xref: /kernel/linux/linux-5.10/drivers/md/dm-crypt.c (revision 8c2ecf20)
1/*
2 * Copyright (C) 2003 Jana Saout <jana@saout.de>
3 * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
4 * Copyright (C) 2006-2020 Red Hat, Inc. All rights reserved.
5 * Copyright (C) 2013-2020 Milan Broz <gmazyland@gmail.com>
6 *
7 * This file is released under the GPL.
8 */
9
10#include <linux/completion.h>
11#include <linux/err.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/kernel.h>
15#include <linux/key.h>
16#include <linux/bio.h>
17#include <linux/blkdev.h>
18#include <linux/mempool.h>
19#include <linux/slab.h>
20#include <linux/crypto.h>
21#include <linux/workqueue.h>
22#include <linux/kthread.h>
23#include <linux/backing-dev.h>
24#include <linux/atomic.h>
25#include <linux/scatterlist.h>
26#include <linux/rbtree.h>
27#include <linux/ctype.h>
28#include <asm/page.h>
29#include <asm/unaligned.h>
30#include <crypto/hash.h>
31#include <crypto/md5.h>
32#include <crypto/algapi.h>
33#include <crypto/skcipher.h>
34#include <crypto/aead.h>
35#include <crypto/authenc.h>
36#include <linux/rtnetlink.h> /* for struct rtattr and RTA macros only */
37#include <linux/key-type.h>
38#include <keys/user-type.h>
39#include <keys/encrypted-type.h>
40
41#include <linux/device-mapper.h>
42
43#define DM_MSG_PREFIX "crypt"
44
45/*
46 * context holding the current state of a multi-part conversion
47 */
48struct convert_context {
49	struct completion restart;
50	struct bio *bio_in;
51	struct bio *bio_out;
52	struct bvec_iter iter_in;
53	struct bvec_iter iter_out;
54	u64 cc_sector;
55	atomic_t cc_pending;
56	union {
57		struct skcipher_request *req;
58		struct aead_request *req_aead;
59	} r;
60
61};
62
63/*
64 * per bio private data
65 */
66struct dm_crypt_io {
67	struct crypt_config *cc;
68	struct bio *base_bio;
69	u8 *integrity_metadata;
70	bool integrity_metadata_from_pool:1;
71	bool in_tasklet:1;
72
73	struct work_struct work;
74	struct tasklet_struct tasklet;
75
76	struct convert_context ctx;
77
78	atomic_t io_pending;
79	blk_status_t error;
80	sector_t sector;
81
82	struct rb_node rb_node;
83} CRYPTO_MINALIGN_ATTR;
84
85struct dm_crypt_request {
86	struct convert_context *ctx;
87	struct scatterlist sg_in[4];
88	struct scatterlist sg_out[4];
89	u64 iv_sector;
90};
91
92struct crypt_config;
93
94struct crypt_iv_operations {
95	int (*ctr)(struct crypt_config *cc, struct dm_target *ti,
96		   const char *opts);
97	void (*dtr)(struct crypt_config *cc);
98	int (*init)(struct crypt_config *cc);
99	int (*wipe)(struct crypt_config *cc);
100	int (*generator)(struct crypt_config *cc, u8 *iv,
101			 struct dm_crypt_request *dmreq);
102	int (*post)(struct crypt_config *cc, u8 *iv,
103		    struct dm_crypt_request *dmreq);
104};
105
106struct iv_benbi_private {
107	int shift;
108};
109
110#define LMK_SEED_SIZE 64 /* hash + 0 */
111struct iv_lmk_private {
112	struct crypto_shash *hash_tfm;
113	u8 *seed;
114};
115
116#define TCW_WHITENING_SIZE 16
117struct iv_tcw_private {
118	struct crypto_shash *crc32_tfm;
119	u8 *iv_seed;
120	u8 *whitening;
121};
122
123#define ELEPHANT_MAX_KEY_SIZE 32
124struct iv_elephant_private {
125	struct crypto_skcipher *tfm;
126};
127
128/*
129 * Crypt: maps a linear range of a block device
130 * and encrypts / decrypts at the same time.
131 */
132enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
133	     DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
134	     DM_CRYPT_NO_READ_WORKQUEUE, DM_CRYPT_NO_WRITE_WORKQUEUE,
135	     DM_CRYPT_WRITE_INLINE };
136
137enum cipher_flags {
138	CRYPT_MODE_INTEGRITY_AEAD,	/* Use authenticated mode for cihper */
139	CRYPT_IV_LARGE_SECTORS,		/* Calculate IV from sector_size, not 512B sectors */
140	CRYPT_ENCRYPT_PREPROCESS,	/* Must preprocess data for encryption (elephant) */
141};
142
143/*
144 * The fields in here must be read only after initialization.
145 */
146struct crypt_config {
147	struct dm_dev *dev;
148	sector_t start;
149
150	struct percpu_counter n_allocated_pages;
151
152	struct workqueue_struct *io_queue;
153	struct workqueue_struct *crypt_queue;
154
155	spinlock_t write_thread_lock;
156	struct task_struct *write_thread;
157	struct rb_root write_tree;
158
159	char *cipher_string;
160	char *cipher_auth;
161	char *key_string;
162
163	const struct crypt_iv_operations *iv_gen_ops;
164	union {
165		struct iv_benbi_private benbi;
166		struct iv_lmk_private lmk;
167		struct iv_tcw_private tcw;
168		struct iv_elephant_private elephant;
169	} iv_gen_private;
170	u64 iv_offset;
171	unsigned int iv_size;
172	unsigned short int sector_size;
173	unsigned char sector_shift;
174
175	union {
176		struct crypto_skcipher **tfms;
177		struct crypto_aead **tfms_aead;
178	} cipher_tfm;
179	unsigned tfms_count;
180	unsigned long cipher_flags;
181
182	/*
183	 * Layout of each crypto request:
184	 *
185	 *   struct skcipher_request
186	 *      context
187	 *      padding
188	 *   struct dm_crypt_request
189	 *      padding
190	 *   IV
191	 *
192	 * The padding is added so that dm_crypt_request and the IV are
193	 * correctly aligned.
194	 */
195	unsigned int dmreq_start;
196
197	unsigned int per_bio_data_size;
198
199	unsigned long flags;
200	unsigned int key_size;
201	unsigned int key_parts;      /* independent parts in key buffer */
202	unsigned int key_extra_size; /* additional keys length */
203	unsigned int key_mac_size;   /* MAC key size for authenc(...) */
204
205	unsigned int integrity_tag_size;
206	unsigned int integrity_iv_size;
207	unsigned int on_disk_tag_size;
208
209	/*
210	 * pool for per bio private data, crypto requests,
211	 * encryption requeusts/buffer pages and integrity tags
212	 */
213	unsigned tag_pool_max_sectors;
214	mempool_t tag_pool;
215	mempool_t req_pool;
216	mempool_t page_pool;
217
218	struct bio_set bs;
219	struct mutex bio_alloc_lock;
220
221	u8 *authenc_key; /* space for keys in authenc() format (if used) */
222	u8 key[];
223};
224
225#define MIN_IOS		64
226#define MAX_TAG_SIZE	480
227#define POOL_ENTRY_SIZE	512
228
229static DEFINE_SPINLOCK(dm_crypt_clients_lock);
230static unsigned dm_crypt_clients_n = 0;
231static volatile unsigned long dm_crypt_pages_per_client;
232#define DM_CRYPT_MEMORY_PERCENT			2
233#define DM_CRYPT_MIN_PAGES_PER_CLIENT		(BIO_MAX_PAGES * 16)
234
235static void clone_init(struct dm_crypt_io *, struct bio *);
236static void kcryptd_queue_crypt(struct dm_crypt_io *io);
237static struct scatterlist *crypt_get_sg_data(struct crypt_config *cc,
238					     struct scatterlist *sg);
239
240static bool crypt_integrity_aead(struct crypt_config *cc);
241
242/*
243 * Use this to access cipher attributes that are independent of the key.
244 */
245static struct crypto_skcipher *any_tfm(struct crypt_config *cc)
246{
247	return cc->cipher_tfm.tfms[0];
248}
249
250static struct crypto_aead *any_tfm_aead(struct crypt_config *cc)
251{
252	return cc->cipher_tfm.tfms_aead[0];
253}
254
255/*
256 * Different IV generation algorithms:
257 *
258 * plain: the initial vector is the 32-bit little-endian version of the sector
259 *        number, padded with zeros if necessary.
260 *
261 * plain64: the initial vector is the 64-bit little-endian version of the sector
262 *        number, padded with zeros if necessary.
263 *
264 * plain64be: the initial vector is the 64-bit big-endian version of the sector
265 *        number, padded with zeros if necessary.
266 *
267 * essiv: "encrypted sector|salt initial vector", the sector number is
268 *        encrypted with the bulk cipher using a salt as key. The salt
269 *        should be derived from the bulk cipher's key via hashing.
270 *
271 * benbi: the 64-bit "big-endian 'narrow block'-count", starting at 1
272 *        (needed for LRW-32-AES and possible other narrow block modes)
273 *
274 * null: the initial vector is always zero.  Provides compatibility with
275 *       obsolete loop_fish2 devices.  Do not use for new devices.
276 *
277 * lmk:  Compatible implementation of the block chaining mode used
278 *       by the Loop-AES block device encryption system
279 *       designed by Jari Ruusu. See http://loop-aes.sourceforge.net/
280 *       It operates on full 512 byte sectors and uses CBC
281 *       with an IV derived from the sector number, the data and
282 *       optionally extra IV seed.
283 *       This means that after decryption the first block
284 *       of sector must be tweaked according to decrypted data.
285 *       Loop-AES can use three encryption schemes:
286 *         version 1: is plain aes-cbc mode
287 *         version 2: uses 64 multikey scheme with lmk IV generator
288 *         version 3: the same as version 2 with additional IV seed
289 *                   (it uses 65 keys, last key is used as IV seed)
290 *
291 * tcw:  Compatible implementation of the block chaining mode used
292 *       by the TrueCrypt device encryption system (prior to version 4.1).
293 *       For more info see: https://gitlab.com/cryptsetup/cryptsetup/wikis/TrueCryptOnDiskFormat
294 *       It operates on full 512 byte sectors and uses CBC
295 *       with an IV derived from initial key and the sector number.
296 *       In addition, whitening value is applied on every sector, whitening
297 *       is calculated from initial key, sector number and mixed using CRC32.
298 *       Note that this encryption scheme is vulnerable to watermarking attacks
299 *       and should be used for old compatible containers access only.
300 *
301 * eboiv: Encrypted byte-offset IV (used in Bitlocker in CBC mode)
302 *        The IV is encrypted little-endian byte-offset (with the same key
303 *        and cipher as the volume).
304 *
305 * elephant: The extended version of eboiv with additional Elephant diffuser
306 *           used with Bitlocker CBC mode.
307 *           This mode was used in older Windows systems
308 *           https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/bitlockercipher200608.pdf
309 */
310
311static int crypt_iv_plain_gen(struct crypt_config *cc, u8 *iv,
312			      struct dm_crypt_request *dmreq)
313{
314	memset(iv, 0, cc->iv_size);
315	*(__le32 *)iv = cpu_to_le32(dmreq->iv_sector & 0xffffffff);
316
317	return 0;
318}
319
320static int crypt_iv_plain64_gen(struct crypt_config *cc, u8 *iv,
321				struct dm_crypt_request *dmreq)
322{
323	memset(iv, 0, cc->iv_size);
324	*(__le64 *)iv = cpu_to_le64(dmreq->iv_sector);
325
326	return 0;
327}
328
329static int crypt_iv_plain64be_gen(struct crypt_config *cc, u8 *iv,
330				  struct dm_crypt_request *dmreq)
331{
332	memset(iv, 0, cc->iv_size);
333	/* iv_size is at least of size u64; usually it is 16 bytes */
334	*(__be64 *)&iv[cc->iv_size - sizeof(u64)] = cpu_to_be64(dmreq->iv_sector);
335
336	return 0;
337}
338
339static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv,
340			      struct dm_crypt_request *dmreq)
341{
342	/*
343	 * ESSIV encryption of the IV is now handled by the crypto API,
344	 * so just pass the plain sector number here.
