| // SPDX-License-Identifier: GPL-2.0 |
| /* |
| * Copyright 2019 Google LLC |
| */ |
| |
| /* |
| * Refer to Documentation/block/inline-encryption.rst for detailed explanation. |
| */ |
| |
| #define pr_fmt(fmt) "blk-crypto-fallback: " fmt |
| |
| #include <crypto/skcipher.h> |
| #include <linux/blk-cgroup.h> |
| #include <linux/blk-crypto.h> |
| #include <linux/blkdev.h> |
| #include <linux/crypto.h> |
| #include <linux/keyslot-manager.h> |
| #include <linux/mempool.h> |
| #include <linux/module.h> |
| #include <linux/random.h> |
| |
| #include "blk-crypto-internal.h" |
| |
| static unsigned int num_prealloc_bounce_pg = 32; |
| module_param(num_prealloc_bounce_pg, uint, 0); |
| MODULE_PARM_DESC(num_prealloc_bounce_pg, |
| "Number of preallocated bounce pages for the blk-crypto crypto API fallback"); |
| |
| static unsigned int blk_crypto_num_keyslots = 100; |
| module_param_named(num_keyslots, blk_crypto_num_keyslots, uint, 0); |
| MODULE_PARM_DESC(num_keyslots, |
| "Number of keyslots for the blk-crypto crypto API fallback"); |
| |
| static unsigned int num_prealloc_fallback_crypt_ctxs = 128; |
| module_param(num_prealloc_fallback_crypt_ctxs, uint, 0); |
| MODULE_PARM_DESC(num_prealloc_crypt_fallback_ctxs, |
| "Number of preallocated bio fallback crypto contexts for blk-crypto to use during crypto API fallback"); |
| |
| struct bio_fallback_crypt_ctx { |
| struct bio_crypt_ctx crypt_ctx; |
| /* |
| * Copy of the bvec_iter when this bio was submitted. |
| * We only want to en/decrypt the part of the bio as described by the |
| * bvec_iter upon submission because bio might be split before being |
| * resubmitted |
| */ |
| struct bvec_iter crypt_iter; |
| union { |
| struct { |
| struct work_struct work; |
| struct bio *bio; |
| }; |
| struct { |
| void *bi_private_orig; |
| bio_end_io_t *bi_end_io_orig; |
| }; |
| }; |
| }; |
| |
| static struct kmem_cache *bio_fallback_crypt_ctx_cache; |
| static mempool_t *bio_fallback_crypt_ctx_pool; |
| |
| /* |
| * Allocating a crypto tfm during I/O can deadlock, so we have to preallocate |
| * all of a mode's tfms when that mode starts being used. Since each mode may |
| * need all the keyslots at some point, each mode needs its own tfm for each |
| * keyslot; thus, a keyslot may contain tfms for multiple modes. However, to |
| * match the behavior of real inline encryption hardware (which only supports a |
| * single encryption context per keyslot), we only allow one tfm per keyslot to |
| * be used at a time - the rest of the unused tfms have their keys cleared. |
| */ |
| static DEFINE_MUTEX(tfms_init_lock); |
| static bool tfms_inited[BLK_ENCRYPTION_MODE_MAX]; |
| |
| static struct blk_crypto_keyslot { |
| enum blk_crypto_mode_num crypto_mode; |
| struct crypto_skcipher *tfms[BLK_ENCRYPTION_MODE_MAX]; |
| } *blk_crypto_keyslots; |
| |
| static struct blk_keyslot_manager blk_crypto_ksm; |
| static struct workqueue_struct *blk_crypto_wq; |
| static mempool_t *blk_crypto_bounce_page_pool; |
