2 * QEMU block full disk encryption
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
23 #include "block/block_int.h"
24 #include "block/qdict.h"
25 #include "sysemu/block-backend.h"
26 #include "crypto/block.h"
27 #include "qapi/opts-visitor.h"
28 #include "qapi/qapi-visit-crypto.h"
29 #include "qapi/qobject-input-visitor.h"
30 #include "qapi/error.h"
31 #include "qemu/module.h"
32 #include "qemu/option.h"
33 #include "qemu/cutils.h"
34 #include "qemu/memalign.h"
37 typedef struct BlockCrypto BlockCrypto
;
45 static int block_crypto_probe_generic(QCryptoBlockFormat format
,
50 if (qcrypto_block_has_format(format
, buf
, buf_size
)) {
58 static int block_crypto_read_func(QCryptoBlock
*block
,
65 BlockDriverState
*bs
= opaque
;
68 ret
= bdrv_pread(bs
->file
, offset
, buflen
, buf
, 0);
70 error_setg_errno(errp
, -ret
, "Could not read encryption header");
76 static int block_crypto_write_func(QCryptoBlock
*block
,
83 BlockDriverState
*bs
= opaque
;
86 ret
= bdrv_pwrite(bs
->file
, offset
, buflen
, buf
, 0);
88 error_setg_errno(errp
, -ret
, "Could not write encryption header");
95 struct BlockCryptoCreateData
{
98 PreallocMode prealloc
;
102 static int block_crypto_create_write_func(QCryptoBlock
*block
,
109 struct BlockCryptoCreateData
*data
= opaque
;
112 ret
= blk_pwrite(data
->blk
, offset
, buflen
, buf
, 0);
114 error_setg_errno(errp
, -ret
, "Could not write encryption header");
120 static int block_crypto_create_init_func(QCryptoBlock
*block
,
125 struct BlockCryptoCreateData
*data
= opaque
;
126 Error
*local_error
= NULL
;
129 if (data
->size
> INT64_MAX
|| headerlen
> INT64_MAX
- data
->size
) {
134 /* User provided size should reflect amount of space made
135 * available to the guest, so we must take account of that
136 * which will be used by the crypto header
138 ret
= blk_truncate(data
->blk
, data
->size
+ headerlen
, false,
139 data
->prealloc
, 0, &local_error
);
147 /* Replace the error message with a better one */
148 error_free(local_error
);
149 error_setg(errp
, "The requested file size is too large");
151 error_propagate(errp
, local_error
);
158 static QemuOptsList block_crypto_runtime_opts_luks
= {
160 .head
= QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks
.head
),
162 BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
163 { /* end of list */ }
168 static QemuOptsList block_crypto_create_opts_luks
= {
170 .head
= QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks
.head
),
173 .name
= BLOCK_OPT_SIZE
,
174 .type
= QEMU_OPT_SIZE
,
175 .help
= "Virtual disk size"
177 BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
178 BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(""),
179 BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(""),
180 BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(""),
181 BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(""),
182 BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(""),
183 BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""),
184 { /* end of list */ }
189 static QemuOptsList block_crypto_amend_opts_luks
= {
191 .head
= QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks
.head
),
193 BLOCK_CRYPTO_OPT_DEF_LUKS_STATE(""),
194 BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT(""),
195 BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET(""),
196 BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET(""),
197 BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""),