345	 */
346	memset(iv, 0, cc->iv_size);
347	*(__le64 *)iv = cpu_to_le64(dmreq->iv_sector);
348
349	return 0;
350}
351
352static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti,
353			      const char *opts)
354{
355	unsigned bs;
356	int log;
357
358	if (crypt_integrity_aead(cc))
359		bs = crypto_aead_blocksize(any_tfm_aead(cc));
360	else
361		bs = crypto_skcipher_blocksize(any_tfm(cc));
362	log = ilog2(bs);
363
364	/* we need to calculate how far we must shift the sector count
365	 * to get the cipher block count, we use this shift in _gen */
366
367	if (1 << log != bs) {
368		ti->error = "cypher blocksize is not a power of 2";
369		return -EINVAL;
370	}
371
372	if (log > 9) {
373		ti->error = "cypher blocksize is > 512";
374		return -EINVAL;
375	}
376
377	cc->iv_gen_private.benbi.shift = 9 - log;
378
379	return 0;
380}
381
382static void crypt_iv_benbi_dtr(struct crypt_config *cc)
383{
384}
385
386static int crypt_iv_benbi_gen(struct crypt_config *cc, u8 *iv,
387			      struct dm_crypt_request *dmreq)
388{
389	__be64 val;
390
391	memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */
392
393	val = cpu_to_be64(((u64)dmreq->iv_sector << cc->iv_gen_private.benbi.shift) + 1);
394	put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64)));
395
396	return 0;
397}
398
399static int crypt_iv_null_gen(struct crypt_config *cc, u8 *iv,
400			     struct dm_crypt_request *dmreq)
401{
402	memset(iv, 0, cc->iv_size);
403
404	return 0;
405}
406
407static void crypt_iv_lmk_dtr(struct crypt_config *cc)
408{
409	struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;
410
411	if (lmk->hash_tfm && !IS_ERR(lmk->hash_tfm))
412		crypto_free_shash(lmk->hash_tfm);
413	lmk->hash_tfm = NULL;
414
415	kfree_sensitive(lmk->seed);
416	lmk->seed = NULL;
417}
418
419static int crypt_iv_lmk_ctr(struct crypt_config *cc, struct dm_target *ti,
420			    const char *opts)
421{
422	struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;
423
424	if (cc->sector_size != (1 << SECTOR_SHIFT)) {
425		ti->error = "Unsupported sector size for LMK";
426		return -EINVAL;
427	}
428
429	lmk->hash_tfm = crypto_alloc_shash("md5", 0,
430					   CRYPTO_ALG_ALLOCATES_MEMORY);
431	if (IS_ERR(lmk->hash_tfm)) {
432		ti->error = "Error initializing LMK hash";
433		return PTR_ERR(lmk->hash_tfm);
434	}
435
436	/* No seed in LMK version 2 */
437	if (cc->key_parts == cc->tfms_count) {
438		lmk->seed = NULL;
439		return 0;
440	}
441
442	lmk->seed = kzalloc(LMK_SEED_SIZE, GFP_KERNEL);
443	if (!lmk->seed) {
444		crypt_iv_lmk_dtr(cc);
445		ti->error = "Error kmallocing seed storage in LMK";
446		return -ENOMEM;
447	}
448
449	return 0;
450}
451
452static int crypt_iv_lmk_init(struct crypt_config *cc)
453{
454	struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;
455	int subkey_size = cc->key_size / cc->key_parts;
456
457	/* LMK seed is on the position of LMK_KEYS + 1 key */
458	if (lmk->seed)
459		memcpy(lmk->seed, cc->key + (cc->tfms_count * subkey_size),
460		       crypto_shash_digestsize(lmk->hash_tfm));
461
462	return 0;
463}
464
465static int crypt_iv_lmk_wipe(struct crypt_config *cc)
466{
467	struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;
468
469	if (lmk->seed)
470		memset(lmk->seed, 0, LMK_SEED_SIZE);
471
472	return 0;
473}
474
475static int crypt_iv_lmk_one(struct crypt_config *cc, u8 *iv,
476			    struct dm_crypt_request *dmreq,
477			    u8 *data)
478{
479	struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;
480	SHASH_DESC_ON_STACK(desc, lmk->hash_tfm);
481	struct md5_state md5state;
482	__le32 buf[4];
483	int i, r;
484
485	desc->tfm = lmk->hash_tfm;
486
487	r = crypto_shash_init(desc);
488	if (r)
489		return r;
490
491	if (lmk->seed) {
492		r = crypto_shash_update(desc, lmk->seed, LMK_SEED_SIZE);
493		if (r)
494			return r;
495	}
496
497	/* Sector is always 512B, block size 16, add data of blocks 1-31 */
498	r = crypto_shash_update(desc, data + 16, 16 * 31);
499	if (r)
500		return r;
501
502	/* Sector is cropped to 56 bits here */
503	buf[0] = cpu_to_le32(dmreq->iv_sector & 0xFFFFFFFF);
504	buf[1] = cpu_to_le32((((u64)dmreq->iv_sector >> 32) & 0x00FFFFFF) | 0x80000000);
505	buf[2] = cpu_to_le32(4024);
506	buf[3] = 0;
507	r = crypto_shash_update(desc, (u8 *)buf, sizeof(buf));
508	if (r)
509		return r;
510
511	/* No MD5 padding here */
512	r = crypto_shash_export(desc, &md5state);
513	if (r)
514		return r;
515
516	for (i = 0; i < MD5_HASH_WORDS; i++)
517		__cpu_to_le32s(&md5state.hash[i]);
518	memcpy(iv, &md5state.hash, cc->iv_size);
519
520	return 0;
521}
522
523static int crypt_iv_lmk_gen(struct crypt_config *cc, u8 *iv,
524			    struct dm_crypt_request *dmreq)
525{
526	struct scatterlist *sg;
527	u8 *src;
528	int r = 0;
529
530	if (bio_data_dir(dmreq->ctx->bio_in) == WRITE) {
531		sg = crypt_get_sg_data(cc, dmreq->sg_in);
532		src = kmap_atomic(sg_page(sg));
533		r = crypt_iv_lmk_one(cc, iv, dmreq, src + sg->offset);
534		kunmap_atomic(src);
535	} else
536		memset(iv, 0, cc->iv_size);
537
538	return r;
539}
540
541static int crypt_iv_lmk_post(struct crypt_config *cc, u8 *iv,
542			     struct dm_crypt_request *dmreq)
543{
544	struct scatterlist *sg;
545	u8 *dst;
546	int r;
547
548	if (bio_data_dir(dmreq->ctx->bio_in) == WRITE)
549		return 0;
550
551	sg = crypt_get_sg_data(cc, dmreq->sg_out);
552	dst = kmap_atomic(sg_page(sg));
553	r = crypt_iv_lmk_one(cc, iv, dmreq, dst + sg->offset);
554
555	/* Tweak the first block of plaintext sector */
556	if (!r)
557		crypto_xor(dst + sg->offset, iv, cc->iv_size);
558
559	kunmap_atomic(dst);
560	return r;
561}
562
563static void crypt_iv_tcw_dtr(struct crypt_config *cc)
564{
565	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
566
567	kfree_sensitive(tcw->iv_seed);
568	tcw->iv_seed = NULL;
569	kfree_sensitive(tcw->whitening);
570	tcw->whitening = NULL;
571
572	if (tcw->crc32_tfm && !IS_ERR(tcw->crc32_tfm))
573		crypto_free_shash(tcw->crc32_tfm);
574	tcw->crc32_tfm = NULL;
575}
576
577static int crypt_iv_tcw_ctr(struct crypt_config *cc, struct dm_target *ti,
578			    const char *opts)
579{
580	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
581
582	if (cc->sector_size != (1 << SECTOR_SHIFT)) {
583		ti->error = "Unsupported sector size for TCW";
584		return -EINVAL;
585	}
586
587	if (cc->key_size <= (cc->iv_size + TCW_WHITENING_SIZE)) {
588		ti->error = "Wrong key size for TCW";
589		return -EINVAL;
590	}
591
592	tcw->crc32_tfm = crypto_alloc_shash("crc32", 0,
593					    CRYPTO_ALG_ALLOCATES_MEMORY);
594	if (IS_ERR(tcw->crc32_tfm)) {
595		ti->error = "Error initializing CRC32 in TCW";
596		return PTR_ERR(tcw->crc32_tfm);
597	}
598
599	tcw->iv_seed = kzalloc(cc->iv_size, GFP_KERNEL);
600	tcw->whitening = kzalloc(TCW_WHITENING_SIZE, GFP_KERNEL);
601	if (!tcw->iv_seed || !tcw->whitening) {
602		crypt_iv_tcw_dtr(cc);
603		ti->error = "Error allocating seed storage in TCW";
604		return -ENOMEM;
605	}
606
607	return 0;
608}
609
610static int crypt_iv_tcw_init(struct crypt_config *cc)
611{
612	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
613	int key_offset = cc->key_size - cc->iv_size - TCW_WHITENING_SIZE;
614
615	memcpy(tcw->iv_seed, &cc->key[key_offset], cc->iv_size);
616	memcpy(tcw->whitening, &cc->key[key_offset + cc->iv_size],
617	       TCW_WHITENING_SIZE);
618
619	return 0;
620}
621
622static int crypt_iv_tcw_wipe(struct crypt_config *cc)
623{
624	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
625
626	memset(tcw->iv_seed, 0, cc->iv_size);
627	memset(tcw->whitening, 0, TCW_WHITENING_SIZE);
628
629	return 0;
630}
631
632static int crypt_iv_tcw_whitening(struct crypt_config *cc,
633				  struct dm_crypt_request *dmreq,
634				  u8 *data)
635{
636	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
637	__le64 sector = cpu_to_le64(dmreq->iv_sector);
638	u8 buf[TCW_WHITENING_SIZE];
639	SHASH_DESC_ON_STACK(desc, tcw->crc32_tfm);
640	int i, r;
641
642	/* xor whitening with sector number */
643	crypto_xor_cpy(buf, tcw->whitening, (u8 *)&sector, 8);
644	crypto_xor_cpy(&buf[8], tcw->whitening + 8, (u8 *)&sector, 8);
645
646	/* calculate crc32 for every 32bit part and xor it */
647	desc->tfm = tcw->crc32_tfm;
648	for (i = 0; i < 4; i++) {
649		r = crypto_shash_init(desc);
650		if (r)
651			goto out;
652		r = crypto_shash_update(desc, &buf[i * 4], 4);
653		if (r)
654			goto out;
655		r = crypto_shash_final(desc, &buf[i * 4]);
656		if (r)
657			goto out;
658	}
659	crypto_xor(&buf[0], &buf[12], 4);
660	crypto_xor(&buf[4], &buf[8], 4);
661
662	/* apply whitening (8 bytes) to whole sector */
663	for (i = 0; i < ((1 << SECTOR_SHIFT) / 8); i++)
664		crypto_xor(data + i * 8, buf, 8);
665out:
666	memzero_explicit(buf, sizeof(buf));
667	return r;
668}
669
670static int crypt_iv_tcw_gen(struct crypt_config *cc, u8 *iv,
671			    struct dm_crypt_request *dmreq)
672{
673	struct scatterlist *sg;
674	struct iv_tcw_private *tcw = &cc->iv_gen_private.tcw;
675	__le64 sector = cpu_to_le64(dmreq->iv_sector);
676	u8 *src;
677	int r = 0;
678
679	/* Remove whitening from ciphertext */
680	if (bio_data_dir(dmreq->ctx->bio_in) != WRITE) {
681		sg = crypt_get_sg_data(cc, dmreq->sg_in);
682		src = kmap_atomic(sg_page(sg));
683		r = crypt_iv_tcw_whitening(cc, dmreq, src + sg->offset);
684		kunmap_atomic(src);
685	}
686
687	/* Calculate IV */
688	crypto_xor_cpy(iv, tcw->iv_seed, (u8 *)&sector, 8);
689	if (cc->iv_size > 8)
690		crypto_xor_cpy(&iv[8], tcw->iv_seed + 8, (u8 *)&sector,
691			       cc->iv_size - 8);
692
693	return r;
694}
695
696static int crypt_iv_tcw_post(struct crypt_config *cc, u8 *iv,
697			     struct dm_crypt_request *dmreq)
698{
699	struct scatterlist *sg;
700	u8 *dst;
701	int r;
702
703	if (bio_data_dir(dmreq->ctx->bio_in) != WRITE)
704		return 0;
705
706	/* Apply whitening on ciphertext */
707	sg = crypt_get_sg_data(cc, dmreq->sg_out);
708	dst = kmap_atomic(sg_page(sg));
709	r = crypt_iv_tcw_whitening(cc, dmreq, dst + sg->offset);
710	kunmap_atomic(dst);
711
712	return r;
713}
714
715static int crypt_iv_random_gen(struct crypt_config *cc, u8 *iv,
716				struct dm_crypt_request *dmreq)
717{
718	/* Used only for writes, there must be an additional space to store IV */
719	get_random_bytes(iv, cc->iv_size);
720	return 0;
721}
722
723static int crypt_iv_eboiv_ctr(struct crypt_config *cc, struct dm_target *ti,
724			    const char *opts)
725{
726	if (crypt_integrity_aead(cc)) {
727		ti->error = "AEAD transforms not supported for EBOIV";
728		return -EINVAL;
729	}
730
731	if (crypto_skcipher_blocksize(any_tfm(cc)) != cc->iv_size) {
732		ti->error = "Block size of EBOIV cipher does "
733			    "not match IV size of block cipher";
734		return -EINVAL;
735	}
736
737	return 0;
738}
739
740static int crypt_iv_eboiv_gen(struct crypt_config *cc, u8 *iv,
741			    struct dm_crypt_request *dmreq)
742{
743	u8 buf[MAX_CIPHER_BLOCKSIZE] __aligned(__alignof__(__le64));
744	struct skcipher_request *req;
745	struct scatterlist src, dst;
746	DECLARE_CRYPTO_WAIT(wait);
747	int err;
748
749	req = skcipher_request_alloc(any_tfm(cc), GFP_NOIO);
750	if (!req)
751		return -ENOMEM;
752
753	memset(buf, 0, cc->iv_size);
754	*(__le64 *)buf = cpu_to_le64(dmreq->iv_sector * cc->sector_size);
755
756	sg_init_one(&src, page_address(ZERO_PAGE(0)), cc->iv_size);
757	sg_init_one(&dst, iv, cc->iv_size);
758	skcipher_request_set_crypt(req, &src, &dst, cc->iv_size, buf);
759	skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
760	err = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
761	skcipher_request_free(req);
762
763	return err;
764}
765
766static void crypt_iv_elephant_dtr(struct crypt_config *cc)
767{
768	struct iv_elephant_private *elephant = &cc->iv_gen_private.elephant;
769
770	crypto_free_skcipher(elephant->tfm);
771	elephant->tfm = NULL;
772}
773
774static int crypt_iv_elephant_ctr(struct crypt_config *cc, struct dm_target *ti,
775			    const char *opts)
776{
777	struct iv_elephant_private *elephant = &cc->iv_gen_private.elephant;
778	int r;
779
780	elephant->tfm = crypto_alloc_skcipher("ecb(aes)", 0,
781					      CRYPTO_ALG_ALLOCATES_MEMORY);
782	if (IS_ERR(elephant->tfm)) {
783		r = PTR_ERR(elephant->tfm);
784		elephant->tfm = NULL;
785		return r;
786	}
787
788	r = crypt_iv_eboiv_ctr(cc, ti, NULL);
789	if (r)
790		crypt_iv_elephant_dtr(cc);
791	return r;
792}
793
794static void diffuser_disk_to_cpu(u32 *d, size_t n)
795{
796#ifndef __LITTLE_ENDIAN
797	int i;
798
799	for (i = 0; i < n; i++)
800		d[i] = le32_to_cpu((__le32)d[i]);
801#endif
802}
803
804static void diffuser_cpu_to_disk(__le32 *d, size_t n)
805{
806#ifndef __LITTLE_ENDIAN
807	int i;
808
809	for (i = 0; i < n; i++)
810		d[i] = cpu_to_le32((u32)d[i]);
811#endif
812}
813
814static void diffuser_a_decrypt(u32 *d, size_t n)
815{
816	int i, i1, i2, i3;
817
818	for (i = 0; i < 5; i++) {
819		i1 = 0;
820		i2 = n - 2;
821		i3 = n - 5;
822
823		while (i1 < (n - 1)) {
824			d[i1] += d[i2] ^ (d[i3] << 9 | d[i3] >> 23);
825			i1++; i2++; i3++;
826
827			if (i3 >= n)
828				i3 -= n;
829
830			d[i1] += d[i2] ^ d[i3];
831			i1++; i2++; i3++;
832
833			if (i2 >= n)
834				i2 -= n;
835
836			d[i1] += d[i2] ^ (d[i3] << 13 | d[i3] >> 19);
837			i1++; i2++; i3++;
838
839			d[i1] += d[i2] ^ d[i3];
840			i1++; i2++; i3++;
841		}
842	}
843}
844
845static void diffuser_a_encrypt(u32 *d, size_t n)
846{
847	int i, i1, i2, i3;
848
849	for (i = 0; i < 5; i++) {
850		i1 = n - 1;
851		i2 = n - 2 - 1;
852		i3 = n - 5 - 1;
853
854		while (i1 > 0) {
855			d[i1] -= d[i2] ^ d[i3];
856			i1--; i2--; i3--;
857
858			d[i1] -= d[i2] ^ (d[i3] << 13 | d[i3] >> 19);
859			i1--; i2--; i3--;
860
861			if (i2 < 0)
862				i2 += n;
863
864			d[i1] -= d[i2] ^ d[i3];
865			i1--; i2--; i3--;
866
867			if (i3 < 0)
868				i3 += n;
869
870			d[i1] -= d[i2] ^ (d[i3] << 9 | d[i3] >> 23);
871			i1--; i2--; i3--;
872		}
873	}
874}
875
876static void diffuser_b_decrypt(u32 *d, size_t n)
877{
878	int i, i1, i2, i3;
879
880	for (i = 0; i < 3; i++) {
881		i1 = 0;
882		i2 = 2;
883		i3 = 5;
884
885		while (i1 < (n - 1)) {
886			d[i1] += d[i2] ^ d[i3];
887			i1++; i2++; i3++;
888
889			d[i1] += d[i2] ^ (d[i3] << 10 | d[i3] >> 22);
890			i1++; i2++; i3++;
891
892			if (i2 >= n)
893				i2 -= n;
894
895			d[i1] += d[i2] ^ d[i3];
896			i1++; i2++; i3++;
897
898			if (i3 >= n)
899				i3 -= n;
900
901			d[i1] += d[i2] ^ (d[i3] << 25 | d[i3] >> 7);
902			i1++; i2++; i3++;
903		}
904	}
905}
906
907static void diffuser_b_encrypt(u32 *d, size_t n)
908{
909	int i, i1, i2, i3;
910
911	for (i = 0; i < 3; i++) {
912		i1 = n - 1;
913		i2 = 2 - 1;
914		i3 = 5 - 1;
915
916		while (i1 > 0) {
917			d[i1] -= d[i2] ^ (d[i3] << 25 | d[i3] >> 7);
918			i1--; i2--; i3--;
919
920			if (i3 < 0)
921				i3 += n;
922
923			d[i1] -= d[i2] ^ d[i3];
924			i1--; i2--; i3--;
925
926			if (i2 < 0)
927				i2 += n;
928
929			d[i1] -= d[i2] ^ (d[i3] << 10 | d[i3] >> 22);
930			i1--; i2--; i3--;
931
932			d[i1] -= d[i2] ^ d[i3];
933			i1--; i2--; i3--;
934		}
935	}
936}
937
938static int crypt_iv_elephant(struct crypt_config *cc, struct dm_crypt_request *dmreq)
939{
940	struct iv_elephant_private *elephant = &cc->iv_gen_private.elephant;
941	u8 *es, *ks, *data, *data2, *data_offset;
942	struct skcipher_request *req;
943	struct scatterlist *sg, *sg2, src, dst;
944	DECLARE_CRYPTO_WAIT(wait);
945	int i, r;
946
947	req = skcipher_request_alloc(elephant->tfm, GFP_NOIO);
948	es = kzalloc(16, GFP_NOIO); /* Key for AES */
949	ks = kzalloc(32, GFP_NOIO); /* Elephant sector key */
950
951	if (!req || !es || !ks) {
952		r = -ENOMEM;
953		goto out;
954	}
955
956	*(__le64 *)es = cpu_to_le64(dmreq->iv_sector * cc->sector_size);
957
958	/* E(Ks, e(s)) */
959	sg_init_one(&src, es, 16);
960	sg_init_one(&dst, ks, 16);
961	skcipher_request_set_crypt(req, &src, &dst, 16, NULL);
962	skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
963	r = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
964	if (r)
965		goto out;
966
967	/* E(Ks, e'(s)) */
968	es[15] = 0x80;
969	sg_init_one(&dst, &ks[16], 16);
970	r = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
971	if (r)
972		goto out;
973
974	sg = crypt_get_sg_data(cc, dmreq->sg_out);
975	data = kmap_atomic(sg_page(sg));
976	data_offset = data + sg->offset;
977
978	/* Cannot modify original bio, copy to sg_out and apply Elephant to it */
979	if (bio_data_dir(dmreq->ctx->bio_in) == WRITE) {
980		sg2 = crypt_get_sg_data(cc, dmreq->sg_in);
981		data2 = kmap_atomic(sg_page(sg2));
982		memcpy(data_offset, data2 + sg2->offset, cc->sector_size);
983		kunmap_atomic(data2);
984	}
985
986	if (bio_data_dir(dmreq->ctx->bio_in) != WRITE) {
987		diffuser_disk_to_cpu((u32*)data_offset, cc->sector_size / sizeof(u32));