| static struct bio_set crypto_bio_split; |
| |
| /* |
| * This is the key we set when evicting a keyslot. This *should* be the all 0's |
| * key, but AES-XTS rejects that key, so we use some random bytes instead. |
| */ |
| static u8 blank_key[BLK_CRYPTO_MAX_KEY_SIZE]; |
| |
| static void blk_crypto_evict_keyslot(unsigned int slot) |
| { |
| struct blk_crypto_keyslot *slotp = &blk_crypto_keyslots[slot]; |
| enum blk_crypto_mode_num crypto_mode = slotp->crypto_mode; |
| int err; |
| |
| WARN_ON(slotp->crypto_mode == BLK_ENCRYPTION_MODE_INVALID); |
| |
| /* Clear the key in the skcipher */ |
| err = crypto_skcipher_setkey(slotp->tfms[crypto_mode], blank_key, |
| blk_crypto_modes[crypto_mode].keysize); |
| WARN_ON(err); |
| slotp->crypto_mode = BLK_ENCRYPTION_MODE_INVALID; |
| } |
| |
| static int blk_crypto_keyslot_program(struct blk_keyslot_manager *ksm, |
| const struct blk_crypto_key *key, |
| unsigned int slot) |
| { |
| struct blk_crypto_keyslot *slotp = &blk_crypto_keyslots[slot]; |
| const enum blk_crypto_mode_num crypto_mode = |
| key->crypto_cfg.crypto_mode; |
| int err; |
| |
| if (crypto_mode != slotp->crypto_mode && |
| slotp->crypto_mode != BLK_ENCRYPTION_MODE_INVALID) |
| blk_crypto_evict_keyslot(slot); |
| |
| slotp->crypto_mode = crypto_mode; |
| err = crypto_skcipher_setkey(slotp->tfms[crypto_mode], key->raw, |
| key->size); |
| if (err) { |
| blk_crypto_evict_keyslot(slot); |
| return err; |
| } |
| return 0; |
| } |
| |
| static int blk_crypto_keyslot_evict(struct blk_keyslot_manager *ksm, |
| const struct blk_crypto_key *key, |
| unsigned int slot) |
| { |
| blk_crypto_evict_keyslot(slot); |
| return 0; |
| } |
| |
| /* |
| * The crypto API fallback KSM ops - only used for a bio when it specifies a |
| * blk_crypto_key that was not supported by the device's inline encryption |
| * hardware. |
| */ |
| static const struct blk_ksm_ll_ops blk_crypto_ksm_ll_ops = { |
| .keyslot_program = blk_crypto_keyslot_program, |
| .keyslot_evict = blk_crypto_keyslot_evict, |
| }; |
| |
| static void blk_crypto_fallback_encrypt_endio(struct bio *enc_bio) |
| { |
| struct bio *src_bio = enc_bio->bi_private; |
| int i; |
| |
| for (i = 0; i < enc_bio->bi_vcnt; i++) |
| mempool_free(enc_bio->bi_io_vec[i].bv_page, |
| blk_crypto_bounce_page_pool); |
| |
| src_bio->bi_status = enc_bio->bi_status; |
| |
| bio_put(enc_bio); |
| bio_endio(src_bio); |
| } |
| |
| static struct bio *blk_crypto_clone_bio(struct bio *bio_src) |
| { |
| struct bvec_iter iter; |
| struct bio_vec bv; |
| struct bio *bio; |
| |
| bio = bio_kmalloc(GFP_NOIO, bio_segments(bio_src)); |
| if (!bio) |
| return NULL; |
| bio->bi_bdev = bio_src->bi_bdev; |
| if (bio_flagged(bio_src, BIO_REMAPPED)) |
| bio_set_flag(bio, BIO_REMAPPED); |
| bio->bi_opf = bio_src->bi_opf; |
| bio->bi_ioprio = bio_src->bi_ioprio; |
| bio->bi_write_hint = bio_src->bi_write_hint; |
| bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector; |
| bio->bi_iter.bi_size = bio_src->bi_iter.bi_size; |
