DM_MAPIO_REMAPPED. + * + * To get the correct accounting for a dm target in the case where + * __blk_crypto_submit_bio() doesn't take ownership of the bio (returns + * true), call __blk_crypto_submit_bio() directly and return + * DM_MAPIO_REMAPPED in that case, rather than relying on + * blk_crypto_submit_bio() which calls submit_bio() in that case. + * + * TODO: blk-crypto fallback write slow-path currently double-accounts + * IO in vmstat, as encrypted bios are submitted via submit_bio(). + * This does not affect data correctness. Consider fixing this if + * a cleaner accounting model for derived bios is introduced. + */ + if (__blk_crypto_submit_bio(bio)) + return DM_MAPIO_REMAPPED; + return DM_MAPIO_SUBMITTED; +} + +static void inlinecrypt_status(struct dm_target *ti, status_type_t type, + unsigned int status_flags, char *result, + unsigned int maxlen) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + unsigned int sz =3D 0; + int num_feature_args =3D 0; + + switch (type) { + case STATUSTYPE_INFO: + case STATUSTYPE_IMA: + result[0] =3D '\0'; + break; + + case STATUSTYPE_TABLE: + /* + * Warning: like dm-crypt, dm-inlinecrypt includes the key in + * the returned table. Userspace is responsible for redacting + * the key when needed. + */ + DMEMIT("%s %*phN %llu %s %llu", ctx->cipher_string, + ctx->key.size, ctx->key.bytes, ctx->iv_offset, + ctx->dev->name, ctx->start); + num_feature_args +=3D !!ti->num_discard_bios; + if (ctx->sector_size !=3D SECTOR_SIZE) + num_feature_args +=3D 2; + if (num_feature_args !=3D 0) { + DMEMIT(" %d", num_feature_args); + if (ti->num_discard_bios) + DMEMIT(" allow_discards"); + if (ctx->sector_size !=3D SECTOR_SIZE) { + DMEMIT(" sector_size:%u", ctx->sector_size); + DMEMIT(" iv_large_sectors"); + } + } + break; + } +} + +static int inlinecrypt_prepare_ioctl(struct dm_target *ti, + struct block_device **bdev, unsigned int cmd, + unsigned long arg, bool *forward) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + const struct dm_dev *dev =3D ctx->dev; + + *bdev =3D dev->bdev; + + /* Only pass ioctls through if the device sizes match exactly. */ + return ctx->start !=3D 0 || ti->len !=3D bdev_nr_sectors(dev->bdev); +} + +static int inlinecrypt_iterate_devices(struct dm_target *ti, + iterate_devices_callout_fn fn, + void *data) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + + return fn(ti, ctx->dev, ctx->start, ti->len, data); +} + +#ifdef CONFIG_BLK_DEV_ZONED +static int inlinecrypt_report_zones(struct dm_target *ti, + struct dm_report_zones_args *args, + unsigned int nr_zones) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + + return dm_report_zones(ctx->dev->bdev, ctx->start, + ctx->start + dm_target_offset(ti, args->next_sector), + args, nr_zones); +} +#else +#define inlinecrypt_report_zones NULL +#endif + +static void inlinecrypt_io_hints(struct dm_target *ti, + struct queue_limits *limits) +{ + const struct inlinecrypt_ctx *ctx =3D ti->private; + const unsigned int sector_size =3D ctx->sector_size; + + limits->logical_block_size =3D + max_t(unsigned int, limits->logical_block_size, sector_size); + limits->physical_block_size =3D + max_t(unsigned int, limits->physical_block_size, sector_size); + limits->io_min =3D max_t(unsigned int, limits->io_min, sector_size); + limits->dma_alignment =3D limits->logical_block_size - 1; +} + +static struct target_type inlinecrypt_target =3D { + .name =3D "inlinecrypt", + .version =3D {1, 0, 0}, + /* + * Do not set DM_TARGET_PASSES_CRYPTO, since dm-inlinecrypt consumes the + * crypto capability itself. + */ + .features =3D DM_TARGET_ZONED_HM, + .module =3D THIS_MODULE, + .ctr =3D inlinecrypt_ctr, + .dtr =3D inlinecrypt_dtr, + .map =3D