988		diffuser_b_decrypt((u32*)data_offset, cc->sector_size / sizeof(u32));
989		diffuser_a_decrypt((u32*)data_offset, cc->sector_size / sizeof(u32));
990		diffuser_cpu_to_disk((__le32*)data_offset, cc->sector_size / sizeof(u32));
991	}
992
993	for (i = 0; i < (cc->sector_size / 32); i++)
994		crypto_xor(data_offset + i * 32, ks, 32);
995
996	if (bio_data_dir(dmreq->ctx->bio_in) == WRITE) {
997		diffuser_disk_to_cpu((u32*)data_offset, cc->sector_size / sizeof(u32));
998		diffuser_a_encrypt((u32*)data_offset, cc->sector_size / sizeof(u32));
999		diffuser_b_encrypt((u32*)data_offset, cc->sector_size / sizeof(u32));
1000		diffuser_cpu_to_disk((__le32*)data_offset, cc->sector_size / sizeof(u32));
1001	}
1002
1003	kunmap_atomic(data);
1004out:
1005	kfree_sensitive(ks);
1006	kfree_sensitive(es);
1007	skcipher_request_free(req);
1008	return r;
1009}
1010
1011static int crypt_iv_elephant_gen(struct crypt_config *cc, u8 *iv,
1012			    struct dm_crypt_request *dmreq)
1013{
1014	int r;
1015
1016	if (bio_data_dir(dmreq->ctx->bio_in) == WRITE) {
1017		r = crypt_iv_elephant(cc, dmreq);
1018		if (r)
1019			return r;
1020	}
1021
1022	return crypt_iv_eboiv_gen(cc, iv, dmreq);
1023}
1024
1025static int crypt_iv_elephant_post(struct crypt_config *cc, u8 *iv,
1026				  struct dm_crypt_request *dmreq)
1027{
1028	if (bio_data_dir(dmreq->ctx->bio_in) != WRITE)
1029		return crypt_iv_elephant(cc, dmreq);
1030
1031	return 0;
1032}
1033
1034static int crypt_iv_elephant_init(struct crypt_config *cc)
1035{
1036	struct iv_elephant_private *elephant = &cc->iv_gen_private.elephant;
1037	int key_offset = cc->key_size - cc->key_extra_size;
1038
1039	return crypto_skcipher_setkey(elephant->tfm, &cc->key[key_offset], cc->key_extra_size);
1040}
1041
1042static int crypt_iv_elephant_wipe(struct crypt_config *cc)
1043{
1044	struct iv_elephant_private *elephant = &cc->iv_gen_private.elephant;
1045	u8 key[ELEPHANT_MAX_KEY_SIZE];
1046
1047	memset(key, 0, cc->key_extra_size);
1048	return crypto_skcipher_setkey(elephant->tfm, key, cc->key_extra_size);
1049}
1050
1051static const struct crypt_iv_operations crypt_iv_plain_ops = {
1052	.generator = crypt_iv_plain_gen
1053};
1054
1055static const struct crypt_iv_operations crypt_iv_plain64_ops = {
1056	.generator = crypt_iv_plain64_gen
1057};
1058
1059static const struct crypt_iv_operations crypt_iv_plain64be_ops = {
1060	.generator = crypt_iv_plain64be_gen
1061};
1062
1063static const struct crypt_iv_operations crypt_iv_essiv_ops = {
1064	.generator = crypt_iv_essiv_gen
1065};
1066
1067static const struct crypt_iv_operations crypt_iv_benbi_ops = {
1068	.ctr	   = crypt_iv_benbi_ctr,
1069	.dtr	   = crypt_iv_benbi_dtr,
1070	.generator = crypt_iv_benbi_gen
1071};
1072
1073static const struct crypt_iv_operations crypt_iv_null_ops = {
1074	.generator = crypt_iv_null_gen
1075};
1076
1077static const struct crypt_iv_operations crypt_iv_lmk_ops = {
1078	.ctr	   = crypt_iv_lmk_ctr,
1079	.dtr	   = crypt_iv_lmk_dtr,
1080	.init	   = crypt_iv_lmk_init,
1081	.wipe	   = crypt_iv_lmk_wipe,
1082	.generator = crypt_iv_lmk_gen,
1083	.post	   = crypt_iv_lmk_post
1084};
1085
1086static const struct crypt_iv_operations crypt_iv_tcw_ops = {
1087	.ctr	   = crypt_iv_tcw_ctr,
1088	.dtr	   = crypt_iv_tcw_dtr,
1089	.init	   = crypt_iv_tcw_init,
1090	.wipe	   = crypt_iv_tcw_wipe,
1091	.generator = crypt_iv_tcw_gen,
1092	.post	   = crypt_iv_tcw_post
1093};
1094
1095static struct crypt_iv_operations crypt_iv_random_ops = {
1096	.generator = crypt_iv_random_gen
1097};
1098
1099static struct crypt_iv_operations crypt_iv_eboiv_ops = {
1100	.ctr	   = crypt_iv_eboiv_ctr,
1101	.generator = crypt_iv_eboiv_gen
1102};
1103
1104static struct crypt_iv_operations crypt_iv_elephant_ops = {
1105	.ctr	   = crypt_iv_elephant_ctr,
1106	.dtr	   = crypt_iv_elephant_dtr,
1107	.init	   = crypt_iv_elephant_init,
1108	.wipe	   = crypt_iv_elephant_wipe,
1109	.generator = crypt_iv_elephant_gen,
1110	.post	   = crypt_iv_elephant_post
1111};
1112
1113/*
1114 * Integrity extensions
1115 */
1116static bool crypt_integrity_aead(struct crypt_config *cc)
1117{
1118	return test_bit(CRYPT_MODE_INTEGRITY_AEAD, &cc->cipher_flags);
1119}
1120
1121static bool crypt_integrity_hmac(struct crypt_config *cc)
1122{
1123	return crypt_integrity_aead(cc) && cc->key_mac_size;
1124}
1125
1126/* Get sg containing data */
1127static struct scatterlist *crypt_get_sg_data(struct crypt_config *cc,
1128					     struct scatterlist *sg)
1129{
1130	if (unlikely(crypt_integrity_aead(cc)))
1131		return &sg[2];
1132
1133	return sg;
1134}
1135
1136static int dm_crypt_integrity_io_alloc(struct dm_crypt_io *io, struct bio *bio)
1137{
1138	struct bio_integrity_payload *bip;
1139	unsigned int tag_len;
1140	int ret;
1141
1142	if (!bio_sectors(bio) || !io->cc->on_disk_tag_size)
1143		return 0;
1144
1145	bip = bio_integrity_alloc(bio, GFP_NOIO, 1);
1146	if (IS_ERR(bip))
1147		return PTR_ERR(bip);
1148
1149	tag_len = io->cc->on_disk_tag_size * (bio_sectors(bio) >> io->cc->sector_shift);
1150
1151	bip->bip_iter.bi_size = tag_len;
1152	bip->bip_iter.bi_sector = io->cc->start + io->sector;
1153
1154	ret = bio_integrity_add_page(bio, virt_to_page(io->integrity_metadata),
1155				     tag_len, offset_in_page(io->integrity_metadata));
1156	if (unlikely(ret != tag_len))
1157		return -ENOMEM;
1158
1159	return 0;
1160}
1161
1162static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
1163{
1164#ifdef CONFIG_BLK_DEV_INTEGRITY
1165	struct blk_integrity *bi = blk_get_integrity(cc->dev->bdev->bd_disk);
1166	struct mapped_device *md = dm_table_get_md(ti->table);
1167
1168	/* From now we require underlying device with our integrity profile */
1169	if (!bi || strcasecmp(bi->profile->name, "DM-DIF-EXT-TAG")) {
1170		ti->error = "Integrity profile not supported.";
1171		return -EINVAL;
1172	}
1173
1174	if (bi->tag_size != cc->on_disk_tag_size ||
1175	    bi->tuple_size != cc->on_disk_tag_size) {
1176		ti->error = "Integrity profile tag size mismatch.";
1177		return -EINVAL;
1178	}
1179	if (1 << bi->interval_exp != cc->sector_size) {
1180		ti->error = "Integrity profile sector size mismatch.";
1181		return -EINVAL;
1182	}
1183
1184	if (crypt_integrity_aead(cc)) {
1185		cc->integrity_tag_size = cc->on_disk_tag_size - cc->integrity_iv_size;
1186		DMDEBUG("%s: Integrity AEAD, tag size %u, IV size %u.", dm_device_name(md),
1187		       cc->integrity_tag_size, cc->integrity_iv_size);
1188
1189		if (crypto_aead_setauthsize(any_tfm_aead(cc), cc->integrity_tag_size)) {
1190			ti->error = "Integrity AEAD auth tag size is not supported.";
1191			return -EINVAL;
1192		}
1193	} else if (cc->integrity_iv_size)
1194		DMDEBUG("%s: Additional per-sector space %u bytes for IV.", dm_device_name(md),
1195		       cc->integrity_iv_size);
1196
1197	if ((cc->integrity_tag_size + cc->integrity_iv_size) != bi->tag_size) {
1198		ti->error = "Not enough space for integrity tag in the profile.";
1199		return -EINVAL;
1200	}
1201
1202	return 0;
1203#else
1204	ti->error = "Integrity profile not supported.";
1205	return -EINVAL;
1206#endif
1207}
1208
1209static void crypt_convert_init(struct crypt_config *cc,
1210			       struct convert_context *ctx,
1211			       struct bio *bio_out, struct bio *bio_in,
1212			       sector_t sector)
1213{
1214	ctx->bio_in = bio_in;
1215	ctx->bio_out = bio_out;
1216	if (bio_in)
1217		ctx->iter_in = bio_in->bi_iter;
1218	if (bio_out)
1219		ctx->iter_out = bio_out->bi_iter;
1220	ctx->cc_sector = sector + cc->iv_offset;
1221	init_completion(&ctx->restart);
1222}
1223
1224static struct dm_crypt_request *dmreq_of_req(struct crypt_config *cc,
1225					     void *req)
1226{
1227	return (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
1228}
1229
1230static void *req_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq)
1231{
1232	return (void *)((char *)dmreq - cc->dmreq_start);
1233}
1234
1235static u8 *iv_of_dmreq(struct crypt_config *cc,
1236		       struct dm_crypt_request *dmreq)
1237{
1238	if (crypt_integrity_aead(cc))
1239		return (u8 *)ALIGN((unsigned long)(dmreq + 1),
1240			crypto_aead_alignmask(any_tfm_aead(cc)) + 1);
1241	else
1242		return (u8 *)ALIGN((unsigned long)(dmreq + 1),
1243			crypto_skcipher_alignmask(any_tfm(cc)) + 1);
1244}
1245
1246static u8 *org_iv_of_dmreq(struct crypt_config *cc,
1247		       struct dm_crypt_request *dmreq)
1248{
1249	return iv_of_dmreq(cc, dmreq) + cc->iv_size;
1250}
1251
1252static __le64 *org_sector_of_dmreq(struct crypt_config *cc,
1253		       struct dm_crypt_request *dmreq)
1254{
1255	u8 *ptr = iv_of_dmreq(cc, dmreq) + cc->iv_size + cc->iv_size;
1256	return (__le64 *) ptr;
1257}
1258
1259static unsigned int *org_tag_of_dmreq(struct crypt_config *cc,
1260		       struct dm_crypt_request *dmreq)
1261{
1262	u8 *ptr = iv_of_dmreq(cc, dmreq) + cc->iv_size +
1263		  cc->iv_size + sizeof(uint64_t);
1264	return (unsigned int*)ptr;
1265}
1266
1267static void *tag_from_dmreq(struct crypt_config *cc,
1268				struct dm_crypt_request *dmreq)
1269{
1270	struct convert_context *ctx = dmreq->ctx;
1271	struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
1272
1273	return &io->integrity_metadata[*org_tag_of_dmreq(cc, dmreq) *
1274		cc->on_disk_tag_size];
1275}
1276
1277static void *iv_tag_from_dmreq(struct crypt_config *cc,
1278			       struct dm_crypt_request *dmreq)
1279{
1280	return tag_from_dmreq(cc, dmreq) + cc->integrity_tag_size;
1281}
1282
1283static int crypt_convert_block_aead(struct crypt_config *cc,
1284				     struct convert_context *ctx,
1285				     struct aead_request *req,
1286				     unsigned int tag_offset)
1287{
1288	struct bio_vec bv_in = bio_iter_iovec(ctx->bio_in, ctx->iter_in);
1289	struct bio_vec bv_out = bio_iter_iovec(ctx->bio_out, ctx->iter_out);
1290	struct dm_crypt_request *dmreq;
1291	u8 *iv, *org_iv, *tag_iv, *tag;
1292	__le64 *sector;
1293	int r = 0;
1294
1295	BUG_ON(cc->integrity_iv_size && cc->integrity_iv_size != cc->iv_size);
1296
1297	/* Reject unexpected unaligned bio. */
1298	if (unlikely(bv_in.bv_len & (cc->sector_size - 1)))
1299		return -EIO;
1300
1301	dmreq = dmreq_of_req(cc, req);
1302	dmreq->iv_sector = ctx->cc_sector;
1303	if (test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags))
1304		dmreq->iv_sector >>= cc->sector_shift;
1305	dmreq->ctx = ctx;
1306
1307	*org_tag_of_dmreq(cc, dmreq) = tag_offset;
1308
1309	sector = org_sector_of_dmreq(cc, dmreq);
1310	*sector = cpu_to_le64(ctx->cc_sector - cc->iv_offset);
1311
1312	iv = iv_of_dmreq(cc, dmreq);
1313	org_iv = org_iv_of_dmreq(cc, dmreq);
1314	tag = tag_from_dmreq(cc, dmreq);
1315	tag_iv = iv_tag_from_dmreq(cc, dmreq);
1316
1317	/* AEAD request:
1318	 *  |----- AAD -------|------ DATA -------|-- AUTH TAG --|
1319	 *  | (authenticated) | (auth+encryption) |              |
1320	 *  | sector_LE |  IV |  sector in/out    |  tag in/out  |
1321	 */
1322	sg_init_table(dmreq->sg_in, 4);
1323	sg_set_buf(&dmreq->sg_in[0], sector, sizeof(uint64_t));
1324	sg_set_buf(&dmreq->sg_in[1], org_iv, cc->iv_size);
1325	sg_set_page(&dmreq->sg_in[2], bv_in.bv_page, cc->sector_size, bv_in.bv_offset);
1326	sg_set_buf(&dmreq->sg_in[3], tag, cc->integrity_tag_size);
1327
1328	sg_init_table(dmreq->sg_out, 4);
1329	sg_set_buf(&dmreq->sg_out[0], sector, sizeof(uint64_t));
1330	sg_set_buf(&dmreq->sg_out[1], org_iv, cc->iv_size);
1331	sg_set_page(&dmreq->sg_out[2], bv_out.bv_page, cc->sector_size, bv_out.bv_offset);
1332	sg_set_buf(&dmreq->sg_out[3], tag, cc->integrity_tag_size);
1333
1334	if (cc->iv_gen_ops) {
1335		/* For READs use IV stored in integrity metadata */
1336		if (cc->integrity_iv_size && bio_data_dir(ctx->bio_in) != WRITE) {
1337			memcpy(org_iv, tag_iv, cc->iv_size);
1338		} else {
1339			r = cc->iv_gen_ops->generator(cc, org_iv, dmreq);
1340			if (r < 0)
1341				return r;
1342			/* Store generated IV in integrity metadata */
1343			if (cc->integrity_iv_size)
1344				memcpy(tag_iv, org_iv, cc->iv_size);
1345		}
1346		/* Working copy of IV, to be modified in crypto API */
1347		memcpy(iv, org_iv, cc->iv_size);
1348	}
1349
1350	aead_request_set_ad(req, sizeof(uint64_t) + cc->iv_size);
1351	if (bio_data_dir(ctx->bio_in) == WRITE) {
1352		aead_request_set_crypt(req, dmreq->sg_in, dmreq->sg_out,
1353				       cc->sector_size, iv);
1354		r = crypto_aead_encrypt(req);
1355		if (cc->integrity_tag_size + cc->integrity_iv_size != cc->on_disk_tag_size)
1356			memset(tag + cc->integrity_tag_size + cc->integrity_iv_size, 0,
1357			       cc->on_disk_tag_size - (cc->integrity_tag_size + cc->integrity_iv_size));
1358	} else {
1359		aead_request_set_crypt(req, dmreq->sg_in, dmreq->sg_out,
1360				       cc->sector_size + cc->integrity_tag_size, iv);
1361		r = crypto_aead_decrypt(req);
1362	}
1363
1364	if (r == -EBADMSG) {
1365		char b[BDEVNAME_SIZE];
1366		DMERR_LIMIT("%s: INTEGRITY AEAD ERROR, sector %llu", bio_devname(ctx->bio_in, b),
1367			    (unsigned long long)le64_to_cpu(*sector));
1368	}
1369
1370	if (!r && cc->iv_gen_ops && cc->iv_gen_ops->post)
1371		r = cc->iv_gen_ops->post(cc, org_iv, dmreq);
1372
1373	bio_advance_iter(ctx->bio_in, &ctx->iter_in, cc->sector_size);
1374	bio_advance_iter(ctx->bio_out, &ctx->iter_out, cc->sector_size);
1375
1376	return r;
1377}
1378
1379static int crypt_convert_block_skcipher(struct crypt_config *cc,
1380					struct convert_context *ctx,
1381					struct skcipher_request *req,
1382					unsigned int tag_offset)
1383{
1384	struct bio_vec bv_in = bio_iter_iovec(ctx->bio_in, ctx->iter_in);
1385	struct bio_vec bv_out = bio_iter_iovec(ctx->bio_out, ctx->iter_out);
1386	struct scatterlist *sg_in, *sg_out;
1387	struct dm_crypt_request *dmreq;
1388	u8 *iv, *org_iv, *tag_iv;
1389	__le64 *sector;
1390	int r = 0;
1391
1392	/* Reject unexpected unaligned bio. */
1393	if (unlikely(bv_in.bv_len & (cc->sector_size - 1)))
1394		return -EIO;
1395
1396	dmreq = dmreq_of_req(cc, req);
1397	dmreq->iv_sector = ctx->cc_sector;
1398	if (test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags))
1399		dmreq->iv_sector >>= cc->sector_shift;
1400	dmreq->ctx = ctx;
1401
1402	*org_tag_of_dmreq(cc, dmreq) = tag_offset;
1403
1404	iv = iv_of_dmreq(cc, dmreq);
1405	org_iv = org_iv_of_dmreq(cc, dmreq);
1406	tag_iv = iv_tag_from_dmreq(cc, dmreq);
1407
1408	sector = org_sector_of_dmreq(cc, dmreq);
1409	*sector = cpu_to_le64(ctx->cc_sector - cc->iv_offset);
1410
1411	/* For skcipher we use only the first sg item */
1412	sg_in  = &dmreq->sg_in[0];
1413	sg_out = &dmreq->sg_out[0];
1414
1415	sg_init_table(sg_in, 1);
1416	sg_set_page(sg_in, bv_in.bv_page, cc->sector_size, bv_in.bv_offset);
1417
1418	sg_init_table(sg_out, 1);
1419	sg_set_page(sg_out, bv_out.bv_page, cc->sector_size, bv_out.bv_offset);
1420
1421	if (cc->iv_gen_ops) {
1422		/* For READs use IV stored in integrity metadata */
1423		if (cc->integrity_iv_size && bio_data_dir(ctx->bio_in) != WRITE) {
1424			memcpy(org_iv, tag_iv, cc->integrity_iv_size);
1425		} else {
1426			r = cc->iv_gen_ops->generator(cc, org_iv, dmreq);
1427			if (r < 0)
1428				return r;
1429			/* Data can be already preprocessed in generator */
1430			if (test_bit(CRYPT_ENCRYPT_PREPROCESS, &cc->cipher_flags))
1431				sg_in = sg_out;
1432			/* Store generated IV in integrity metadata */
1433			if (cc->integrity_iv_size)
1434				memcpy(tag_iv, org_iv, cc->integrity_iv_size);
1435		}
1436		/* Working copy of IV, to be modified in crypto API */
1437		memcpy(iv, org_iv, cc->iv_size);
1438	}
1439
1440	skcipher_request_set_crypt(req, sg_in, sg_out, cc->sector_size, iv);
1441
1442	if (bio_data_dir(ctx->bio_in) == WRITE)
1443		r = crypto_skcipher_encrypt(req);
1444	else
1445		r = crypto_skcipher_decrypt(req);
1446
1447	if (!r && cc->iv_gen_ops && cc->iv_gen_ops->post)
1448		r = cc->iv_gen_ops->post(cc, org_iv, dmreq);
1449
1450	bio_advance_iter(ctx->bio_in, &ctx->iter_in, cc->sector_size);
1451	bio_advance_iter(ctx->bio_out, &ctx->iter_out, cc->sector_size);
1452
1453	return r;
1454}
1455
1456static void kcryptd_async_done(struct crypto_async_request *async_req,
1457			       int error);
1458
1459static int crypt_alloc_req_skcipher(struct crypt_config *cc,
1460				     struct convert_context *ctx)
1461{
1462	unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
1463
1464	if (!ctx->r.req) {
1465		ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
1466		if (!ctx->r.req)
1467			return -ENOMEM;
1468	}
1469
1470	skcipher_request_set_tfm(ctx->r.req, cc->cipher_tfm.tfms[key_index]);
1471
1472	/*
1473	 * Use REQ_MAY_BACKLOG so a cipher driver internally backlogs
1474	 * requests if driver request queue is full.