| |
| bio_for_each_segment(bv, bio_src, iter) |
| bio->bi_io_vec[bio->bi_vcnt++] = bv; |
| |
| bio_clone_blkg_association(bio, bio_src); |
| blkcg_bio_issue_init(bio); |
| |
| bio_clone_skip_dm_default_key(bio, bio_src); |
| |
| return bio; |
| } |
| |
| static bool blk_crypto_alloc_cipher_req(struct blk_ksm_keyslot *slot, |
| struct skcipher_request **ciph_req_ret, |
| struct crypto_wait *wait) |
| { |
| struct skcipher_request *ciph_req; |
| const struct blk_crypto_keyslot *slotp; |
| int keyslot_idx = blk_ksm_get_slot_idx(slot); |
| |
| slotp = &blk_crypto_keyslots[keyslot_idx]; |
| ciph_req = skcipher_request_alloc(slotp->tfms[slotp->crypto_mode], |
| GFP_NOIO); |
| if (!ciph_req) |
| return false; |
| |
| skcipher_request_set_callback(ciph_req, |
| CRYPTO_TFM_REQ_MAY_BACKLOG | |
| CRYPTO_TFM_REQ_MAY_SLEEP, |
| crypto_req_done, wait); |
| *ciph_req_ret = ciph_req; |
| |
| return true; |
| } |
| |
| static bool blk_crypto_split_bio_if_needed(struct bio **bio_ptr) |
| { |
| struct bio *bio = *bio_ptr; |
| unsigned int i = 0; |
| unsigned int num_sectors = 0; |
| struct bio_vec bv; |
| struct bvec_iter iter; |
| |
| bio_for_each_segment(bv, bio, iter) { |
| num_sectors += bv.bv_len >> SECTOR_SHIFT; |
| if (++i == BIO_MAX_VECS) |
| break; |
| } |
| if (num_sectors < bio_sectors(bio)) { |
| struct bio *split_bio; |
| |
| split_bio = bio_split(bio, num_sectors, GFP_NOIO, |
| &crypto_bio_split); |
| if (!split_bio) { |
| bio->bi_status = BLK_STS_RESOURCE; |
| return false; |
| } |
| bio_chain(split_bio, bio); |
| submit_bio_noacct(bio); |
| *bio_ptr = split_bio; |
| } |
| |
| return true; |
| } |
| |
| union blk_crypto_iv { |
| __le64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE]; |
| u8 bytes[BLK_CRYPTO_MAX_IV_SIZE]; |
| }; |
| |
| static void blk_crypto_dun_to_iv(const u64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE], |
| union blk_crypto_iv *iv) |
| { |
| int i; |
| |
| for (i = 0; i < BLK_CRYPTO_DUN_ARRAY_SIZE; i++) |
| iv->dun[i] = cpu_to_le64(dun[i]); |
| } |
| |
| /* |
| * The crypto API fallback's encryption routine. |
| * Allocate a bounce bio for encryption, encrypt the input bio using crypto API, |
| * and replace *bio_ptr with the bounce bio. May split input bio if it's too |
| * large. Returns true on success. Returns false and sets bio->bi_status on |
| * error. |
| */ |
| static bool blk_crypto_fallback_encrypt_bio(struct bio **bio_ptr) |
| { |
| struct bio *src_bio, *enc_bio; |
| struct bio_crypt_ctx *bc; |
| struct blk_ksm_keyslot *slot; |
| int data_unit_size; |
| struct skcipher_request *ciph_req = NULL; |
| DECLARE_CRYPTO_WAIT(wait); |
| u64 curr_dun[BLK_CRYPTO_DUN_ARRAY_SIZE]; |
| struct scatterlist src, dst; |
| union blk_crypto_iv iv; |
| unsigned int i, j; |
| bool ret = false; |
| blk_status_t blk_st; |
| |
| /* Split the bio if it's too big for single page bvec */ |
| if (!blk_crypto_split_bio_if_needed(bio_ptr)) |
| return false; |
| |
| src_bio = *bio_ptr; |