198 { /* end of list */ }
202 QCryptoBlockOpenOptions
*
203 block_crypto_open_opts_init(QDict
*opts
, Error
**errp
)
206 QCryptoBlockOpenOptions
*ret
;
208 v
= qobject_input_visitor_new_flat_confused(opts
, errp
);
213 visit_type_QCryptoBlockOpenOptions(v
, NULL
, &ret
, errp
);
220 QCryptoBlockCreateOptions
*
221 block_crypto_create_opts_init(QDict
*opts
, Error
**errp
)
224 QCryptoBlockCreateOptions
*ret
;
226 v
= qobject_input_visitor_new_flat_confused(opts
, errp
);
231 visit_type_QCryptoBlockCreateOptions(v
, NULL
, &ret
, errp
);
237 QCryptoBlockAmendOptions
*
238 block_crypto_amend_opts_init(QDict
*opts
, Error
**errp
)
241 QCryptoBlockAmendOptions
*ret
;
243 v
= qobject_input_visitor_new_flat_confused(opts
, errp
);
248 visit_type_QCryptoBlockAmendOptions(v
, NULL
, &ret
, errp
);
255 static int block_crypto_open_generic(QCryptoBlockFormat format
,
256 QemuOptsList
*opts_spec
,
257 BlockDriverState
*bs
,
262 BlockCrypto
*crypto
= bs
->opaque
;
263 QemuOpts
*opts
= NULL
;
265 QCryptoBlockOpenOptions
*open_opts
= NULL
;
266 unsigned int cflags
= 0;
267 QDict
*cryptoopts
= NULL
;
269 ret
= bdrv_open_file_child(NULL
, options
, "file", bs
, errp
);
274 bs
->supported_write_flags
= BDRV_REQ_FUA
&
275 bs
->file
->bs
->supported_write_flags
;
277 opts
= qemu_opts_create(opts_spec
, NULL
, 0, &error_abort
);
278 if (!qemu_opts_absorb_qdict(opts
, options
, errp
)) {
283 cryptoopts
= qemu_opts_to_qdict(opts
, NULL
);
284 qdict_put_str(cryptoopts
, "format", QCryptoBlockFormat_str(format
));
286 open_opts
= block_crypto_open_opts_init(cryptoopts
, errp
);
292 if (flags
& BDRV_O_NO_IO
) {
293 cflags
|= QCRYPTO_BLOCK_OPEN_NO_IO
;
295 crypto
->block
= qcrypto_block_open(open_opts
, NULL
,
296 block_crypto_read_func
,
302 if (!crypto
->block
) {
307 bs
->encrypted
= true;
311 qobject_unref(cryptoopts
);
312 qapi_free_QCryptoBlockOpenOptions(open_opts
);
317 static int coroutine_fn
318 block_crypto_co_create_generic(BlockDriverState
*bs
, int64_t size
,
319 QCryptoBlockCreateOptions
*opts
,
320 PreallocMode prealloc
, Error
**errp
)
324 QCryptoBlock
*crypto
= NULL
;
325 struct BlockCryptoCreateData data
;
327 blk
= blk_co_new_with_bs(bs
, BLK_PERM_WRITE
| BLK_PERM_RESIZE
, BLK_PERM_ALL
,
334 if (prealloc
== PREALLOC_MODE_METADATA
) {
335 prealloc
= PREALLOC_MODE_OFF
;
338 data
= (struct BlockCryptoCreateData
) {
341 .prealloc
= prealloc
,
344 crypto
= qcrypto_block_create(opts
, NULL
,
345 block_crypto_create_init_func
,
346 block_crypto_create_write_func
,
357 qcrypto_block_free(crypto
);
362 static int coroutine_fn GRAPH_RDLOCK
363 block_crypto_co_truncate(BlockDriverState
*bs
, int64_t offset
, bool exact
,
364 PreallocMode prealloc
, BdrvRequestFlags flags
,
367 BlockCrypto
*crypto
= bs
->opaque
;
368 uint64_t payload_offset
=
369 qcrypto_block_get_payload_offset(crypto
->block
);
371 if (payload_offset
> INT64_MAX
- offset
) {
372 error_setg(errp
, "The requested file size is too large");
376 offset
+= payload_offset
;
378 return bdrv_co_truncate(bs
->file
, offset
, exact
, prealloc
, 0, errp
);
381 static void block_crypto_close(BlockDriverState
*bs
)
383 BlockCrypto
*crypto
= bs
->opaque
;
384 qcrypto_block_free(crypto
->block
);
387 static int block_crypto_reopen_prepare(BDRVReopenState
*state
,
388 BlockReopenQueue
*queue
, Error
**errp
)
390 /* nothing needs checking */
395 * 1 MB bounce buffer gives good performance / memory tradeoff
396 * when using cache=none|directsync.