1475	 */
1476	skcipher_request_set_callback(ctx->r.req,
1477	    CRYPTO_TFM_REQ_MAY_BACKLOG,
1478	    kcryptd_async_done, dmreq_of_req(cc, ctx->r.req));
1479
1480	return 0;
1481}
1482
1483static int crypt_alloc_req_aead(struct crypt_config *cc,
1484				 struct convert_context *ctx)
1485{
1486	if (!ctx->r.req_aead) {
1487		ctx->r.req_aead = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
1488		if (!ctx->r.req_aead)
1489			return -ENOMEM;
1490	}
1491
1492	aead_request_set_tfm(ctx->r.req_aead, cc->cipher_tfm.tfms_aead[0]);
1493
1494	/*
1495	 * Use REQ_MAY_BACKLOG so a cipher driver internally backlogs
1496	 * requests if driver request queue is full.
1497	 */
1498	aead_request_set_callback(ctx->r.req_aead,
1499	    CRYPTO_TFM_REQ_MAY_BACKLOG,
1500	    kcryptd_async_done, dmreq_of_req(cc, ctx->r.req_aead));
1501
1502	return 0;
1503}
1504
1505static int crypt_alloc_req(struct crypt_config *cc,
1506			    struct convert_context *ctx)
1507{
1508	if (crypt_integrity_aead(cc))
1509		return crypt_alloc_req_aead(cc, ctx);
1510	else
1511		return crypt_alloc_req_skcipher(cc, ctx);
1512}
1513
1514static void crypt_free_req_skcipher(struct crypt_config *cc,
1515				    struct skcipher_request *req, struct bio *base_bio)
1516{
1517	struct dm_crypt_io *io = dm_per_bio_data(base_bio, cc->per_bio_data_size);
1518
1519	if ((struct skcipher_request *)(io + 1) != req)
1520		mempool_free(req, &cc->req_pool);
1521}
1522
1523static void crypt_free_req_aead(struct crypt_config *cc,
1524				struct aead_request *req, struct bio *base_bio)
1525{
1526	struct dm_crypt_io *io = dm_per_bio_data(base_bio, cc->per_bio_data_size);
1527
1528	if ((struct aead_request *)(io + 1) != req)
1529		mempool_free(req, &cc->req_pool);
1530}
1531
1532static void crypt_free_req(struct crypt_config *cc, void *req, struct bio *base_bio)
1533{
1534	if (crypt_integrity_aead(cc))
1535		crypt_free_req_aead(cc, req, base_bio);
1536	else
1537		crypt_free_req_skcipher(cc, req, base_bio);
1538}
1539
1540/*
1541 * Encrypt / decrypt data from one bio to another one (can be the same one)
1542 */
1543static blk_status_t crypt_convert(struct crypt_config *cc,
1544			 struct convert_context *ctx, bool atomic, bool reset_pending)
1545{
1546	unsigned int tag_offset = 0;
1547	unsigned int sector_step = cc->sector_size >> SECTOR_SHIFT;
1548	int r;
1549
1550	/*
1551	 * if reset_pending is set we are dealing with the bio for the first time,
1552	 * else we're continuing to work on the previous bio, so don't mess with
1553	 * the cc_pending counter
1554	 */
1555	if (reset_pending)
1556		atomic_set(&ctx->cc_pending, 1);
1557
1558	while (ctx->iter_in.bi_size && ctx->iter_out.bi_size) {
1559
1560		r = crypt_alloc_req(cc, ctx);
1561		if (r) {
1562			complete(&ctx->restart);
1563			return BLK_STS_DEV_RESOURCE;
1564		}
1565
1566		atomic_inc(&ctx->cc_pending);
1567
1568		if (crypt_integrity_aead(cc))
1569			r = crypt_convert_block_aead(cc, ctx, ctx->r.req_aead, tag_offset);
1570		else
1571			r = crypt_convert_block_skcipher(cc, ctx, ctx->r.req, tag_offset);
1572
1573		switch (r) {
1574		/*
1575		 * The request was queued by a crypto driver
1576		 * but the driver request queue is full, let's wait.
1577		 */
1578		case -EBUSY:
1579			if (in_interrupt()) {
1580				if (try_wait_for_completion(&ctx->restart)) {
1581					/*
1582					 * we don't have to block to wait for completion,
1583					 * so proceed
1584					 */
1585				} else {
1586					/*
1587					 * we can't wait for completion without blocking
1588					 * exit and continue processing in a workqueue
1589					 */
1590					ctx->r.req = NULL;
1591					ctx->cc_sector += sector_step;
1592					tag_offset++;
1593					return BLK_STS_DEV_RESOURCE;
1594				}
1595			} else {
1596				wait_for_completion(&ctx->restart);
1597			}
1598			reinit_completion(&ctx->restart);
1599			fallthrough;
1600		/*
1601		 * The request is queued and processed asynchronously,
1602		 * completion function kcryptd_async_done() will be called.
1603		 */
1604		case -EINPROGRESS:
1605			ctx->r.req = NULL;
1606			ctx->cc_sector += sector_step;
1607			tag_offset++;
1608			continue;
1609		/*
1610		 * The request was already processed (synchronously).
1611		 */
1612		case 0:
1613			atomic_dec(&ctx->cc_pending);
1614			ctx->cc_sector += sector_step;
1615			tag_offset++;
1616			if (!atomic)
1617				cond_resched();
1618			continue;
1619		/*
1620		 * There was a data integrity error.
1621		 */
1622		case -EBADMSG:
1623			atomic_dec(&ctx->cc_pending);
1624			return BLK_STS_PROTECTION;
1625		/*
1626		 * There was an error while processing the request.
1627		 */
1628		default:
1629			atomic_dec(&ctx->cc_pending);
1630			return BLK_STS_IOERR;
1631		}
1632	}
1633
1634	return 0;
1635}
1636
1637static void crypt_free_buffer_pages(struct crypt_config *cc, struct bio *clone);
1638
1639/*
1640 * Generate a new unfragmented bio with the given size
1641 * This should never violate the device limitations (but only because
1642 * max_segment_size is being constrained to PAGE_SIZE).
1643 *
1644 * This function may be called concurrently. If we allocate from the mempool
1645 * concurrently, there is a possibility of deadlock. For example, if we have
1646 * mempool of 256 pages, two processes, each wanting 256, pages allocate from
1647 * the mempool concurrently, it may deadlock in a situation where both processes
1648 * have allocated 128 pages and the mempool is exhausted.
1649 *
1650 * In order to avoid this scenario we allocate the pages under a mutex.
1651 *
1652 * In order to not degrade performance with excessive locking, we try
1653 * non-blocking allocations without a mutex first but on failure we fallback
1654 * to blocking allocations with a mutex.
1655 */
1656static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned size)
1657{
1658	struct crypt_config *cc = io->cc;
1659	struct bio *clone;
1660	unsigned int nr_iovecs = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
1661	gfp_t gfp_mask = GFP_NOWAIT | __GFP_HIGHMEM;
1662	unsigned i, len, remaining_size;
1663	struct page *page;
1664
1665retry:
1666	if (unlikely(gfp_mask & __GFP_DIRECT_RECLAIM))
1667		mutex_lock(&cc->bio_alloc_lock);
1668
1669	clone = bio_alloc_bioset(GFP_NOIO, nr_iovecs, &cc->bs);
1670	if (!clone)
1671		goto out;
1672
1673	clone_init(io, clone);
1674
1675	remaining_size = size;
1676
1677	for (i = 0; i < nr_iovecs; i++) {
1678		page = mempool_alloc(&cc->page_pool, gfp_mask);
1679		if (!page) {
1680			crypt_free_buffer_pages(cc, clone);
1681			bio_put(clone);
1682			gfp_mask |= __GFP_DIRECT_RECLAIM;
1683			goto retry;
1684		}
1685
1686		len = (remaining_size > PAGE_SIZE) ? PAGE_SIZE : remaining_size;
1687
1688		bio_add_page(clone, page, len, 0);
1689
1690		remaining_size -= len;
1691	}
1692
1693	/* Allocate space for integrity tags */
1694	if (dm_crypt_integrity_io_alloc(io, clone)) {
1695		crypt_free_buffer_pages(cc, clone);
1696		bio_put(clone);
1697		clone = NULL;
1698	}
1699out:
1700	if (unlikely(gfp_mask & __GFP_DIRECT_RECLAIM))
1701		mutex_unlock(&cc->bio_alloc_lock);
1702
1703	return clone;
1704}
1705
1706static void crypt_free_buffer_pages(struct crypt_config *cc, struct bio *clone)
1707{
1708	struct bio_vec *bv;
1709	struct bvec_iter_all iter_all;
1710
1711	bio_for_each_segment_all(bv, clone, iter_all) {
1712		BUG_ON(!bv->bv_page);
1713		mempool_free(bv->bv_page, &cc->page_pool);
1714	}
1715}
1716
1717static void crypt_io_init(struct dm_crypt_io *io, struct crypt_config *cc,
1718			  struct bio *bio, sector_t sector)
1719{
1720	io->cc = cc;
1721	io->base_bio = bio;
1722	io->sector = sector;
1723	io->error = 0;
1724	io->ctx.r.req = NULL;
1725	io->integrity_metadata = NULL;
1726	io->integrity_metadata_from_pool = false;
1727	io->in_tasklet = false;
1728	atomic_set(&io->io_pending, 0);
1729}
1730
1731static void crypt_inc_pending(struct dm_crypt_io *io)
1732{
1733	atomic_inc(&io->io_pending);
1734}
1735
1736static void kcryptd_io_bio_endio(struct work_struct *work)
1737{
1738	struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
1739	bio_endio(io->base_bio);
1740}
1741
1742/*
1743 * One of the bios was finished. Check for completion of
1744 * the whole request and correctly clean up the buffer.
1745 */
1746static void crypt_dec_pending(struct dm_crypt_io *io)
1747{
1748	struct crypt_config *cc = io->cc;
1749	struct bio *base_bio = io->base_bio;
1750	blk_status_t error = io->error;
1751
1752	if (!atomic_dec_and_test(&io->io_pending))
1753		return;
1754
1755	if (io->ctx.r.req)
1756		crypt_free_req(cc, io->ctx.r.req, base_bio);
1757
1758	if (unlikely(io->integrity_metadata_from_pool))
1759		mempool_free(io->integrity_metadata, &io->cc->tag_pool);
1760	else
1761		kfree(io->integrity_metadata);
1762
1763	base_bio->bi_status = error;
1764
1765	/*
1766	 * If we are running this function from our tasklet,
1767	 * we can't call bio_endio() here, because it will call
1768	 * clone_endio() from dm.c, which in turn will
1769	 * free the current struct dm_crypt_io structure with
1770	 * our tasklet. In this case we need to delay bio_endio()
1771	 * execution to after the tasklet is done and dequeued.
1772	 */
1773	if (io->in_tasklet) {
1774		INIT_WORK(&io->work, kcryptd_io_bio_endio);
1775		queue_work(cc->io_queue, &io->work);
1776		return;
1777	}
1778
1779	bio_endio(base_bio);
1780}
1781
1782/*
1783 * kcryptd/kcryptd_io:
1784 *
1785 * Needed because it would be very unwise to do decryption in an
1786 * interrupt context.
1787 *
1788 * kcryptd performs the actual encryption or decryption.
1789 *
1790 * kcryptd_io performs the IO submission.
1791 *
1792 * They must be separated as otherwise the final stages could be
1793 * starved by new requests which can block in the first stages due
1794 * to memory allocation.
1795 *
1796 * The work is done per CPU global for all dm-crypt instances.
1797 * They should not depend on each other and do not block.