| bc = src_bio->bi_crypt_context; |
| data_unit_size = bc->bc_key->crypto_cfg.data_unit_size; |
| |
| /* Allocate bounce bio for encryption */ |
| enc_bio = blk_crypto_clone_bio(src_bio); |
| if (!enc_bio) { |
| src_bio->bi_status = BLK_STS_RESOURCE; |
| return false; |
| } |
| |
| /* |
| * Use the crypto API fallback keyslot manager to get a crypto_skcipher |
| * for the algorithm and key specified for this bio. |
| */ |
| blk_st = blk_ksm_get_slot_for_key(&blk_crypto_ksm, bc->bc_key, &slot); |
| if (blk_st != BLK_STS_OK) { |
| src_bio->bi_status = blk_st; |
| goto out_put_enc_bio; |
| } |
| |
| /* and then allocate an skcipher_request for it */ |
| if (!blk_crypto_alloc_cipher_req(slot, &ciph_req, &wait)) { |
| src_bio->bi_status = BLK_STS_RESOURCE; |
| goto out_release_keyslot; |
| } |
| |
| memcpy(curr_dun, bc->bc_dun, sizeof(curr_dun)); |
| sg_init_table(&src, 1); |
| sg_init_table(&dst, 1); |
| |
| skcipher_request_set_crypt(ciph_req, &src, &dst, data_unit_size, |
| iv.bytes); |
| |
| /* Encrypt each page in the bounce bio */ |
| for (i = 0; i < enc_bio->bi_vcnt; i++) { |
| struct bio_vec *enc_bvec = &enc_bio->bi_io_vec[i]; |
| struct page *plaintext_page = enc_bvec->bv_page; |
| struct page *ciphertext_page = |
| mempool_alloc(blk_crypto_bounce_page_pool, GFP_NOIO); |
| |
| enc_bvec->bv_page = ciphertext_page; |
| |
| if (!ciphertext_page) { |
| src_bio->bi_status = BLK_STS_RESOURCE; |
| goto out_free_bounce_pages; |
| } |
| |
| sg_set_page(&src, plaintext_page, data_unit_size, |
| enc_bvec->bv_offset); |
| sg_set_page(&dst, ciphertext_page, data_unit_size, |
| enc_bvec->bv_offset); |
| |
| /* Encrypt each data unit in this page */ |
| for (j = 0; j < enc_bvec->bv_len; j += data_unit_size) { |
| blk_crypto_dun_to_iv(curr_dun, &iv); |
| if (crypto_wait_req(crypto_skcipher_encrypt(ciph_req), |
| &wait)) { |
| i++; |
| src_bio->bi_status = BLK_STS_IOERR; |
| goto out_free_bounce_pages; |
| } |
| bio_crypt_dun_increment(curr_dun, 1); |
| src.offset += data_unit_size; |
| dst.offset += data_unit_size; |
| } |
| } |
| |
| enc_bio->bi_private = src_bio; |
| enc_bio->bi_end_io = blk_crypto_fallback_encrypt_endio; |
| *bio_ptr = enc_bio; |
| ret = true; |
| |
| enc_bio = NULL; |
| goto out_free_ciph_req; |
| |
| out_free_bounce_pages: |
| while (i > 0) |
| mempool_free(enc_bio->bi_io_vec[--i].bv_page, |
| blk_crypto_bounce_page_pool); |
| out_free_ciph_req: |
| skcipher_request_free(ciph_req); |
| out_release_keyslot: |
| blk_ksm_put_slot(slot); |
| out_put_enc_bio: |
| if (enc_bio) |
| bio_put(enc_bio); |
| |
| return ret; |
| } |
| |
| /* |
| * The crypto API fallback's main decryption routine. |
| * Decrypts input bio in place, and calls bio_endio on the bio. |
| */ |
| static void blk_crypto_fallback_decrypt_bio(struct work_struct *work) |
| { |
| struct bio_fallback_crypt_ctx *f_ctx = |
| container_of(work, struct bio_fallback_crypt_ctx, work); |
| struct bio *bio = f_ctx->bio; |
| struct bio_crypt_ctx *bc = &f_ctx->crypt_ctx; |