398 #define BLOCK_CRYPTO_MAX_IO_SIZE (1024 * 1024)
400 static int coroutine_fn GRAPH_RDLOCK
401 block_crypto_co_preadv(BlockDriverState
*bs
, int64_t offset
, int64_t bytes
,
402 QEMUIOVector
*qiov
, BdrvRequestFlags flags
)
404 BlockCrypto
*crypto
= bs
->opaque
;
405 uint64_t cur_bytes
; /* number of bytes in current iteration */
406 uint64_t bytes_done
= 0;
407 uint8_t *cipher_data
= NULL
;
408 QEMUIOVector hd_qiov
;
410 uint64_t sector_size
= qcrypto_block_get_sector_size(crypto
->block
);
411 uint64_t payload_offset
= qcrypto_block_get_payload_offset(crypto
->block
);
413 assert(payload_offset
< INT64_MAX
);
414 assert(QEMU_IS_ALIGNED(offset
, sector_size
));
415 assert(QEMU_IS_ALIGNED(bytes
, sector_size
));
417 qemu_iovec_init(&hd_qiov
, qiov
->niov
);
419 /* Bounce buffer because we don't wish to expose cipher text
420 * in qiov which points to guest memory.
423 qemu_try_blockalign(bs
->file
->bs
, MIN(BLOCK_CRYPTO_MAX_IO_SIZE
,
425 if (cipher_data
== NULL
) {
431 cur_bytes
= MIN(bytes
, BLOCK_CRYPTO_MAX_IO_SIZE
);
433 qemu_iovec_reset(&hd_qiov
);
434 qemu_iovec_add(&hd_qiov
, cipher_data
, cur_bytes
);
436 ret
= bdrv_co_preadv(bs
->file
, payload_offset
+ offset
+ bytes_done
,
437 cur_bytes
, &hd_qiov
, 0);
442 if (qcrypto_block_decrypt(crypto
->block
, offset
+ bytes_done
,
443 cipher_data
, cur_bytes
, NULL
) < 0) {
448 qemu_iovec_from_buf(qiov
, bytes_done
, cipher_data
, cur_bytes
);
451 bytes_done
+= cur_bytes
;
455 qemu_iovec_destroy(&hd_qiov
);
456 qemu_vfree(cipher_data
);
462 static int coroutine_fn GRAPH_RDLOCK
463 block_crypto_co_pwritev(BlockDriverState
*bs
, int64_t offset
, int64_t bytes
,
464 QEMUIOVector
*qiov
, BdrvRequestFlags flags
)
466 BlockCrypto
*crypto
= bs
->opaque
;
467 uint64_t cur_bytes
; /* number of bytes in current iteration */
468 uint64_t bytes_done
= 0;
469 uint8_t *cipher_data
= NULL
;
470 QEMUIOVector hd_qiov
;
472 uint64_t sector_size
= qcrypto_block_get_sector_size(crypto
->block
);
473 uint64_t payload_offset
= qcrypto_block_get_payload_offset(crypto
->block
);
475 flags
&= ~BDRV_REQ_REGISTERED_BUF
;
477 assert(payload_offset
< INT64_MAX
);
478 assert(QEMU_IS_ALIGNED(offset
, sector_size
));
479 assert(QEMU_IS_ALIGNED(bytes
, sector_size
));
481 qemu_iovec_init(&hd_qiov
, qiov
->niov
);
483 /* Bounce buffer because we're not permitted to touch
484 * contents of qiov - it points to guest memory.
487 qemu_try_blockalign(bs
->file
->bs
, MIN(BLOCK_CRYPTO_MAX_IO_SIZE
,
489 if (cipher_data
== NULL
) {
495 cur_bytes
= MIN(bytes
, BLOCK_CRYPTO_MAX_IO_SIZE
);
497 qemu_iovec_to_buf(qiov
, bytes_done
, cipher_data
, cur_bytes
);
499 if (qcrypto_block_encrypt(crypto
->block
, offset
+ bytes_done
,
500 cipher_data
, cur_bytes
, NULL
) < 0) {
505 qemu_iovec_reset(&hd_qiov
);
506 qemu_iovec_add(&hd_qiov
, cipher_data
, cur_bytes
);
508 ret
= bdrv_co_pwritev(bs
->file
, payload_offset
+ offset
+ bytes_done
,
509 cur_bytes
, &hd_qiov
, flags
);
515 bytes_done
+= cur_bytes
;
519 qemu_iovec_destroy(&hd_qiov
);
520 qemu_vfree(cipher_data
);
525 static void block_crypto_refresh_limits(BlockDriverState
*bs
, Error
**errp
)
527 BlockCrypto
*crypto
= bs
->opaque
;
528 uint64_t sector_size
= qcrypto_block_get_sector_size(crypto
->block
);
529 bs
->bl
.request_alignment
= sector_size
; /* No sub-sector I/O */
533 static int64_t coroutine_fn GRAPH_RDLOCK
534 block_crypto_co_getlength(BlockDriverState
*bs
)
536 BlockCrypto
*crypto
= bs
->opaque
;
537 int64_t len
= bdrv_co_getlength(bs
->file
->bs
);
539 uint64_t offset
= qcrypto_block_get_payload_offset(crypto
->block
);
540 assert(offset
< INT64_MAX
);
552 static BlockMeasureInfo
*block_crypto_measure(QemuOpts