1798 */
1799static void crypt_endio(struct bio *clone)
1800{
1801	struct dm_crypt_io *io = clone->bi_private;
1802	struct crypt_config *cc = io->cc;
1803	unsigned rw = bio_data_dir(clone);
1804	blk_status_t error;
1805
1806	/*
1807	 * free the processed pages
1808	 */
1809	if (rw == WRITE)
1810		crypt_free_buffer_pages(cc, clone);
1811
1812	error = clone->bi_status;
1813	bio_put(clone);
1814
1815	if (rw == READ && !error) {
1816		kcryptd_queue_crypt(io);
1817		return;
1818	}
1819
1820	if (unlikely(error))
1821		io->error = error;
1822
1823	crypt_dec_pending(io);
1824}
1825
1826static void clone_init(struct dm_crypt_io *io, struct bio *clone)
1827{
1828	struct crypt_config *cc = io->cc;
1829
1830	clone->bi_private = io;
1831	clone->bi_end_io  = crypt_endio;
1832	bio_set_dev(clone, cc->dev->bdev);
1833	clone->bi_opf	  = io->base_bio->bi_opf;
1834}
1835
1836static int kcryptd_io_read(struct dm_crypt_io *io, gfp_t gfp)
1837{
1838	struct crypt_config *cc = io->cc;
1839	struct bio *clone;
1840
1841	/*
1842	 * We need the original biovec array in order to decrypt
1843	 * the whole bio data *afterwards* -- thanks to immutable
1844	 * biovecs we don't need to worry about the block layer
1845	 * modifying the biovec array; so leverage bio_clone_fast().
1846	 */
1847	clone = bio_clone_fast(io->base_bio, gfp, &cc->bs);
1848	if (!clone)
1849		return 1;
1850
1851	crypt_inc_pending(io);
1852
1853	clone_init(io, clone);
1854	clone->bi_iter.bi_sector = cc->start + io->sector;
1855
1856	if (dm_crypt_integrity_io_alloc(io, clone)) {
1857		crypt_dec_pending(io);
1858		bio_put(clone);
1859		return 1;
1860	}
1861
1862	submit_bio_noacct(clone);
1863	return 0;
1864}
1865
1866static void kcryptd_io_read_work(struct work_struct *work)
1867{
1868	struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
1869
1870	crypt_inc_pending(io);
1871	if (kcryptd_io_read(io, GFP_NOIO))
1872		io->error = BLK_STS_RESOURCE;
1873	crypt_dec_pending(io);
1874}
1875
1876static void kcryptd_queue_read(struct dm_crypt_io *io)
1877{
1878	struct crypt_config *cc = io->cc;
1879
1880	INIT_WORK(&io->work, kcryptd_io_read_work);
1881	queue_work(cc->io_queue, &io->work);
1882}
1883
1884static void kcryptd_io_write(struct dm_crypt_io *io)
1885{
1886	struct bio *clone = io->ctx.bio_out;
1887
1888	submit_bio_noacct(clone);
1889}
1890
1891#define crypt_io_from_node(node) rb_entry((node), struct dm_crypt_io, rb_node)
1892
1893static int dmcrypt_write(void *data)
1894{
1895	struct crypt_config *cc = data;
1896	struct dm_crypt_io *io;
1897
1898	while (1) {
1899		struct rb_root write_tree;
1900		struct blk_plug plug;
1901
1902		spin_lock_irq(&cc->write_thread_lock);
1903continue_locked:
1904
1905		if (!RB_EMPTY_ROOT(&cc->write_tree))
1906			goto pop_from_list;
1907
1908		set_current_state(TASK_INTERRUPTIBLE);
1909
1910		spin_unlock_irq(&cc->write_thread_lock);
1911
1912		if (unlikely(kthread_should_stop())) {
1913			set_current_state(TASK_RUNNING);
1914			break;
1915		}
1916
1917		schedule();
1918
1919		set_current_state(TASK_RUNNING);
1920		spin_lock_irq(&cc->write_thread_lock);
1921		goto continue_locked;
1922
1923pop_from_list:
1924		write_tree = cc->write_tree;
1925		cc->write_tree = RB_ROOT;
1926		spin_unlock_irq(&cc->write_thread_lock);
1927
1928		BUG_ON(rb_parent(write_tree.rb_node));
1929
1930		/*
1931		 * Note: we cannot walk the tree here with rb_next because
1932		 * the structures may be freed when kcryptd_io_write is called.
1933		 */
1934		blk_start_plug(&plug);
1935		do {
1936			io = crypt_io_from_node(rb_first(&write_tree));
1937			rb_erase(&io->rb_node, &write_tree);
1938			kcryptd_io_write(io);
1939			cond_resched();
1940		} while (!RB_EMPTY_ROOT(&write_tree));
1941		blk_finish_plug(&plug);
1942	}
1943	return 0;
1944}
1945
1946static void kcryptd_crypt_write_io_submit(struct dm_crypt_io *io, int async)
1947{
1948	struct bio *clone = io->ctx.bio_out;
1949	struct crypt_config *cc = io->cc;
1950	unsigned long flags;
1951	sector_t sector;
1952	struct rb_node **rbp, *parent;
1953
1954	if (unlikely(io->error)) {
1955		crypt_free_buffer_pages(cc, clone);
1956		bio_put(clone);
1957		crypt_dec_pending(io);
1958		return;
1959	}
1960
1961	/* crypt_convert should have filled the clone bio */
1962	BUG_ON(io->ctx.iter_out.bi_size);
1963
1964	clone->bi_iter.bi_sector = cc->start + io->sector;
1965
1966	if ((likely(!async) && test_bit(DM_CRYPT_NO_OFFLOAD, &cc->flags)) ||
1967	    test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags)) {
1968		submit_bio_noacct(clone);
1969		return;
1970	}
1971
1972	spin_lock_irqsave(&cc->write_thread_lock, flags);
1973	if (RB_EMPTY_ROOT(&cc->write_tree))
1974		wake_up_process(cc->write_thread);
1975	rbp = &cc->write_tree.rb_node;
1976	parent = NULL;
1977	sector = io->sector;
1978	while (*rbp) {
1979		parent = *rbp;
1980		if (sector < crypt_io_from_node(parent)->sector)
1981			rbp = &(*rbp)->rb_left;
1982		else
1983			rbp = &(*rbp)->rb_right;
1984	}
1985	rb_link_node(&io->rb_node, parent, rbp);
1986	rb_insert_color(&io->rb_node, &cc->write_tree);
1987	spin_unlock_irqrestore(&cc->write_thread_lock, flags);
1988}
1989
1990static bool kcryptd_crypt_write_inline(struct crypt_config *cc,
1991				       struct convert_context *ctx)
1992
1993{
1994	if (!test_bit(DM_CRYPT_WRITE_INLINE, &cc->flags))
1995		return false;
1996
1997	/*
1998	 * Note: zone append writes (REQ_OP_ZONE_APPEND) do not have ordering
1999	 * constraints so they do not need to be issued inline by
2000	 * kcryptd_crypt_write_convert().
2001	 */
2002	switch (bio_op(ctx->bio_in)) {
2003	case REQ_OP_WRITE:
2004	case REQ_OP_WRITE_SAME:
2005	case REQ_OP_WRITE_ZEROES:
2006		return true;
2007	default:
2008		return false;
2009	}
2010}
2011
2012static void kcryptd_crypt_write_continue(struct work_struct *work)
2013{
2014	struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
2015	struct crypt_config *cc = io->cc;
2016	struct convert_context *ctx = &io->ctx;
2017	int crypt_finished;
2018	sector_t sector = io->sector;
2019	blk_status_t r;
2020
2021	wait_for_completion(&ctx->restart);
2022	reinit_completion(&ctx->restart);
2023
2024	r = crypt_convert(cc, &io->ctx, true, false);
2025	if (r)
2026		io->error = r;
2027	crypt_finished = atomic_dec_and_test(&ctx->cc_pending);
2028	if (!crypt_finished && kcryptd_crypt_write_inline(cc, ctx)) {
2029		/* Wait for completion signaled by kcryptd_async_done() */
2030		wait_for_completion(&ctx->restart);
2031		crypt_finished = 1;
2032	}
2033
2034	/* Encryption was already finished, submit io now */
2035	if (crypt_finished) {
2036		kcryptd_crypt_write_io_submit(io, 0);
2037		io->sector = sector;
2038	}
2039
2040	crypt_dec_pending(io);
2041}
2042
2043static void kcryptd_crypt_write_convert(struct dm_crypt_io *io)
2044{
2045	struct crypt_config *cc = io->cc;
2046	struct convert_context *ctx = &io->ctx;
2047	struct bio *clone;
2048	int crypt_finished;
2049	sector_t sector = io->sector;
2050	blk_status_t r;
2051
2052	/*
2053	 * Prevent io from disappearing until this function completes.
2054	 */
2055	crypt_inc_pending(io);
2056	crypt_convert_init(cc, ctx, NULL, io->base_bio, sector);
2057
2058	clone = crypt_alloc_buffer(io, io->base_bio->bi_iter.bi_size);
2059	if (unlikely(!clone)) {
2060		io->error = BLK_STS_IOERR;
2061		goto dec;
2062	}
2063
2064	io->ctx.bio_out = clone;
2065	io->ctx.iter_out = clone->bi_iter;
2066
2067	sector += bio_sectors(clone);
2068
2069	crypt_inc_pending(io);
2070	r = crypt_convert(cc, ctx,
2071			  test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags), true);
2072	/*
2073	 * Crypto API backlogged the request, because its queue was full
2074	 * and we're in softirq context, so continue from a workqueue
2075	 * (TODO: is it actually possible to be in softirq in the write path?)
2076	 */
2077	if (r == BLK_STS_DEV_RESOURCE) {
2078		INIT_WORK(&io->work, kcryptd_crypt_write_continue);
2079		queue_work(cc->crypt_queue, &io->work);
2080		return;
2081	}
2082	if (r)
2083		io->error = r;
2084	crypt_finished = atomic_dec_and_test(&ctx->cc_pending);
2085	if (!crypt_finished && kcryptd_crypt_write_inline(cc, ctx)) {
2086		/* Wait for completion signaled by kcryptd_async_done() */
2087		wait_for_completion(&ctx->restart);
2088		crypt_finished = 1;
2089	}
2090
2091	/* Encryption was already finished, submit io now */
2092	if (crypt_finished) {
2093		kcryptd_crypt_write_io_submit(io, 0);
2094		io->sector = sector;
2095	}
2096
2097dec:
2098	crypt_dec_pending(io);
2099}
2100
2101static void kcryptd_crypt_read_done(struct dm_crypt_io *io)
2102{
2103	crypt_dec_pending(io);
2104}
2105
2106static void kcryptd_crypt_read_continue(struct work_struct *work)
2107{
2108	struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
2109	struct crypt_config *cc = io->cc;
2110	blk_status_t r;
2111
2112	wait_for_completion(&io->ctx.restart);
2113	reinit_completion(&io->ctx.restart);
2114
2115	r = crypt_convert(cc, &io->ctx, true, false);
2116	if (r)
2117		io->error = r;
2118
2119	if (atomic_dec_and_test(&io->ctx.cc_pending))
2120		kcryptd_crypt_read_done(io);
2121
2122	crypt_dec_pending(io);
2123}
2124
2125static void kcryptd_crypt_read_convert(struct dm_crypt_io *io)
2126{
2127	struct crypt_config *cc = io->cc;
2128	blk_status_t r;
2129
2130	crypt_inc_pending(io);
2131
2132	crypt_convert_init(cc, &io->ctx, io->base_bio, io->base_bio,
2133			   io->sector);
2134
2135	r = crypt_convert(cc, &io->ctx,
2136			  test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags), true);
2137	/*
2138	 * Crypto API backlogged the request, because its queue was full
2139	 * and we're in softirq context, so continue from a workqueue
2140	 */
2141	if (r == BLK_STS_DEV_RESOURCE) {
2142		INIT_WORK(&io->work, kcryptd_crypt_read_continue);
2143		queue_work(cc->crypt_queue, &io->work);
2144		return;
2145	}
2146	if (r)
2147		io->error = r;
2148
2149	if (atomic_dec_and_test(&io->ctx.cc_pending))
2150		kcryptd_crypt_read_done(io);
2151
2152	crypt_dec_pending(io);
2153}
2154
2155static void kcryptd_async_done(struct crypto_async_request *async_req,
2156			       int error)
2157{
2158	struct dm_crypt_request *dmreq = async_req->data;
2159	struct convert_context *ctx = dmreq->ctx;
2160	struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
2161	struct crypt_config *cc = io->cc;
2162
2163	/*
2164	 * A request from crypto driver backlog is going to be processed now,
2165	 * finish the completion and continue in crypt_convert().
2166	 * (Callback will be called for the second time for this request.)
2167	 */
2168	if (error == -EINPROGRESS) {
2169		complete(&ctx->restart);
2170		return;
2171	}
2172
2173	if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
2174		error = cc->iv_gen_ops->post(cc, org_iv_of_dmreq(cc, dmreq), dmreq);
2175
2176	if (error == -EBADMSG) {
2177		char b[BDEVNAME_SIZE];
2178		DMERR_LIMIT("%s: INTEGRITY AEAD ERROR, sector %llu", bio_devname(ctx->bio_in, b),
2179			    (unsigned long long)le64_to_cpu(*org_sector_of_dmreq(cc, dmreq)));
2180		io->error = BLK_STS_PROTECTION;
2181	} else if (error < 0)
2182		io->error = BLK_STS_IOERR;
2183
2184	crypt_free_req(cc, req_of_dmreq(cc, dmreq), io->base_bio);
2185
2186	if (!atomic_dec_and_test(&ctx->cc_pending))
2187		return;
2188
2189	/*
2190	 * The request is fully completed: for inline writes, let
2191	 * kcryptd_crypt_write_convert() do the IO submission.
2192	 */
2193	if (bio_data_dir(io->base_bio) == READ) {
2194		kcryptd_crypt_read_done(io);
2195		return;
2196	}
2197
2198	if (kcryptd_crypt_write_inline(cc, ctx)) {
2199		complete(&ctx->restart);
2200		return;
2201	}
2202
2203	kcryptd_crypt_write_io_submit(io, 1);
2204}
2205
2206static void kcryptd_crypt(struct work_struct *work)
2207{
2208	struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
2209
2210	if (bio_data_dir(io->base_bio) == READ)
2211		kcryptd_crypt_read_convert(io);
2212	else
2213		kcryptd_crypt_write_convert(io);
2214}
2215
2216static void kcryptd_crypt_tasklet(unsigned long work)
2217{
2218	kcryptd_crypt((struct work_struct *)work);
2219}
2220
2221static void kcryptd_queue_crypt(struct dm_crypt_io *io)
2222{
2223	struct crypt_config *cc = io->cc;
2224
2225	if ((bio_data_dir(io->base_bio) == READ && test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags)) ||
2226	    (bio_data_dir(io->base_bio) == WRITE && test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags))) {
2227		/*
2228		 * in_irq(): Crypto API's skcipher_walk_first() refuses to work in hard IRQ context.
2229		 * irqs_disabled(): the kernel may run some IO completion from the idle thread, but
2230		 * it is being executed with irqs disabled.
2231		 */
2232		if (in_irq() || irqs_disabled()) {
2233			io->in_tasklet = true;
2234			tasklet_init(&io->tasklet, kcryptd_crypt_tasklet, (unsigned long)&io->work);
2235			tasklet_schedule(&io->tasklet);
2236			return;
2237		}
2238
2239		kcryptd_crypt(&io->work);
2240		return;
2241	}
2242
2243	INIT_WORK(&io->work, kcryptd_crypt);
2244	queue_work(cc->crypt_queue, &io->work);
2245}
2246
2247static void crypt_free_tfms_aead(struct crypt_config *cc)
2248{
2249	if (!cc->cipher_tfm.tfms_aead)
2250		return;
2251
2252	if (cc->cipher_tfm.tfms_aead[0] && !IS_ERR(cc->cipher_tfm.tfms_aead[0])) {
2253		crypto_free_aead(cc->cipher_tfm.tfms_aead[0]);
2254		cc->cipher_tfm.tfms_aead[0] = NULL;
2255	}
2256
2257	kfree(cc->cipher_tfm.tfms_aead);
2258	cc->cipher_tfm.tfms_aead = NULL;
2259}
2260
2261static void crypt_free_tfms_skcipher(struct crypt_config *cc)
2262{
2263	unsigned i;
2264
2265	if (!cc->cipher_tfm.tfms)
2266		return;
2267
2268	for (i = 0; i < cc->tfms_count; i++)
2269		if (cc->cipher_tfm.tfms[i] && !IS_ERR(cc->cipher_tfm.tfms[i])) {
2270			crypto_free_skcipher(cc->cipher_tfm.tfms[i]);
2271			cc->cipher_tfm.tfms[i] = NULL;
2272		}
2273
2274	kfree(cc->cipher_tfm.tfms);
2275	cc->cipher_tfm.tfms = NULL;
2276}
2277
2278static void crypt_free_tfms(struct crypt_config *cc)
2279{
2280	if (crypt_integrity_aead(cc))
2281		crypt_free_tfms_aead(cc);
2282	else
2283		crypt_free_tfms_skcipher(cc);
2284}
2285
2286static int crypt_alloc_tfms_skcipher(struct crypt_config *cc, char *ciphermode)
2287{
2288	unsigned i;
2289	int err;
2290
2291	cc->cipher_tfm.tfms = kcalloc(cc->tfms_count,
2292				      sizeof(struct crypto_skcipher *),
2293				      GFP_KERNEL);
2294	if (!cc->cipher_tfm.tfms)
2295		return -ENOMEM;
2296
2297	for (i = 0; i < cc->tfms_count; i++) {
2298		cc->cipher_tfm.tfms[i] = crypto_alloc_skcipher(ciphermode, 0,
2299						CRYPTO_ALG_ALLOCATES_MEMORY);
2300		if (IS_ERR(cc->cipher_tfm.tfms[i])) {
2301			err = PTR_ERR(cc->cipher_tfm.tfms[i]);
2302			crypt_free_tfms(cc);
2303			return err;
2304		}
2305	}
2306
2307	/*
2308	 * dm-crypt performance can vary greatly depending on which crypto
2309	 * algorithm implementation is used.  Help people debug performance
2310	 * problems by logging the ->cra_driver_name.