inlinecrypt_map, + .status =3D inlinecrypt_status, + .prepare_ioctl =3D inlinecrypt_prepare_ioctl, + .iterate_devices =3D inlinecrypt_iterate_devices, + .report_zones =3D inlinecrypt_report_zones, + .io_hints =3D inlinecrypt_io_hints, +}; + +module_dm(inlinecrypt); + +MODULE_AUTHOR("Eric Biggers "); +MODULE_AUTHOR("Linlin Zhang "); +MODULE_DESCRIPTION(DM_NAME " target for inline encryption"); +MODULE_LICENSE("GPL"); --=20 2.34.1 From nobody Wed Jun 10 10:18:44 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 514283FFAB1 for ; Thu, 30 Apr 2026 09:52:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542777; cv=none; b=NdQMmpomWI04jne5B6nizx9muJEzEB81MUOPKaH/mRmuco76iaejcnYBaNgS4miWW8N/8ynVfjQ5Akej5sUasMh4LRTWX3myYbjSJolhZdV08DtxwR6b3rOuvsCmEmgtB+MHsbo15zvTHkc9euvJf6cfFl68YgbQ0QR/Or5SQJI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777542777; c=relaxed/simple; bh=oKEFlZ7j+cKtRBji8SO0Ip/DJfA6is5IIdXwt6HGb2A=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jNQOGIxGxCnhTQwsTVV2iYZjkRpx2v6EwKIn3bIBwV0JWUirq9XyPFhq3y05zOe0mtzWaGAenoGWoCL3o8EnkXT/oAGZvM6XWN+uJ1p1aRGQ/rUIJuBKXYYO242XH1KiNRDYzeFeOmJK6jm1AlXcIYY26B6XWz6IViwJ2VueWaw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=eEbBPJFd; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=QBpgCoiF; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="eEbBPJFd"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="QBpgCoiF" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63U75AQk830980 for ; Thu, 30 Apr 2026 09:52:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=lrYikL+96ns dg6Sdr1h2bfcZxEJEZfN5XyHVJwCmeaM=; b=eEbBPJFdhlNimEoeJIrVXbHT+Al G6aIO1ekVqLK8bATQY4QQJh9Zi20Gjzfzd7UI/MeiirMCdlUzSJDGG4QfvIDp8DP 5m96YMAn3GluzA7tz0Xc5UkIfF19vsKvVUNs8zMXT23G6uR8h+Y0YWPNkDpOzeBp Ieg5OsSHnY3uw9F/DAPMRksGVdsLr9Jjpa3xlsNZhmzVmQ4UPQrE1zJJxkObPmC+ pGFW2pIaYFE9vfSKtyxVFOU+P4d+Q0pv/p1vwhbTvJrjWcu9y8Qj7qIP+41TyLx2 +KtWujVXEal1ZNc3KFRR0kqX6ykp5GZTsEvieNWHyvVezSd8d99xKObFwdw== Received: from mail-dy1-f197.google.com (mail-dy1-f197.google.com [74.125.82.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4dv2cq0mwe-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 30 Apr 2026 09:52:54 +0000 (GMT) Received: by mail-dy1-f197.google.com with SMTP id 5a478bee46e88-2c0f6593ef5so1070953eec.1 for ; Thu, 30 Apr 2026 02:52:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1777542773; x=1778147573; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lrYikL+96nsdg6Sdr1h2bfcZxEJEZfN5XyHVJwCmeaM=; b=QBpgCoiF3jS4JJYmmEhh4msWsEsySVCRvJflrESAJS69EoDEqBKlOQYwxJCPgrw5r9 0EdbOPy0J5Q47N9HGuj+DCWFKXJ+FlGpS5em4M4uwoHpfuCnAv49nr/o46rr1MSYJeaF LrFdLiejYRH4xA/Dm7QOLMGiy5u847SFLM6097XSTpP74dbrAVjYOewFaLqLGxYO0m1k 9aS2vnV5y04FBY4/80b83SUSXGLkuKZCi2RvznzL5S0jq2zqzGLXfoYP8WxqgxCgchtt KimLnT6jdEg8FRcG2vl1p/juaD9g8YBzICSkWHeOOI5khk1DLwpgTkMZSNhegkPxs1eL hA/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777542773; x=1778147573; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=lrYikL+96nsdg6Sdr1h2bfcZxEJEZfN5XyHVJwCmeaM=; b=tP2MxFVrH5u7oHpvOPNGMGQzVayH7a0TcLlkcOmYlVLacce7vz+W71OlQr9FI8eabj B4pq3Q7IdYKtCoLE2kfG8rXsw7TlvJ/zsqjmIkh1scMqh+t+lcUSvnZ2ac8vYyW7Y3Ka z8OjpxBBy/u9dOl8097eHtqcTrvCCT7Q31Tzb2wivgbZOvXOAcbfxBGpjqSYXNyIFkrN yFvtFKCmw2FloO7CwrTJ2zu6/7w8fOQ5u+7favB9+2cA0zjIUbZ45O14itf/TwvjFOBZ 4mwNbWhE4wDDlp15ewzjxgaLCRH86h1NCw9l2zb/iTENrMtBs1yQ3YCJ95biO4FVadCG vd4g== X-Gm-Message-State: AOJu0YzPOgr3KHQCTkeiKPCpKpVCN2DVqBIfTagl2RmxWpasNbYD079H 9dA/fggJIodJPUH4LlrBg/N5IwcaCbNcJJwxyoWHNJlqv3m1cIkKIsmjJm0CJoMvmJUUJGXJWsq Kraspit5nglZXE8g3egP5m04tMuLyue73vCDe/o4CyMAZ0afwXCT+u/xPz2JbQcMt3pM= X-Gm-Gg: AeBDieuPz9pyx1GdlxuLou7ITE1GdHvoL9BjCFf1M4LF/qfZzBvvMB8d33ImfTRVXmL HxhZkxfbOm0aBoCDvGXaCSpWhkfnoAlMTZBC+kzho27w1heNu826lWtH14HXrl7HMmGeVxmME+G