*opts
,
553 BlockDriverState
*in_bs
,
556 g_autoptr(QCryptoBlockCreateOptions
) create_opts
= NULL
;
557 Error
*local_err
= NULL
;
558 BlockMeasureInfo
*info
;
560 size_t luks_payload_size
;
564 * Preallocation mode doesn't affect size requirements but we must consume
567 g_free(qemu_opt_get_del(opts
, BLOCK_OPT_PREALLOC
));
569 size
= qemu_opt_get_size_del(opts
, BLOCK_OPT_SIZE
, 0);
572 int64_t ssize
= bdrv_getlength(in_bs
);
575 error_setg_errno(&local_err
, -ssize
,
576 "Unable to get image virtual_size");
583 cryptoopts
= qemu_opts_to_qdict_filtered(opts
, NULL
,
584 &block_crypto_create_opts_luks
, true);
585 qdict_put_str(cryptoopts
, "format", "luks");
586 create_opts
= block_crypto_create_opts_init(cryptoopts
, &local_err
);
587 qobject_unref(cryptoopts
);
592 if (!qcrypto_block_calculate_payload_offset(create_opts
, NULL
,
599 * Unallocated blocks are still encrypted so allocation status makes no
600 * difference to the file size.
602 info
= g_new0(BlockMeasureInfo
, 1);
603 info
->fully_allocated
= luks_payload_size
+ size
;
604 info
->required
= luks_payload_size
+ size
;
608 error_propagate(errp
, local_err
);
613 static int block_crypto_probe_luks(const uint8_t *buf
,
615 const char *filename
) {
616 return block_crypto_probe_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS
,
617 buf
, buf_size
, filename
);
620 static int block_crypto_open_luks(BlockDriverState
*bs
,
625 return block_crypto_open_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS
,
626 &block_crypto_runtime_opts_luks
,
627 bs
, options
, flags
, errp
);
630 static int coroutine_fn
631 block_crypto_co_create_luks(BlockdevCreateOptions
*create_options
, Error
**errp
)
633 BlockdevCreateOptionsLUKS
*luks_opts
;
634 BlockDriverState
*bs
= NULL
;
635 QCryptoBlockCreateOptions create_opts
;
636 PreallocMode preallocation
= PREALLOC_MODE_OFF
;
639 assert(create_options
->driver
== BLOCKDEV_DRIVER_LUKS
);
640 luks_opts
= &create_options
->u
.luks
;
642 bs
= bdrv_co_open_blockdev_ref(luks_opts
->file
, errp
);
647 create_opts
= (QCryptoBlockCreateOptions
) {
648 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
649 .u
.luks
= *qapi_BlockdevCreateOptionsLUKS_base(luks_opts
),
652 if (luks_opts
->has_preallocation
) {
653 preallocation
= luks_opts
->preallocation
;
656 ret
= block_crypto_co_create_generic(bs
, luks_opts
->size
, &create_opts
,
657 preallocation
, errp
);
668 static int coroutine_fn GRAPH_RDLOCK
669 block_crypto_co_create_opts_luks(BlockDriver
*drv
, const char *filename
,
670 QemuOpts
*opts
, Error
**errp
)
672 QCryptoBlockCreateOptions
*create_opts
= NULL
;
673 BlockDriverState
*bs
= NULL
;
675 PreallocMode prealloc
;
679 Error
*local_err
= NULL
;
682 size
= qemu_opt_get_size_del(opts
, BLOCK_OPT_SIZE
, 0);
684 buf
= qemu_opt_get_del(opts
, BLOCK_OPT_PREALLOC
);
685 prealloc
= qapi_enum_parse(&PreallocMode_lookup
, buf
,
686 PREALLOC_MODE_OFF
, &local_err
);
689 error_propagate(errp
, local_err
);
693 cryptoopts
= qemu_opts_to_qdict_filtered(opts
, NULL
,
694 &block_crypto_create_opts_luks
,
697 qdict_put_str(cryptoopts
, "format", "luks");
698 create_opts
= block_crypto_create_opts_init(cryptoopts
, errp
);
704 /* Create protocol layer */
705 ret
= bdrv_co_create_file(filename
, opts
, errp
);
710 bs
= bdrv_co_open(filename
, NULL
, NULL
,
711 BDRV_O_RDWR
| BDRV_O_RESIZE
| BDRV_O_PROTOCOL
, errp
);
717 /* Create format layer */
718 ret
= block_crypto_co_create_generic(bs
, size
, create_opts
, prealloc
, errp
);
726 * If an error occurred, delete 'filename'. Even if the file existed
727 * beforehand, it has been truncated and corrupted in the process.