2311	 */
2312	DMDEBUG_LIMIT("%s using implementation \"%s\"", ciphermode,
2313	       crypto_skcipher_alg(any_tfm(cc))->base.cra_driver_name);
2314	return 0;
2315}
2316
2317static int crypt_alloc_tfms_aead(struct crypt_config *cc, char *ciphermode)
2318{
2319	int err;
2320
2321	cc->cipher_tfm.tfms = kmalloc(sizeof(struct crypto_aead *), GFP_KERNEL);
2322	if (!cc->cipher_tfm.tfms)
2323		return -ENOMEM;
2324
2325	cc->cipher_tfm.tfms_aead[0] = crypto_alloc_aead(ciphermode, 0,
2326						CRYPTO_ALG_ALLOCATES_MEMORY);
2327	if (IS_ERR(cc->cipher_tfm.tfms_aead[0])) {
2328		err = PTR_ERR(cc->cipher_tfm.tfms_aead[0]);
2329		crypt_free_tfms(cc);
2330		return err;
2331	}
2332
2333	DMDEBUG_LIMIT("%s using implementation \"%s\"", ciphermode,
2334	       crypto_aead_alg(any_tfm_aead(cc))->base.cra_driver_name);
2335	return 0;
2336}
2337
2338static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
2339{
2340	if (crypt_integrity_aead(cc))
2341		return crypt_alloc_tfms_aead(cc, ciphermode);
2342	else
2343		return crypt_alloc_tfms_skcipher(cc, ciphermode);
2344}
2345
2346static unsigned crypt_subkey_size(struct crypt_config *cc)
2347{
2348	return (cc->key_size - cc->key_extra_size) >> ilog2(cc->tfms_count);
2349}
2350
2351static unsigned crypt_authenckey_size(struct crypt_config *cc)
2352{
2353	return crypt_subkey_size(cc) + RTA_SPACE(sizeof(struct crypto_authenc_key_param));
2354}
2355
2356/*
2357 * If AEAD is composed like authenc(hmac(sha256),xts(aes)),
2358 * the key must be for some reason in special format.
2359 * This funcion converts cc->key to this special format.
2360 */
2361static void crypt_copy_authenckey(char *p, const void *key,
2362				  unsigned enckeylen, unsigned authkeylen)
2363{
2364	struct crypto_authenc_key_param *param;
2365	struct rtattr *rta;
2366
2367	rta = (struct rtattr *)p;
2368	param = RTA_DATA(rta);
2369	param->enckeylen = cpu_to_be32(enckeylen);
2370	rta->rta_len = RTA_LENGTH(sizeof(*param));
2371	rta->rta_type = CRYPTO_AUTHENC_KEYA_PARAM;
2372	p += RTA_SPACE(sizeof(*param));
2373	memcpy(p, key + enckeylen, authkeylen);
2374	p += authkeylen;
2375	memcpy(p, key, enckeylen);
2376}
2377
2378static int crypt_setkey(struct crypt_config *cc)
2379{
2380	unsigned subkey_size;
2381	int err = 0, i, r;
2382
2383	/* Ignore extra keys (which are used for IV etc) */
2384	subkey_size = crypt_subkey_size(cc);
2385
2386	if (crypt_integrity_hmac(cc)) {
2387		if (subkey_size < cc->key_mac_size)
2388			return -EINVAL;
2389
2390		crypt_copy_authenckey(cc->authenc_key, cc->key,
2391				      subkey_size - cc->key_mac_size,
2392				      cc->key_mac_size);
2393	}
2394
2395	for (i = 0; i < cc->tfms_count; i++) {
2396		if (crypt_integrity_hmac(cc))
2397			r = crypto_aead_setkey(cc->cipher_tfm.tfms_aead[i],
2398				cc->authenc_key, crypt_authenckey_size(cc));
2399		else if (crypt_integrity_aead(cc))
2400			r = crypto_aead_setkey(cc->cipher_tfm.tfms_aead[i],
2401					       cc->key + (i * subkey_size),
2402					       subkey_size);
2403		else
2404			r = crypto_skcipher_setkey(cc->cipher_tfm.tfms[i],
2405						   cc->key + (i * subkey_size),
2406						   subkey_size);
2407		if (r)
2408			err = r;
2409	}
2410
2411	if (crypt_integrity_hmac(cc))
2412		memzero_explicit(cc->authenc_key, crypt_authenckey_size(cc));
2413
2414	return err;
2415}
2416
2417#ifdef CONFIG_KEYS
2418
2419static bool contains_whitespace(const char *str)
2420{
2421	while (*str)
2422		if (isspace(*str++))
2423			return true;
2424	return false;
2425}
2426
2427static int set_key_user(struct crypt_config *cc, struct key *key)
2428{
2429	const struct user_key_payload *ukp;
2430
2431	ukp = user_key_payload_locked(key);
2432	if (!ukp)
2433		return -EKEYREVOKED;
2434
2435	if (cc->key_size != ukp->datalen)
2436		return -EINVAL;
2437
2438	memcpy(cc->key, ukp->data, cc->key_size);
2439
2440	return 0;
2441}
2442
2443#if defined(CONFIG_ENCRYPTED_KEYS) || defined(CONFIG_ENCRYPTED_KEYS_MODULE)
2444static int set_key_encrypted(struct crypt_config *cc, struct key *key)
2445{
2446	const struct encrypted_key_payload *ekp;
2447
2448	ekp = key->payload.data[0];
2449	if (!ekp)
2450		return -EKEYREVOKED;
2451
2452	if (cc->key_size != ekp->decrypted_datalen)
2453		return -EINVAL;
2454
2455	memcpy(cc->key, ekp->decrypted_data, cc->key_size);
2456
2457	return 0;
2458}
2459#endif /* CONFIG_ENCRYPTED_KEYS */
2460
2461static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string)
2462{
2463	char *new_key_string, *key_desc;
2464	int ret;
2465	struct key_type *type;
2466	struct key *key;
2467	int (*set_key)(struct crypt_config *cc, struct key *key);
2468
2469	/*
2470	 * Reject key_string with whitespace. dm core currently lacks code for
2471	 * proper whitespace escaping in arguments on DM_TABLE_STATUS path.
2472	 */
2473	if (contains_whitespace(key_string)) {
2474		DMERR("whitespace chars not allowed in key string");
2475		return -EINVAL;
2476	}
2477
2478	/* look for next ':' separating key_type from key_description */
2479	key_desc = strpbrk(key_string, ":");
2480	if (!key_desc || key_desc == key_string || !strlen(key_desc + 1))
2481		return -EINVAL;
2482
2483	if (!strncmp(key_string, "logon:", key_desc - key_string + 1)) {
2484		type = &key_type_logon;
2485		set_key = set_key_user;
2486	} else if (!strncmp(key_string, "user:", key_desc - key_string + 1)) {
2487		type = &key_type_user;
2488		set_key = set_key_user;
2489#if defined(CONFIG_ENCRYPTED_KEYS) || defined(CONFIG_ENCRYPTED_KEYS_MODULE)
2490	} else if (!strncmp(key_string, "encrypted:", key_desc - key_string + 1)) {
2491		type = &key_type_encrypted;
2492		set_key = set_key_encrypted;
2493#endif
2494	} else {
2495		return -EINVAL;
2496	}
2497
2498	new_key_string = kstrdup(key_string, GFP_KERNEL);
2499	if (!new_key_string)
2500		return -ENOMEM;
2501
2502	key = request_key(type, key_desc + 1, NULL);
2503	if (IS_ERR(key)) {
2504		kfree_sensitive(new_key_string);
2505		return PTR_ERR(key);
2506	}
2507
2508	down_read(&key->sem);
2509
2510	ret = set_key(cc, key);
2511	if (ret < 0) {
2512		up_read(&key->sem);
2513		key_put(key);
2514		kfree_sensitive(new_key_string);
2515		return ret;
2516	}
2517
2518	up_read(&key->sem);
2519	key_put(key);
2520
2521	/* clear the flag since following operations may invalidate previously valid key */
2522	clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
2523
2524	ret = crypt_setkey(cc);
2525
2526	if (!ret) {
2527		set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
2528		kfree_sensitive(cc->key_string);
2529		cc->key_string = new_key_string;
2530	} else
2531		kfree_sensitive(new_key_string);
2532
2533	return ret;
2534}
2535
2536static int get_key_size(char **key_string)
2537{
2538	char *colon, dummy;
2539	int ret;
2540
2541	if (*key_string[0] != ':')
2542		return strlen(*key_string) >> 1;
2543
2544	/* look for next ':' in key string */
2545	colon = strpbrk(*key_string + 1, ":");
2546	if (!colon)
2547		return -EINVAL;
2548
2549	if (sscanf(*key_string + 1, "%u%c", &ret, &dummy) != 2 || dummy != ':')
2550		return -EINVAL;
2551
2552	*key_string = colon;
2553
2554	/* remaining key string should be :<logon|user>:<key_desc> */
2555
2556	return ret;
2557}
2558
2559#else
2560
2561static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string)
2562{
2563	return -EINVAL;
2564}
2565
2566static int get_key_size(char **key_string)
2567{
2568	return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1);
2569}
2570
2571#endif /* CONFIG_KEYS */
2572
2573static int crypt_set_key(struct crypt_config *cc, char *key)
2574{
2575	int r = -EINVAL;
2576	int key_string_len = strlen(key);
2577
2578	/* Hyphen (which gives a key_size of zero) means there is no key. */
2579	if (!cc->key_size && strcmp(key, "-"))
2580		goto out;
2581
2582	/* ':' means the key is in kernel keyring, short-circuit normal key processing */
2583	if (key[0] == ':') {
2584		r = crypt_set_keyring_key(cc, key + 1);
2585		goto out;
2586	}
2587
2588	/* clear the flag since following operations may invalidate previously valid key */
2589	clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
2590
2591	/* wipe references to any kernel keyring key */
2592	kfree_sensitive(cc->key_string);
2593	cc->key_string = NULL;
2594
2595	/* Decode key from its hex representation. */
2596	if (cc->key_size && hex2bin(cc->key, key, cc->key_size) < 0)
2597		goto out;
2598
2599	r = crypt_setkey(cc);
2600	if (!r)
2601		set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
2602
2603out:
2604	/* Hex key string not needed after here, so wipe it. */
2605	memset(key, '0', key_string_len);
2606
2607	return r;
2608}
2609
2610static int crypt_wipe_key(struct crypt_config *cc)
2611{
2612	int r;
2613
2614	clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
2615	get_random_bytes(&cc->key, cc->key_size);
2616
2617	/* Wipe IV private keys */
2618	if (cc->iv_gen_ops && cc->iv_gen_ops->wipe) {
2619		r = cc->iv_gen_ops->wipe(cc);
2620		if (r)
2621			return r;
2622	}
2623
2624	kfree_sensitive(cc->key_string);
2625	cc->key_string = NULL;
2626	r = crypt_setkey(cc);
2627	memset(&cc->key, 0, cc->key_size * sizeof(u8));
2628
2629	return r;
2630}
2631
2632static void crypt_calculate_pages_per_client(void)
2633{
2634	unsigned long pages = (totalram_pages() - totalhigh_pages()) * DM_CRYPT_MEMORY_PERCENT / 100;
2635
2636	if (!dm_crypt_clients_n)
2637		return;
2638
2639	pages /= dm_crypt_clients_n;
2640	if (pages < DM_CRYPT_MIN_PAGES_PER_CLIENT)
2641		pages = DM_CRYPT_MIN_PAGES_PER_CLIENT;
2642	dm_crypt_pages_per_client = pages;
2643}
2644
2645static void *crypt_page_alloc(gfp_t gfp_mask, void *pool_data)
2646{
2647	struct crypt_config *cc = pool_data;
2648	struct page *page;
2649
2650	/*
2651	 * Note, percpu_counter_read_positive() may over (and under) estimate
2652	 * the current usage by at most (batch - 1) * num_online_cpus() pages,
2653	 * but avoids potential spinlock contention of an exact result.
2654	 */
2655	if (unlikely(percpu_counter_read_positive(&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&
2656	    likely(gfp_mask & __GFP_NORETRY))
2657		return NULL;
2658
2659	page = alloc_page(gfp_mask);
2660	if (likely(page != NULL))
2661		percpu_counter_add(&cc->n_allocated_pages, 1);
2662
2663	return page;
2664}
2665
2666static void crypt_page_free(void *page, void *pool_data)
2667{
2668	struct crypt_config *cc = pool_data;
2669
2670	__free_page(page);
2671	percpu_counter_sub(&cc->n_allocated_pages, 1);
2672}
2673
2674static void crypt_dtr(struct dm_target *ti)
2675{
2676	struct crypt_config *cc = ti->private;
2677
2678	ti->private = NULL;
2679
2680	if (!cc)
2681		return;
2682
2683	if (cc->write_thread)
2684		kthread_stop(cc->write_thread);
2685
2686	if (cc->io_queue)
2687		destroy_workqueue(cc->io_queue);
2688	if (cc->crypt_queue)
2689		destroy_workqueue(cc->crypt_queue);
2690
2691	crypt_free_tfms(cc);
2692
2693	bioset_exit(&cc->bs);
2694
2695	mempool_exit(&cc->page_pool);
2696	mempool_exit(&cc->req_pool);
2697	mempool_exit(&cc->tag_pool);
2698
2699	WARN_ON(percpu_counter_sum(&cc->n_allocated_pages) != 0);
2700	percpu_counter_destroy(&cc->n_allocated_pages);
2701
2702	if (cc->iv_gen_ops && cc->iv_gen_ops->dtr)
2703		cc->iv_gen_ops->dtr(cc);
2704
2705	if (cc->dev)
2706		dm_put_device(ti, cc->dev);
2707
2708	kfree_sensitive(cc->cipher_string);
2709	kfree_sensitive(cc->key_string);
2710	kfree_sensitive(cc->cipher_auth);
2711	kfree_sensitive(cc->authenc_key);
2712
2713	mutex_destroy(&cc->bio_alloc_lock);
2714
2715	/* Must zero key material before freeing */
2716	kfree_sensitive(cc);
2717
2718	spin_lock(&dm_crypt_clients_lock);
2719	WARN_ON(!dm_crypt_clients_n);
2720	dm_crypt_clients_n--;
2721	crypt_calculate_pages_per_client();
2722	spin_unlock(&dm_crypt_clients_lock);
2723}
2724
2725static int crypt_ctr_ivmode(struct dm_target *ti, const char *ivmode)
2726{
2727	struct crypt_config *cc = ti->private;
2728
2729	if (crypt_integrity_aead(cc))
2730		cc->iv_size = crypto_aead_ivsize(any_tfm_aead(cc));
2731	else
2732		cc->iv_size = crypto_skcipher_ivsize(any_tfm(cc));
2733
2734	if (cc->iv_size)
2735		/* at least a 64 bit sector number should fit in our buffer */
2736		cc->iv_size = max(cc->iv_size,
2737				  (unsigned int)(sizeof(u64) / sizeof(u8)));
2738	else if (ivmode) {
2739		DMWARN("Selected cipher does not support IVs");
2740		ivmode = NULL;
2741	}
2742
2743	/* Choose ivmode, see comments at iv code. */
2744	if (ivmode == NULL)
2745		cc->iv_gen_ops = NULL;
2746	else if (strcmp(ivmode, "plain") == 0)
2747		cc->iv_gen_ops = &crypt_iv_plain_ops;
2748	else if (strcmp(ivmode, "plain64") == 0)
2749		cc->iv_gen_ops = &crypt_iv_plain64_ops;
2750	else if (strcmp(ivmode, "plain64be") == 0)
2751		cc->iv_gen_ops = &crypt_iv_plain64be_ops;
2752	else if (strcmp(ivmode, "essiv") == 0)
2753		cc->iv_gen_ops = &crypt_iv_essiv_ops;
2754	else if (strcmp(ivmode, "benbi") == 0)
2755		cc->iv_gen_ops = &crypt_iv_benbi_ops;
2756	else if (strcmp(ivmode, "null") == 0)
2757		cc->iv_gen_ops = &crypt_iv_null_ops;
2758	else if (strcmp(ivmode, "eboiv") == 0)
2759		cc->iv_gen_ops = &crypt_iv_eboiv_ops;
2760	else if (strcmp(ivmode, "elephant") == 0) {
2761		cc->iv_gen_ops = &crypt_iv_elephant_ops;
2762		cc->key_parts = 2;
2763		cc->key_extra_size = cc->key_size / 2;
2764		if (cc->key_extra_size > ELEPHANT_MAX_KEY_SIZE)
2765			return -EINVAL;
2766		set_bit(CRYPT_ENCRYPT_PREPROCESS, &cc->cipher_flags);
2767	} else if (strcmp(ivmode, "lmk") == 0) {
2768		cc->iv_gen_ops = &crypt_iv_lmk_ops;
2769		/*
2770		 * Version 2 and 3 is recognised according
2771		 * to length of provided multi-key string.