A/K2HSGfraWVhnYN5tsiWIsuifH7IxJx4xsZLzu8wU2ImsqeTBgdeELmmc7Mf/If7WZ0HIFn7/H 1nPWvSX8G/Bjqaoz9GT3y+G6ZlT4djZ54bNlQyW+1ATHaBdLYfsq/ZlKCSxza7DjZCo2sGmUCYN 2M4I/gXpDYDWfmIY3X9Ix0qV2ljt+6ps7SQBrtBd1EB1QMDGKr6OHU5DEaULiiMbzpG+b79IB92 VhGuzPMU7Apq8tc2aLWBlkRc+V1Wm1pIaQ7mkFamlKvCdQG7yfvgbhnBmLSzhJw2be7fRv1G19g ru6BhJhBh4jnCU5jQ= X-Received: by 2002:a05:7301:168f:b0:2c1:7793:7bbb with SMTP id 5a478bee46e88-2ed3e67f82dmr848272eec.27.1777542773038; Thu, 30 Apr 2026 02:52:53 -0700 (PDT) X-Received: by 2002:a05:7301:168f:b0:2c1:7793:7bbb with SMTP id 5a478bee46e88-2ed3e67f82dmr848258eec.27.1777542772331; Thu, 30 Apr 2026 02:52:52 -0700 (PDT) Received: from u20-san1p10573.qualcomm.com (i-global254.qualcomm.com. [199.106.103.254]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2ed1c0d218dsm5885804eec.27.2026.04.30.02.52.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Apr 2026 02:52:52 -0700 (PDT) From: Linlin Zhang To: linux-block@vger.kernel.org, ebiggers@kernel.org, mpatocka@redhat.com, gmazyland@gmail.com, bmarzins@redhat.com Cc: linux-kernel@vger.kernel.org, adrianvovk@gmail.com, dm-devel@lists.linux.dev, quic_mdalam@quicinc.com, israelr@nvidia.com, hch@infradead.org, axboe@kernel.dk Subject: [PATCH v3 3/3] dm: add documentation for dm-inlinecrypt target Date: Thu, 30 Apr 2026 02:52:44 -0700 Message-Id: <20260430095244.3352446-4-linlin.zhang@oss.qualcomm.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> References: <20260430095244.3352446-1-linlin.zhang@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: EOVqtpvKt7835ew37a3Y9O18kz5__4Kr X-Authority-Analysis: v=2.4 cv=aYRRWxot c=1 sm=1 tr=0 ts=69f32676 cx=c_pps a=Uww141gWH0fZj/3QKPojxA==:117 a=JYp8KDb2vCoCEuGobkYCKw==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=r5tAstHzX-DRmjCks68A:9 a=PxkB5W3o20Ba91AHUih5:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDMwMDA5OSBTYWx0ZWRfX3AyLAduvzy7P VFeq2JyxmCPrUhbqeaDDB9znhbAUq/QZDr/UV3DYcEvMaj86BHhq7HQncQ7Acb7EVJro6q1DGxw uW9WRidSuBcxnDMF/qIbQUBk/a6B62pGIXVnRLVPQvhVu8lyrLPulv1BRmWnIRFCeSKVSP4ormC hsuWt1pnp+KYy/YgF/pN+Gnrr3K51VSbsDP/vAhIFkcmpUp6M7E+wfPQt5DhklIMQ7qVlqL+PTZ RdVWkLwu3QyzPIvl9/vh3zglKOA+d3CHTd1Xicw+cKh6AAO77K5pLmfvHcpI66fw9t77fMr1mVl wjnaaFxvqsDnj8vN7Fl6n6ne+aah+pFzOF+WDQqf/Jj2SYhPAEzJxr3hYsWqDBLuH15Br4klUE7 J3uE53OjnjZ8JpbNMg5+WCglPf+MkHBBjbBDPNo7Qxu1RcIm5dCEpl/ikni6MyBpRKsPRcSUMMb 40rx9e2U15X62JGG8pQ== X-Proofpoint-ORIG-GUID: EOVqtpvKt7835ew37a3Y9O18kz5__4Kr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-30_03,2026-04-28_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 clxscore=1015 phishscore=0 spamscore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604200000 definitions=main-2604300099 Content-Type: text/plain; charset="utf-8" This adds the admin-guide documentation for dm-inlinecrypt. dm-inlinecrypt.rst is the guide to using dm-inlinecrypt. Signed-off-by: Linlin Zhang --- .../device-mapper/dm-inlinecrypt.rst | 123 ++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 Documentation/admin-guide/device-mapper/dm-inlinecrypt.= rst diff --git a/Documentation/admin-guide/device-mapper/dm-inlinecrypt.rst b/D= ocumentation/admin-guide/device-mapper/dm-inlinecrypt.rst new file mode 100644 index 000000000000..c71e600efb76 --- /dev/null +++ b/Documentation/admin-guide/device-mapper/dm-inlinecrypt.rst @@ -0,0 +1,123 @@ +=3D=3D=3D=3D=3D=3D=3D=3D +dm-inlinecrypt +=3D=3D=3D=3D=3D=3D=3D=3D + +Device-Mapper's "inlinecrypt" target provides transparent encryption of bl= ock devices +using the inline encryption hardware. + +For a more detailed description of inline encryption, see: +https://docs.kernel.org/block/inline-encryption.html + +Parameters:: + + \ + [<#opt_params> ] + + + Encryption