730 bdrv_co_delete_file_noerr(bs
);
734 qapi_free_QCryptoBlockCreateOptions(create_opts
);
735 qobject_unref(cryptoopts
);
739 static int coroutine_fn GRAPH_RDLOCK
740 block_crypto_co_get_info_luks(BlockDriverState
*bs
, BlockDriverInfo
*bdi
)
742 BlockDriverInfo subbdi
;
745 ret
= bdrv_co_get_info(bs
->file
->bs
, &subbdi
);
750 bdi
->cluster_size
= subbdi
.cluster_size
;
755 static ImageInfoSpecific
*
756 block_crypto_get_specific_info_luks(BlockDriverState
*bs
, Error
**errp
)
758 BlockCrypto
*crypto
= bs
->opaque
;
759 ImageInfoSpecific
*spec_info
;
760 QCryptoBlockInfo
*info
;
762 info
= qcrypto_block_get_info(crypto
->block
, errp
);
766 assert(info
->format
== Q_CRYPTO_BLOCK_FORMAT_LUKS
);
768 spec_info
= g_new(ImageInfoSpecific
, 1);
769 spec_info
->type
= IMAGE_INFO_SPECIFIC_KIND_LUKS
;
770 spec_info
->u
.luks
.data
= g_new(QCryptoBlockInfoLUKS
, 1);
771 *spec_info
->u
.luks
.data
= info
->u
.luks
;
773 /* Blank out pointers we've just stolen to avoid double free */
774 memset(&info
->u
.luks
, 0, sizeof(info
->u
.luks
));
776 qapi_free_QCryptoBlockInfo(info
);
782 block_crypto_amend_prepare(BlockDriverState
*bs
, Error
**errp
)
784 BlockCrypto
*crypto
= bs
->opaque
;
787 /* apply for exclusive read/write permissions to the underlying file */
788 crypto
->updating_keys
= true;
789 ret
= bdrv_child_refresh_perms(bs
, bs
->file
, errp
);
791 /* Well, in this case we will not be updating any keys */
792 crypto
->updating_keys
= false;
798 block_crypto_amend_cleanup(BlockDriverState
*bs
)
800 BlockCrypto
*crypto
= bs
->opaque
;
803 /* release exclusive read/write permissions to the underlying file */
804 crypto
->updating_keys
= false;
805 bdrv_child_refresh_perms(bs
, bs
->file
, &errp
);
808 error_report_err(errp
);
813 block_crypto_amend_options_generic_luks(BlockDriverState
*bs
,
814 QCryptoBlockAmendOptions
*amend_options
,
818 BlockCrypto
*crypto
= bs
->opaque
;
821 assert(crypto
->block
);
823 return qcrypto_block_amend_options(crypto
->block
,
824 block_crypto_read_func
,
825 block_crypto_write_func
,
833 block_crypto_amend_options_luks(BlockDriverState
*bs
,
835 BlockDriverAmendStatusCB
*status_cb
,
840 BlockCrypto
*crypto
= bs
->opaque
;
841 QDict
*cryptoopts
= NULL
;
842 QCryptoBlockAmendOptions
*amend_options
= NULL
;
846 assert(crypto
->block
);
848 cryptoopts
= qemu_opts_to_qdict(opts
, NULL
);
849 qdict_put_str(cryptoopts
, "format", "luks");
850 amend_options
= block_crypto_amend_opts_init(cryptoopts
, errp
);
851 qobject_unref(cryptoopts
);
852 if (!amend_options
) {
856 ret
= block_crypto_amend_prepare(bs
, errp
);
860 ret
= block_crypto_amend_options_generic_luks(bs
, amend_options
,
864 block_crypto_amend_cleanup(bs
);
866 qapi_free_QCryptoBlockAmendOptions(amend_options
);
871 coroutine_fn
block_crypto_co_amend_luks(BlockDriverState
*bs
,
872 BlockdevAmendOptions
*opts
,
876 QCryptoBlockAmendOptions amend_opts
;
878 amend_opts
= (QCryptoBlockAmendOptions
) {
879 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
880 .u
.luks