2772		 * If present (version 3), last key is used as IV seed.
2773		 * All keys (including IV seed) are always the same size.
2774		 */
2775		if (cc->key_size % cc->key_parts) {
2776			cc->key_parts++;
2777			cc->key_extra_size = cc->key_size / cc->key_parts;
2778		}
2779	} else if (strcmp(ivmode, "tcw") == 0) {
2780		cc->iv_gen_ops = &crypt_iv_tcw_ops;
2781		cc->key_parts += 2; /* IV + whitening */
2782		cc->key_extra_size = cc->iv_size + TCW_WHITENING_SIZE;
2783	} else if (strcmp(ivmode, "random") == 0) {
2784		cc->iv_gen_ops = &crypt_iv_random_ops;
2785		/* Need storage space in integrity fields. */
2786		cc->integrity_iv_size = cc->iv_size;
2787	} else {
2788		ti->error = "Invalid IV mode";
2789		return -EINVAL;
2790	}
2791
2792	return 0;
2793}
2794
2795/*
2796 * Workaround to parse HMAC algorithm from AEAD crypto API spec.
2797 * The HMAC is needed to calculate tag size (HMAC digest size).
2798 * This should be probably done by crypto-api calls (once available...)
2799 */
2800static int crypt_ctr_auth_cipher(struct crypt_config *cc, char *cipher_api)
2801{
2802	char *start, *end, *mac_alg = NULL;
2803	struct crypto_ahash *mac;
2804
2805	if (!strstarts(cipher_api, "authenc("))
2806		return 0;
2807
2808	start = strchr(cipher_api, '(');
2809	end = strchr(cipher_api, ',');
2810	if (!start || !end || ++start > end)
2811		return -EINVAL;
2812
2813	mac_alg = kzalloc(end - start + 1, GFP_KERNEL);
2814	if (!mac_alg)
2815		return -ENOMEM;
2816	strncpy(mac_alg, start, end - start);
2817
2818	mac = crypto_alloc_ahash(mac_alg, 0, CRYPTO_ALG_ALLOCATES_MEMORY);
2819	kfree(mac_alg);
2820
2821	if (IS_ERR(mac))
2822		return PTR_ERR(mac);
2823
2824	cc->key_mac_size = crypto_ahash_digestsize(mac);
2825	crypto_free_ahash(mac);
2826
2827	cc->authenc_key = kmalloc(crypt_authenckey_size(cc), GFP_KERNEL);
2828	if (!cc->authenc_key)
2829		return -ENOMEM;
2830
2831	return 0;
2832}
2833
2834static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key,
2835				char **ivmode, char **ivopts)
2836{
2837	struct crypt_config *cc = ti->private;
2838	char *tmp, *cipher_api, buf[CRYPTO_MAX_ALG_NAME];
2839	int ret = -EINVAL;
2840
2841	cc->tfms_count = 1;
2842
2843	/*
2844	 * New format (capi: prefix)
2845	 * capi:cipher_api_spec-iv:ivopts
2846	 */
2847	tmp = &cipher_in[strlen("capi:")];
2848
2849	/* Separate IV options if present, it can contain another '-' in hash name */
2850	*ivopts = strrchr(tmp, ':');
2851	if (*ivopts) {
2852		**ivopts = '\0';
2853		(*ivopts)++;
2854	}
2855	/* Parse IV mode */
2856	*ivmode = strrchr(tmp, '-');
2857	if (*ivmode) {
2858		**ivmode = '\0';
2859		(*ivmode)++;
2860	}
2861	/* The rest is crypto API spec */
2862	cipher_api = tmp;
2863
2864	/* Alloc AEAD, can be used only in new format. */
2865	if (crypt_integrity_aead(cc)) {
2866		ret = crypt_ctr_auth_cipher(cc, cipher_api);
2867		if (ret < 0) {
2868			ti->error = "Invalid AEAD cipher spec";
2869			return -ENOMEM;
2870		}
2871	}
2872
2873	if (*ivmode && !strcmp(*ivmode, "lmk"))
2874		cc->tfms_count = 64;
2875
2876	if (*ivmode && !strcmp(*ivmode, "essiv")) {
2877		if (!*ivopts) {
2878			ti->error = "Digest algorithm missing for ESSIV mode";
2879			return -EINVAL;
2880		}
2881		ret = snprintf(buf, CRYPTO_MAX_ALG_NAME, "essiv(%s,%s)",
2882			       cipher_api, *ivopts);
2883		if (ret < 0 || ret >= CRYPTO_MAX_ALG_NAME) {
2884			ti->error = "Cannot allocate cipher string";
2885			return -ENOMEM;
2886		}
2887		cipher_api = buf;
2888	}
2889
2890	cc->key_parts = cc->tfms_count;
2891
2892	/* Allocate cipher */
2893	ret = crypt_alloc_tfms(cc, cipher_api);
2894	if (ret < 0) {
2895		ti->error = "Error allocating crypto tfm";
2896		return ret;
2897	}
2898
2899	if (crypt_integrity_aead(cc))
2900		cc->iv_size = crypto_aead_ivsize(any_tfm_aead(cc));
2901	else
2902		cc->iv_size = crypto_skcipher_ivsize(any_tfm(cc));
2903
2904	return 0;
2905}
2906
2907static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key,
2908				char **ivmode, char **ivopts)
2909{
2910	struct crypt_config *cc = ti->private;
2911	char *tmp, *cipher, *chainmode, *keycount;
2912	char *cipher_api = NULL;
2913	int ret = -EINVAL;
2914	char dummy;
2915
2916	if (strchr(cipher_in, '(') || crypt_integrity_aead(cc)) {
2917		ti->error = "Bad cipher specification";
2918		return -EINVAL;
2919	}
2920
2921	/*
2922	 * Legacy dm-crypt cipher specification
2923	 * cipher[:keycount]-mode-iv:ivopts
2924	 */
2925	tmp = cipher_in;
2926	keycount = strsep(&tmp, "-");
2927	cipher = strsep(&keycount, ":");
2928
2929	if (!keycount)
2930		cc->tfms_count = 1;
2931	else if (sscanf(keycount, "%u%c", &cc->tfms_count, &dummy) != 1 ||
2932		 !is_power_of_2(cc->tfms_count)) {
2933		ti->error = "Bad cipher key count specification";
2934		return -EINVAL;
2935	}
2936	cc->key_parts = cc->tfms_count;
2937
2938	chainmode = strsep(&tmp, "-");
2939	*ivmode = strsep(&tmp, ":");
2940	*ivopts = tmp;
2941
2942	/*
2943	 * For compatibility with the original dm-crypt mapping format, if
2944	 * only the cipher name is supplied, use cbc-plain.
2945	 */
2946	if (!chainmode || (!strcmp(chainmode, "plain") && !*ivmode)) {
2947		chainmode = "cbc";
2948		*ivmode = "plain";
2949	}
2950
2951	if (strcmp(chainmode, "ecb") && !*ivmode) {
2952		ti->error = "IV mechanism required";
2953		return -EINVAL;
2954	}
2955
2956	cipher_api = kmalloc(CRYPTO_MAX_ALG_NAME, GFP_KERNEL);
2957	if (!cipher_api)
2958		goto bad_mem;
2959
2960	if (*ivmode && !strcmp(*ivmode, "essiv")) {
2961		if (!*ivopts) {
2962			ti->error = "Digest algorithm missing for ESSIV mode";
2963			kfree(cipher_api);
2964			return -EINVAL;
2965		}
2966		ret = snprintf(cipher_api, CRYPTO_MAX_ALG_NAME,
2967			       "essiv(%s(%s),%s)", chainmode, cipher, *ivopts);
2968	} else {
2969		ret = snprintf(cipher_api, CRYPTO_MAX_ALG_NAME,
2970			       "%s(%s)", chainmode, cipher);
2971	}
2972	if (ret < 0 || ret >= CRYPTO_MAX_ALG_NAME) {
2973		kfree(cipher_api);
2974		goto bad_mem;
2975	}
2976
2977	/* Allocate cipher */
2978	ret = crypt_alloc_tfms(cc, cipher_api);
2979	if (ret < 0) {
2980		ti->error = "Error allocating crypto tfm";
2981		kfree(cipher_api);
2982		return ret;
2983	}
2984	kfree(cipher_api);
2985
2986	return 0;
2987bad_mem:
2988	ti->error = "Cannot allocate cipher strings";
2989	return -ENOMEM;
2990}
2991
2992static int crypt_ctr_cipher(struct dm_target *ti, char *cipher_in, char *key)
2993{
2994	struct crypt_config *cc = ti->private;
2995	char *ivmode = NULL, *ivopts = NULL;
2996	int ret;
2997
2998	cc->cipher_string = kstrdup(cipher_in, GFP_KERNEL);
2999	if (!cc->cipher_string) {
3000		ti->error = "Cannot allocate cipher strings";
3001		return -ENOMEM;
3002	}
3003
3004	if (strstarts(cipher_in, "capi:"))
3005		ret = crypt_ctr_cipher_new(ti, cipher_in, key, &ivmode, &ivopts);
3006	else
3007		ret = crypt_ctr_cipher_old(ti, cipher_in, key, &ivmode, &ivopts);
3008	if (ret)
3009		return ret;
3010
3011	/* Initialize IV */
3012	ret = crypt_ctr_ivmode(ti, ivmode);
3013	if (ret < 0)
3014		return ret;
3015
3016	/* Initialize and set key */
3017	ret = crypt_set_key(cc, key);
3018	if (ret < 0) {
3019		ti->error = "Error decoding and setting key";
3020		return ret;
3021	}
3022
3023	/* Allocate IV */
3024	if (cc->iv_gen_ops && cc->iv_gen_ops->ctr) {
3025		ret = cc->iv_gen_ops->ctr(cc, ti, ivopts);
3026		if (ret < 0) {
3027			ti->error = "Error creating IV";
3028			return ret;
3029		}
3030	}
3031
3032	/* Initialize IV (set keys for ESSIV etc) */
3033	if (cc->iv_gen_ops && cc->iv_gen_ops->init) {
3034		ret = cc->iv_gen_ops->init(cc);
3035		if (ret < 0) {
3036			ti->error = "Error initialising IV";
3037			return ret;
3038		}
3039	}
3040
3041	/* wipe the kernel key payload copy */
3042	if (cc->key_string)
3043		memset(cc->key, 0, cc->key_size * sizeof(u8));
3044
3045	return ret;
3046}
3047
3048static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **argv)
3049{
3050	struct crypt_config *cc = ti->private;
3051	struct dm_arg_set as;
3052	static const struct dm_arg _args[] = {
3053		{0, 8, "Invalid number of feature args"},
3054	};
3055	unsigned int opt_params, val;
3056	const char *opt_string, *sval;
3057	char dummy;
3058	int ret;
3059
3060	/* Optional parameters */
3061	as.argc = argc;
3062	as.argv = argv;
3063
3064	ret = dm_read_arg_group(_args, &as, &opt_params, &ti->error);
3065	if (ret)
3066		return ret;
3067
3068	while (opt_params--) {
3069		opt_string = dm_shift_arg(&as);
3070		if (!opt_string) {
3071			ti->error = "Not enough feature arguments";
3072			return -EINVAL;
3073		}
3074
3075		if (!strcasecmp(opt_string, "allow_discards"))
3076			ti->num_discard_bios = 1;
3077
3078		else if (!strcasecmp(opt_string, "same_cpu_crypt"))
3079			set_bit(DM_CRYPT_SAME_CPU, &cc->flags);
3080
3081		else if (!strcasecmp(opt_string, "submit_from_crypt_cpus"))
3082			set_bit(DM_CRYPT_NO_OFFLOAD, &cc->flags);
3083		else if (!strcasecmp(opt_string, "no_read_workqueue"))
3084			set_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags);
3085		else if (!strcasecmp(opt_string, "no_write_workqueue"))
3086			set_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags);
3087		else if (sscanf(opt_string, "integrity:%u:", &val) == 1) {
3088			if (val == 0 || val > MAX_TAG_SIZE) {
3089				ti->error = "Invalid integrity arguments";
3090				return -EINVAL;
3091			}
3092			cc->on_disk_tag_size = val;
3093			sval = strchr(opt_string + strlen("integrity:"), ':') + 1;
3094			if (!strcasecmp(sval, "aead")) {
3095				set_bit(CRYPT_MODE_INTEGRITY_AEAD, &cc->cipher_flags);
3096			} else  if (strcasecmp(sval, "none")) {
3097				ti->error = "Unknown integrity profile";
3098				return -EINVAL;
3099			}
3100
3101			cc->cipher_auth = kstrdup(sval, GFP_KERNEL);
3102			if (!cc->cipher_auth)
3103				return -ENOMEM;
3104		} else if (sscanf(opt_string, "sector_size:%hu%c", &cc->sector_size, &dummy) == 1) {
3105			if (cc->sector_size < (1 << SECTOR_SHIFT) ||
3106			    cc->sector_size > 4096 ||
3107			    (cc->sector_size & (cc->sector_size - 1))) {
3108				ti->error = "Invalid feature value for sector_size";
3109				return -EINVAL;
3110			}
3111			if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) {
3112				ti->error = "Device size is not multiple of sector_size feature";
3113				return -EINVAL;
3114			}
3115			cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT;
3116		} else if (!strcasecmp(opt_string, "iv_large_sectors"))
3117			set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
3118		else {
3119			ti->error = "Invalid feature arguments";
3120			return -EINVAL;
3121		}
3122	}
3123
3124	return 0;
3125}
3126
3127#ifdef CONFIG_BLK_DEV_ZONED
3128
3129static int crypt_report_zones(struct dm_target *ti,
3130		struct dm_report_zones_args *args, unsigned int nr_zones)
3131{
3132	struct crypt_config *cc = ti->private;
3133	sector_t sector = cc->start + dm_target_offset(ti, args->next_sector);
3134
3135	args->start = cc->start;
3136	return blkdev_report_zones(cc->dev->bdev, sector, nr_zones,
3137				   dm_report_zones_cb, args);
3138}
3139
3140#endif
3141
3142/*
3143 * Construct an encryption mapping:
3144 * <cipher> [<key>|:<key_size>:<user|logon>:<key_description>] <iv_offset> <dev_path> <start>
3145 */
3146static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
3147{
3148	struct crypt_config *cc;
3149	const char *devname = dm_table_device_name(ti->table);
3150	int key_size;
3151	unsigned int align_mask;
3152	unsigned long long tmpll;
3153	int ret;
3154	size_t iv_size_padding, additional_req_size;
3155	char dummy;
3156
3157	if (argc < 5) {
3158		ti->error = "Not enough arguments";
3159		return -EINVAL;
3160	}
3161
3162	key_size = get_key_size(&argv[1]);
3163	if (key_size < 0) {
3164		ti->error = "Cannot parse key size";
3165		return -EINVAL;
3166	}
3167
3168	cc = kzalloc(struct_size(cc, key, key_size), GFP_KERNEL);
3169	if (!cc) {
3170		ti->error = "Cannot allocate encryption context";
3171		return -ENOMEM;
3172	}
3173	cc->key_size = key_size;
3174	cc->sector_size = (1 << SECTOR_SHIFT);
3175	cc->sector_shift = 0;
3176
3177	ti->private = cc;
3178
3179	spin_lock(&dm_crypt_clients_lock);
3180	dm_crypt_clients_n++;
3181	crypt_calculate_pages_per_client();
3182	spin_unlock(&dm_crypt_clients_lock);
3183
3184	ret = percpu_counter_init(&cc->n_allocated_pages, 0, GFP_KERNEL);
3185	if (ret < 0)
3186		goto bad;
3187
3188	/* Optional parameters need to be read before cipher constructor */
3189	if (argc > 5) {
3190		ret = crypt_ctr_optional(ti, argc - 5, &argv[5]);
3191		if (ret)
3192			goto bad;
3193	}
3194
3195	ret = crypt_ctr_cipher(ti, argv[0], argv[1]);
3196	if (ret < 0)
3197		goto bad;
3198
3199	if (crypt_integrity_aead(cc)) {
3200		cc->dmreq_start = sizeof(struct aead_request);
3201		cc->dmreq_start += crypto_aead_reqsize(any_tfm_aead(cc));
3202		align_mask = crypto_aead_alignmask(any_tfm_aead(cc));
3203	} else {
3204		cc->dmreq_start = sizeof(struct skcipher_request);
3205		cc->dmreq_start += crypto_skcipher_reqsize(any_tfm(cc));
3206		align_mask = crypto_skcipher_alignmask(any_tfm(cc));
3207	}
3208	cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
3209
3210	if (align_mask < CRYPTO_MINALIGN) {
3211		/* Allocate the padding exactly */
3212		iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
3213				& align_mask;
3214	} else {
3215		/*
3216		 * If the cipher requires greater alignment than kmalloc
3217		 * alignment, we don't know the exact position of the
3218		 * initialization vector. We must assume worst case.