cipher type. + + The cipher specifications format is:: + + cipher + + Examples:: + + aes-xts-plain64 + + The cipher type corresponds to the encryption modes supported by + inline crypto in the block layer. Currently, only + BLK_ENCRYPTION_MODE_AES_256_XTS (i.e. aes-xts-plain64) is supported. + + + Key used for encryption. It is encoded either as a hexadecimal number + or it can be passed as prefixed with single colon + character (':') for keys residing in kernel keyring service. + You can only use key sizes that are valid for the selected cipher. + Note that the size in bytes of a valid key must be in bellow range. + + [BLK_CRYPTO_KEY_TYPE_RAW, BLK_CRYPTO_KEY_TYPE_HW_WRAPPED] + + + The kernel keyring key is identified by string in following format: + ::. + + + The encryption key size in bytes. The kernel key payload size must mat= ch + the value passed in . + + + Either 'logon', or 'trusted' kernel key type. + + + The kernel keyring key description inlinecrypt target should look for + when loading key of . + + + The IV offset is a sector count that is added to the sector number + before creating the IV. + + + This is the device that is going to be used as backend and contains the + encrypted data. You can specify it as a path like /dev/xxx or a device + number :. + + + Starting sector within the device where the encrypted data begins. + +<#opt_params> + Number of optional parameters. If there are no optional parameters, + the optional parameters section can be skipped or #opt_params can be z= ero. + Otherwise #opt_params is the number of following arguments. + + Example of optional parameters section: + allow_discards sector_size:4096 iv_large_sectors + +allow_discards + Block discard requests (a.k.a. TRIM) are passed through the inlinecrypt + device. The default is to ignore discard requests. + + WARNING: Assess the specific security risks carefully before enabling = this + option. For example, allowing discards on encrypted devices may lead = to + the leak of information about the ciphertext device (filesystem type, + used space etc.) if the discarded blocks can be located easily on the + device later. + +sector_size: + Use as the encryption unit instead of 512 bytes sectors. + This option can be in range 512 - 4096 bytes and must be power of two. + Virtual device will announce this size as a minimal IO and logical sec= tor. + +iv_large_sectors + Use -based sector numbers for IV generation instead of + 512-byte sectors. + + For dm-inlinecrypt, this flag must be specified when + is larger than 512 bytes. The legacy 512-byte-based IV behavior is + not supported. + + When specified, if is 4096 bytes, plain64 IV for the + second sector will be 1, and must be a multiple of + (in 512-byte units). + +Example scripts +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +Currently, dm-inlinecrypt devices must be set up directly using dmsetup. +There is no userspace support yet to integrate dm-inlinecrypt with LUKS +or cryptsetup. In particular, cryptsetup currently only supports +dm-crypt, and cannot be used to create dm-inlinecrypt mappings. + +The following examples demonstrate how to create dm-inlinecrypt devices +using dmsetup + +:: + + #!/bin/sh + # Create a inlinecrypt device using dmsetup + dmsetup create inlinecrypt1 --table "0 `blockdev --getsz $1` inlinecrypt = aes-xts-plain64 babebabebabebabebabebabebabebabebabebabebabebabebabebabebab= ebabe 0 $1 0" + +:: + + #!/bin/sh + # Create a inlinecrypt device using dmsetup when encryption key is stored= in keyring service + dmsetup create inlinecrypt2 --table "0 `blockdev --getsz $1` inlinecrypt = aes-xts-plain64 :64:logon:fde:dminlinecrypt_test_key 0 $1 0" + --=20 2.34.1