= *qapi_BlockdevAmendOptionsLUKS_base(&opts
->u
.luks
),
882 return block_crypto_amend_options_generic_luks(bs
, &amend_opts
,
887 block_crypto_child_perms(BlockDriverState
*bs
, BdrvChild
*c
,
888 const BdrvChildRole role
,
889 BlockReopenQueue
*reopen_queue
,
890 uint64_t perm
, uint64_t shared
,
891 uint64_t *nperm
, uint64_t *nshared
)
894 BlockCrypto
*crypto
= bs
->opaque
;
896 bdrv_default_perms(bs
, c
, role
, reopen_queue
, perm
, shared
, nperm
, nshared
);
899 * For backward compatibility, manually share the write
900 * and resize permission
902 *nshared
|= shared
& (BLK_PERM_WRITE
| BLK_PERM_RESIZE
);
904 * Since we are not fully a format driver, don't always request
905 * the read/resize permission but only when explicitly
908 *nperm
&= ~(BLK_PERM_WRITE
| BLK_PERM_RESIZE
);
909 *nperm
|= perm
& (BLK_PERM_WRITE
| BLK_PERM_RESIZE
);
912 * This driver doesn't modify LUKS metadata except
913 * when updating the encryption slots.
914 * Thus unlike a proper format driver we don't ask for
915 * shared write/read permission. However we need it
916 * when we are updating the keys, to ensure that only we
917 * have access to the device.
919 * Encryption update will set the crypto->updating_keys
920 * during that period and refresh permissions
923 if (crypto
->updating_keys
) {
924 /* need exclusive write access for header update */
925 *nperm
|= BLK_PERM_WRITE
;
926 /* unshare read and write permission */
927 *nshared
&= ~(BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE
);
932 static const char *const block_crypto_strong_runtime_opts
[] = {
933 BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET
,
938 static BlockDriver bdrv_crypto_luks
= {
939 .format_name
= "luks",
940 .instance_size
= sizeof(BlockCrypto
),
941 .bdrv_probe
= block_crypto_probe_luks
,
942 .bdrv_open
= block_crypto_open_luks
,
943 .bdrv_close
= block_crypto_close
,
944 .bdrv_child_perm
= block_crypto_child_perms
,
945 .bdrv_co_create
= block_crypto_co_create_luks
,
946 .bdrv_co_create_opts
= block_crypto_co_create_opts_luks
,
947 .bdrv_co_truncate
= block_crypto_co_truncate
,
948 .create_opts
= &block_crypto_create_opts_luks
,
949 .amend_opts
= &block_crypto_amend_opts_luks
,
951 .bdrv_reopen_prepare
= block_crypto_reopen_prepare
,
952 .bdrv_refresh_limits
= block_crypto_refresh_limits
,
953 .bdrv_co_preadv
= block_crypto_co_preadv
,
954 .bdrv_co_pwritev
= block_crypto_co_pwritev
,
955 .bdrv_co_getlength
= block_crypto_co_getlength
,
956 .bdrv_measure
= block_crypto_measure
,
957 .bdrv_co_get_info
= block_crypto_co_get_info_luks
,
958 .bdrv_get_specific_info
= block_crypto_get_specific_info_luks
,
959 .bdrv_amend_options
= block_crypto_amend_options_luks
,
960 .bdrv_co_amend
= block_crypto_co_amend_luks
,
961 .bdrv_amend_pre_run
= block_crypto_amend_prepare
,
962 .bdrv_amend_clean
= block_crypto_amend_cleanup
,
966 .strong_runtime_opts
= block_crypto_strong_runtime_opts
,
969 static void block_crypto_init(void)
971 bdrv_register(&bdrv_crypto_luks
);
974 block_init(block_crypto_init
);