3219		 */
3220		iv_size_padding = align_mask;
3221	}
3222
3223	/*  ...| IV + padding | original IV | original sec. number | bio tag offset | */
3224	additional_req_size = sizeof(struct dm_crypt_request) +
3225		iv_size_padding + cc->iv_size +
3226		cc->iv_size +
3227		sizeof(uint64_t) +
3228		sizeof(unsigned int);
3229
3230	ret = mempool_init_kmalloc_pool(&cc->req_pool, MIN_IOS, cc->dmreq_start + additional_req_size);
3231	if (ret) {
3232		ti->error = "Cannot allocate crypt request mempool";
3233		goto bad;
3234	}
3235
3236	cc->per_bio_data_size = ti->per_io_data_size =
3237		ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start + additional_req_size,
3238		      ARCH_KMALLOC_MINALIGN);
3239
3240	ret = mempool_init(&cc->page_pool, BIO_MAX_PAGES, crypt_page_alloc, crypt_page_free, cc);
3241	if (ret) {
3242		ti->error = "Cannot allocate page mempool";
3243		goto bad;
3244	}
3245
3246	ret = bioset_init(&cc->bs, MIN_IOS, 0, BIOSET_NEED_BVECS);
3247	if (ret) {
3248		ti->error = "Cannot allocate crypt bioset";
3249		goto bad;
3250	}
3251
3252	mutex_init(&cc->bio_alloc_lock);
3253
3254	ret = -EINVAL;
3255	if ((sscanf(argv[2], "%llu%c", &tmpll, &dummy) != 1) ||
3256	    (tmpll & ((cc->sector_size >> SECTOR_SHIFT) - 1))) {
3257		ti->error = "Invalid iv_offset sector";
3258		goto bad;
3259	}
3260	cc->iv_offset = tmpll;
3261
3262	ret = dm_get_device(ti, argv[3], dm_table_get_mode(ti->table), &cc->dev);
3263	if (ret) {
3264		ti->error = "Device lookup failed";
3265		goto bad;
3266	}
3267
3268	ret = -EINVAL;
3269	if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) {
3270		ti->error = "Invalid device sector";
3271		goto bad;
3272	}
3273	cc->start = tmpll;
3274
3275	/*
3276	 * For zoned block devices, we need to preserve the issuer write
3277	 * ordering. To do so, disable write workqueues and force inline
3278	 * encryption completion.
3279	 */
3280	if (bdev_is_zoned(cc->dev->bdev)) {
3281		set_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags);
3282		set_bit(DM_CRYPT_WRITE_INLINE, &cc->flags);
3283	}
3284
3285	if (crypt_integrity_aead(cc) || cc->integrity_iv_size) {
3286		ret = crypt_integrity_ctr(cc, ti);
3287		if (ret)
3288			goto bad;
3289
3290		cc->tag_pool_max_sectors = POOL_ENTRY_SIZE / cc->on_disk_tag_size;
3291		if (!cc->tag_pool_max_sectors)
3292			cc->tag_pool_max_sectors = 1;
3293
3294		ret = mempool_init_kmalloc_pool(&cc->tag_pool, MIN_IOS,
3295			cc->tag_pool_max_sectors * cc->on_disk_tag_size);
3296		if (ret) {
3297			ti->error = "Cannot allocate integrity tags mempool";
3298			goto bad;
3299		}
3300
3301		cc->tag_pool_max_sectors <<= cc->sector_shift;
3302	}
3303
3304	ret = -ENOMEM;
3305	cc->io_queue = alloc_workqueue("kcryptd_io/%s", WQ_MEM_RECLAIM, 1, devname);
3306	if (!cc->io_queue) {
3307		ti->error = "Couldn't create kcryptd io queue";
3308		goto bad;
3309	}
3310
3311	if (test_bit(DM_CRYPT_SAME_CPU, &cc->flags))
3312		cc->crypt_queue = alloc_workqueue("kcryptd/%s", WQ_CPU_INTENSIVE | WQ_MEM_RECLAIM,
3313						  1, devname);
3314	else
3315		cc->crypt_queue = alloc_workqueue("kcryptd/%s",
3316						  WQ_CPU_INTENSIVE | WQ_MEM_RECLAIM | WQ_UNBOUND,
3317						  num_online_cpus(), devname);
3318	if (!cc->crypt_queue) {
3319		ti->error = "Couldn't create kcryptd queue";
3320		goto bad;
3321	}
3322
3323	spin_lock_init(&cc->write_thread_lock);
3324	cc->write_tree = RB_ROOT;
3325
3326	cc->write_thread = kthread_create(dmcrypt_write, cc, "dmcrypt_write/%s", devname);
3327	if (IS_ERR(cc->write_thread)) {
3328		ret = PTR_ERR(cc->write_thread);
3329		cc->write_thread = NULL;
3330		ti->error = "Couldn't spawn write thread";
3331		goto bad;
3332	}
3333	wake_up_process(cc->write_thread);
3334
3335	ti->num_flush_bios = 1;
3336	ti->limit_swap_bios = true;
3337
3338	return 0;
3339
3340bad:
3341	crypt_dtr(ti);
3342	return ret;
3343}
3344
3345static int crypt_map(struct dm_target *ti, struct bio *bio)
3346{
3347	struct dm_crypt_io *io;
3348	struct crypt_config *cc = ti->private;
3349
3350	/*
3351	 * If bio is REQ_PREFLUSH or REQ_OP_DISCARD, just bypass crypt queues.
3352	 * - for REQ_PREFLUSH device-mapper core ensures that no IO is in-flight
3353	 * - for REQ_OP_DISCARD caller must use flush if IO ordering matters
3354	 */
3355	if (unlikely(bio->bi_opf & REQ_PREFLUSH ||
3356	    bio_op(bio) == REQ_OP_DISCARD)) {
3357		bio_set_dev(bio, cc->dev->bdev);
3358		if (bio_sectors(bio))
3359			bio->bi_iter.bi_sector = cc->start +
3360				dm_target_offset(ti, bio->bi_iter.bi_sector);
3361		return DM_MAPIO_REMAPPED;
3362	}
3363
3364	/*
3365	 * Check if bio is too large, split as needed.
3366	 */
3367	if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
3368	    (bio_data_dir(bio) == WRITE || cc->on_disk_tag_size))
3369		dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
3370
3371	/*
3372	 * Ensure that bio is a multiple of internal sector encryption size
3373	 * and is aligned to this size as defined in IO hints.
3374	 */
3375	if (unlikely((bio->bi_iter.bi_sector & ((cc->sector_size >> SECTOR_SHIFT) - 1)) != 0))
3376		return DM_MAPIO_KILL;
3377
3378	if (unlikely(bio->bi_iter.bi_size & (cc->sector_size - 1)))
3379		return DM_MAPIO_KILL;
3380
3381	io = dm_per_bio_data(bio, cc->per_bio_data_size);
3382	crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
3383
3384	if (cc->on_disk_tag_size) {
3385		unsigned tag_len = cc->on_disk_tag_size * (bio_sectors(bio) >> cc->sector_shift);
3386
3387		if (unlikely(tag_len > KMALLOC_MAX_SIZE) ||
3388		    unlikely(!(io->integrity_metadata = kmalloc(tag_len,
3389				GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN)))) {
3390			if (bio_sectors(bio) > cc->tag_pool_max_sectors)
3391				dm_accept_partial_bio(bio, cc->tag_pool_max_sectors);
3392			io->integrity_metadata = mempool_alloc(&cc->tag_pool, GFP_NOIO);
3393			io->integrity_metadata_from_pool = true;
3394		}
3395	}
3396
3397	if (crypt_integrity_aead(cc))
3398		io->ctx.r.req_aead = (struct aead_request *)(io + 1);
3399	else
3400		io->ctx.r.req = (struct skcipher_request *)(io + 1);
3401
3402	if (bio_data_dir(io->base_bio) == READ) {
3403		if (kcryptd_io_read(io, GFP_NOWAIT))
3404			kcryptd_queue_read(io);
3405	} else
3406		kcryptd_queue_crypt(io);
3407
3408	return DM_MAPIO_SUBMITTED;
3409}
3410
3411static char hex2asc(unsigned char c)
3412{
3413	return c + '0' + ((unsigned)(9 - c) >> 4 & 0x27);
3414}
3415
3416static void crypt_status(struct dm_target *ti, status_type_t type,
3417			 unsigned status_flags, char *result, unsigned maxlen)
3418{
3419	struct crypt_config *cc = ti->private;
3420	unsigned i, sz = 0;
3421	int num_feature_args = 0;
3422
3423	switch (type) {
3424	case STATUSTYPE_INFO:
3425		result[0] = '\0';
3426		break;
3427
3428	case STATUSTYPE_TABLE:
3429		DMEMIT("%s ", cc->cipher_string);
3430
3431		if (cc->key_size > 0) {
3432			if (cc->key_string)
3433				DMEMIT(":%u:%s", cc->key_size, cc->key_string);
3434			else {
3435				for (i = 0; i < cc->key_size; i++) {
3436					DMEMIT("%c%c", hex2asc(cc->key[i] >> 4),
3437					       hex2asc(cc->key[i] & 0xf));
3438				}
3439			}
3440		} else
3441			DMEMIT("-");
3442
3443		DMEMIT(" %llu %s %llu", (unsigned long long)cc->iv_offset,
3444				cc->dev->name, (unsigned long long)cc->start);
3445
3446		num_feature_args += !!ti->num_discard_bios;
3447		num_feature_args += test_bit(DM_CRYPT_SAME_CPU, &cc->flags);
3448		num_feature_args += test_bit(DM_CRYPT_NO_OFFLOAD, &cc->flags);
3449		num_feature_args += test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags);
3450		num_feature_args += test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags);
3451		num_feature_args += cc->sector_size != (1 << SECTOR_SHIFT);
3452		num_feature_args += test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
3453		if (cc->on_disk_tag_size)
3454			num_feature_args++;
3455		if (num_feature_args) {
3456			DMEMIT(" %d", num_feature_args);
3457			if (ti->num_discard_bios)
3458				DMEMIT(" allow_discards");
3459			if (test_bit(DM_CRYPT_SAME_CPU, &cc->flags))
3460				DMEMIT(" same_cpu_crypt");
3461			if (test_bit(DM_CRYPT_NO_OFFLOAD, &cc->flags))
3462				DMEMIT(" submit_from_crypt_cpus");
3463			if (test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags))
3464				DMEMIT(" no_read_workqueue");
3465			if (test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags))
3466				DMEMIT(" no_write_workqueue");
3467			if (cc->on_disk_tag_size)
3468				DMEMIT(" integrity:%u:%s", cc->on_disk_tag_size, cc->cipher_auth);
3469			if (cc->sector_size != (1 << SECTOR_SHIFT))
3470				DMEMIT(" sector_size:%d", cc->sector_size);
3471			if (test_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags))
3472				DMEMIT(" iv_large_sectors");
3473		}
3474
3475		break;
3476	}
3477}
3478
3479static void crypt_postsuspend(struct dm_target *ti)
3480{
3481	struct crypt_config *cc = ti->private;
3482
3483	set_bit(DM_CRYPT_SUSPENDED, &cc->flags);
3484}
3485
3486static int crypt_preresume(struct dm_target *ti)
3487{
3488	struct crypt_config *cc = ti->private;
3489
3490	if (!test_bit(DM_CRYPT_KEY_VALID, &cc->flags)) {
3491		DMERR("aborting resume - crypt key is not set.");
3492		return -EAGAIN;
3493	}
3494
3495	return 0;
3496}
3497
3498static void crypt_resume(struct dm_target *ti)
3499{
3500	struct crypt_config *cc = ti->private;
3501
3502	clear_bit(DM_CRYPT_SUSPENDED, &cc->flags);
3503}
3504
3505/* Message interface
3506 *	key set <key>
3507 *	key wipe
3508 */
3509static int crypt_message(struct dm_target *ti, unsigned argc, char **argv,
3510			 char *result, unsigned maxlen)
3511{
3512	struct crypt_config *cc = ti->private;
3513	int key_size, ret = -EINVAL;
3514
3515	if (argc < 2)
3516		goto error;
3517
3518	if (!strcasecmp(argv[0], "key")) {
3519		if (!test_bit(DM_CRYPT_SUSPENDED, &cc->flags)) {
3520			DMWARN("not suspended during key manipulation.");
3521			return -EINVAL;
3522		}
3523		if (argc == 3 && !strcasecmp(argv[1], "set")) {
3524			/* The key size may not be changed. */
3525			key_size = get_key_size(&argv[2]);
3526			if (key_size < 0 || cc->key_size != key_size) {
3527				memset(argv[2], '0', strlen(argv[2]));
3528				return -EINVAL;
3529			}
3530
3531			ret = crypt_set_key(cc, argv[2]);
3532			if (ret)
3533				return ret;
3534			if (cc->iv_gen_ops && cc->iv_gen_ops->init)
3535				ret = cc->iv_gen_ops->init(cc);
3536			/* wipe the kernel key payload copy */
3537			if (cc->key_string)
3538				memset(cc->key, 0, cc->key_size * sizeof(u8));
3539			return ret;
3540		}
3541		if (argc == 2 && !strcasecmp(argv[1], "wipe"))
3542			return crypt_wipe_key(cc);
3543	}
3544
3545error:
3546	DMWARN("unrecognised message received.");
3547	return -EINVAL;
3548}
3549
3550static int crypt_iterate_devices(struct dm_target *ti,
3551				 iterate_devices_callout_fn fn, void *data)
3552{
3553	struct crypt_config *cc = ti->private;
3554
3555	return fn(ti, cc->dev, cc->start, ti->len, data);
3556}
3557
3558static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
3559{
3560	struct crypt_config *cc = ti->private;
3561
3562	/*
3563	 * Unfortunate constraint that is required to avoid the potential
3564	 * for exceeding underlying device's max_segments limits -- due to
3565	 * crypt_alloc_buffer() possibly allocating pages for the encryption
3566	 * bio that are not as physically contiguous as the original bio.
3567	 */
3568	limits->max_segment_size = PAGE_SIZE;
3569
3570	limits->logical_block_size =
3571		max_t(unsigned, limits->logical_block_size, cc->sector_size);
3572	limits->physical_block_size =
3573		max_t(unsigned, limits->physical_block_size, cc->sector_size);
3574	limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
3575}
3576
3577static struct target_type crypt_target = {
3578	.name   = "crypt",
3579	.version = {1, 22, 0},
3580	.module = THIS_MODULE,
3581	.ctr    = crypt_ctr,
3582	.dtr    = crypt_dtr,
3583#ifdef CONFIG_BLK_DEV_ZONED
3584	.features = DM_TARGET_ZONED_HM,
3585	.report_zones = crypt_report_zones,
3586#endif
3587	.map    = crypt_map,
3588	.status = crypt_status,
3589	.postsuspend = crypt_postsuspend,
3590	.preresume = crypt_preresume,
3591	.resume = crypt_resume,
3592	.message = crypt_message,
3593	.iterate_devices = crypt_iterate_devices,
3594	.io_hints = crypt_io_hints,
3595};
3596
3597static int __init dm_crypt_init(void)
3598{
3599	int r;
3600
3601	r = dm_register_target(&crypt_target);
3602	if (r < 0)
3603		DMERR("register failed %d", r);
3604
3605	return r;
3606}
3607
3608static void __exit dm_crypt_exit(void)
3609{
3610	dm_unregister_target(&crypt_target);
3611}
3612
3613module_init(dm_crypt_init);
3614module_exit(dm_crypt_exit);
3615
3616MODULE_AUTHOR("Jana Saout <jana@saout.de>");
3617MODULE_DESCRIPTION(DM_NAME " target for transparent encryption / decryption");
3618MODULE_LICENSE("GPL");
3619