| struct blk_ksm_keyslot *slot; |
| struct skcipher_request *ciph_req = NULL; |
| DECLARE_CRYPTO_WAIT(wait); |
| u64 curr_dun[BLK_CRYPTO_DUN_ARRAY_SIZE]; |
| union blk_crypto_iv iv; |
| struct scatterlist sg; |
| struct bio_vec bv; |
| struct bvec_iter iter; |
| const int data_unit_size = bc->bc_key->crypto_cfg.data_unit_size; |
| unsigned int i; |
| blk_status_t blk_st; |
| |
| /* |
| * Use the crypto API fallback keyslot manager to get a crypto_skcipher |
| * for the algorithm and key specified for this bio. |
| */ |
| blk_st = blk_ksm_get_slot_for_key(&blk_crypto_ksm, bc->bc_key, &slot); |
| if (blk_st != BLK_STS_OK) { |
| bio->bi_status = blk_st; |
| goto out_no_keyslot; |
| } |
| |
| /* and then allocate an skcipher_request for it */ |
| if (!blk_crypto_alloc_cipher_req(slot, &ciph_req, &wait)) { |
| bio->bi_status = BLK_STS_RESOURCE; |
| goto out; |
| } |
| |
| memcpy(curr_dun, bc->bc_dun, sizeof(curr_dun)); |
| sg_init_table(&sg, 1); |
| skcipher_request_set_crypt(ciph_req, &sg, &sg, data_unit_size, |
| iv.bytes); |
| |
| /* Decrypt each segment in the bio */ |
| __bio_for_each_segment(bv, bio, iter, f_ctx->crypt_iter) { |
| struct page *page = bv.bv_page; |
| |
| sg_set_page(&sg, page, data_unit_size, bv.bv_offset); |
| |
| /* Decrypt each data unit in the segment */ |
| for (i = 0; i < bv.bv_len; i += data_unit_size) { |
| blk_crypto_dun_to_iv(curr_dun, &iv); |
| if (crypto_wait_req(crypto_skcipher_decrypt(ciph_req), |
| &wait)) { |
| bio->bi_status = BLK_STS_IOERR; |
| goto out; |
| } |
| bio_crypt_dun_increment(curr_dun, 1); |
| sg.offset += data_unit_size; |
| } |
| } |
| |
| out: |
| skcipher_request_free(ciph_req); |
| blk_ksm_put_slot(slot); |
| out_no_keyslot: |
| mempool_free(f_ctx, bio_fallback_crypt_ctx_pool); |
| bio_endio(bio); |
| } |
| |
| /** |
| * blk_crypto_fallback_decrypt_endio - queue bio for fallback decryption |
| * |
| * @bio: the bio to queue |
| * |
| * Restore bi_private and bi_end_io, and queue the bio for decryption into a |
| * workqueue, since this function will be called from an atomic context. |
| */ |
| static void blk_crypto_fallback_decrypt_endio(struct bio *bio) |
| { |
| struct bio_fallback_crypt_ctx *f_ctx = bio->bi_private; |
| |
| bio->bi_private = f_ctx->bi_private_orig; |
| bio->bi_end_io = f_ctx->bi_end_io_orig; |
| |
| /* If there was an IO error, don't queue for decrypt. */ |
| if (bio->bi_status) { |
| mempool_free(f_ctx, bio_fallback_crypt_ctx_pool); |
| bio_endio(bio); |
| return; |
| } |
| |
| INIT_WORK(&f_ctx->work, blk_crypto_fallback_decrypt_bio); |
| f_ctx->bio = bio; |
| queue_work(blk_crypto_wq, &f_ctx->work); |
| } |
| |
| /** |
| * blk_crypto_fallback_bio_prep - Prepare a bio to use fallback en/decryption |
| * |
| * @bio_ptr: pointer to the bio to prepare |
| * |
| * If bio is doing a WRITE operation, this splits the bio into two parts if it's |
| * too big (see blk_crypto_split_bio_if_needed). It then allocates a bounce bio |
| * for the first part, encrypts it, and update bio_ptr to point to the bounce |
| * bio. |
| * |
| * For a READ operation, we mark the bio for decryption by using bi_private and |
| * bi_end_io. |
| * |
| * In either case, this function will make the bio look like a regular bio (i.e. |
| * as if no encryption context was ever specified) for the purposes of the rest |
| * of the stack except for blk-integrity (blk-integrity and blk-crypto are not |
| * currently supported together). |
| * |
| * Return: true on success. Sets bio->bi_status and returns false on error. |
| */ |
| bool blk_crypto_fallback_bio_prep(struct bio **bio_ptr) |
| { |
| struct bio *bio = *bio_ptr; |
| struct bio_crypt_ctx *bc = bio->bi_crypt_context; |
| struct bio_fallback_crypt_ctx *f_ctx; |
| |
| if (WARN_ON_ONCE(!tfms_inited[bc->bc_key->crypto_cfg.crypto_mode])) { |
| /* User didn't call blk_crypto_start_using_key() first */ |
| bio->bi_status = BLK_STS_IOERR; |
| return false; |
| } |
| |
| if (!blk_ksm_crypto_cfg_supported(&blk_crypto_ksm, |
| &bc->bc_key->crypto_cfg)) { |
| bio->bi_status = BLK_STS_NOTSUPP; |
| return false; |
| } |
| |
| if (bio_data_dir(bio) == WRITE) |
| return blk_crypto_fallback_encrypt_bio(bio_ptr); |
| |
| /* |
| * bio READ case: Set up a f_ctx in the bio's bi_private and set the |
| * bi_end_io appropriately to trigger decryption when the bio is ended. |
| */ |
| f_ctx = mempool_alloc(bio_fallback_crypt_ctx_pool, GFP_NOIO); |
| f_ctx->crypt_ctx = *bc; |
| f_ctx->crypt_iter = bio->bi_iter; |
| f_ctx->bi_private_orig = bio->bi_private; |
| f_ctx->bi_end_io_orig = bio->bi_end_io; |
| bio->bi_private = (void *)f_ctx; |
| bio->bi_end_io = blk_crypto_fallback_decrypt_endio; |
| bio_crypt_free_ctx(bio); |
| |
| return true; |
| } |
| |
| int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key) |
| { |
| return blk_ksm_evict_key(&blk_crypto_ksm, key); |
| } |
| |
| static bool blk_crypto_fallback_inited; |
| static int blk_crypto_fallback_init(void) |
| { |
| int i; |
| int err; |
| |
| if (blk_crypto_fallback_inited) |
| return 0; |
| |
| prandom_bytes(blank_key, BLK_CRYPTO_MAX_KEY_SIZE); |
| |
| err = bioset_init(&crypto_bio_split, 64, 0, 0); |
| if (err) |
| goto out; |
| |
| err = blk_ksm_init(&blk_crypto_ksm, blk_crypto_num_keyslots); |
| if (err) |
| goto fail_free_bioset; |
| err = -ENOMEM; |
| |
| blk_crypto_ksm.ksm_ll_ops = blk_crypto_ksm_ll_ops; |
| blk_crypto_ksm.max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE; |
| blk_crypto_ksm.features = BLK_CRYPTO_FEATURE_STANDARD_KEYS; |
| |
| /* All blk-crypto modes have a crypto API fallback. */ |
| for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++) |
| blk_crypto_ksm.crypto_modes_supported[i] = 0xFFFFFFFF; |
| blk_crypto_ksm.crypto_modes_supported[BLK_ENCRYPTION_MODE_INVALID] = 0; |
| |
| blk_crypto_wq = alloc_workqueue("blk_crypto_wq", |
| WQ_UNBOUND | WQ_HIGHPRI | |
| WQ_MEM_RECLAIM, num_online_cpus()); |
| if (!blk_crypto_wq) |
| goto fail_free_ksm; |
| |
| blk_crypto_keyslots = kcalloc(blk_crypto_num_keyslots, |
| sizeof(blk_crypto_keyslots[0]), |
| GFP_KERNEL); |
| if (!blk_crypto_keyslots) |
| goto fail_free_wq; |
| |
| blk_crypto_bounce_page_pool = |
| mempool_create_page_pool(num_prealloc_bounce_pg, 0); |
| if (!blk_crypto_bounce_page_pool) |
| goto fail_free_keyslots; |
| |
| bio_fallback_crypt_ctx_cache = KMEM_CACHE(bio_fallback_crypt_ctx, 0); |
| if (!bio_fallback_crypt_ctx_cache) |
| goto fail_free_bounce_page_pool; |
| |
| bio_fallback_crypt_ctx_pool = |
| mempool_create_slab_pool(num_prealloc_fallback_crypt_ctxs, |
| bio_fallback_crypt_ctx_cache); |
| if (!bio_fallback_crypt_ctx_pool) |
| goto fail_free_crypt_ctx_cache; |
| |
| blk_crypto_fallback_inited = true; |
| |
| return 0; |
| fail_free_crypt_ctx_cache: |
| kmem_cache_destroy(bio_fallback_crypt_ctx_cache); |
| fail_free_bounce_page_pool: |
| mempool_destroy(blk_crypto_bounce_page_pool); |
| fail_free_keyslots: |
| kfree(blk_crypto_keyslots); |
| fail_free_wq: |
| destroy_workqueue(blk_crypto_wq); |
| fail_free_ksm: |
| blk_ksm_destroy(&blk_crypto_ksm); |
| fail_free_bioset: |
| bioset_exit(&crypto_bio_split); |
| out: |
| return err; |
| } |
| |
| /* |
| * Prepare blk-crypto-fallback for the specified crypto mode. |
| * Returns -ENOPKG if the needed crypto API support is missing. |
| */ |
| int blk_crypto_fallback_start_using_mode(enum blk_crypto_mode_num mode_num) |
| { |
| const char *cipher_str = blk_crypto_modes[mode_num].cipher_str; |
| struct blk_crypto_keyslot *slotp; |
| unsigned int i; |
| int err = 0; |
| |
| /* |
| * Fast path |
| * Ensure that updates to blk_crypto_keyslots[i].tfms[mode_num] |
| * for each i are visible before we try to access them. |
| */ |
| if (likely(smp_load_acquire(&tfms_inited[mode_num]))) |
| return 0; |
| |
| mutex_lock(&tfms_init_lock); |
| if (tfms_inited[mode_num]) |
| goto out; |
| |
| err = blk_crypto_fallback_init(); |
| if (err) |
| goto out; |
| |
| for (i = 0; i < blk_crypto_num_keyslots; i++) { |
| slotp = &blk_crypto_keyslots[i]; |
| slotp->tfms[mode_num] = crypto_alloc_skcipher(cipher_str, 0, 0); |
| if (IS_ERR(slotp->tfms[mode_num])) { |
| err = PTR_ERR(slotp->tfms[mode_num]); |
| if (err == -ENOENT) { |
| pr_warn_once("Missing crypto API support for \"%s\"\n", |
| cipher_str); |
| err = -ENOPKG; |
| } |
| slotp->tfms[mode_num] = NULL; |
| goto out_free_tfms; |
| } |
| |
| crypto_skcipher_set_flags(slotp->tfms[mode_num], |
| CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); |
| } |
| |
| /* |
| * Ensure that updates to blk_crypto_keyslots[i].tfms[mode_num] |
| * for each i are visible before we set tfms_inited[mode_num]. |
| */ |
| smp_store_release(&tfms_inited[mode_num], true); |
| goto out; |
| |
| out_free_tfms: |
| for (i = 0; i < blk_crypto_num_keyslots; i++) { |
| slotp = &blk_crypto_keyslots[i]; |
| crypto_free_skcipher(slotp->tfms[mode_num]); |
| slotp->tfms[mode_num] = NULL; |
| } |
| out: |
| mutex_unlock(&tfms_init_lock); |
| return err; |
| } |