Commit cb77cb5a authored by Eric Biggers's avatar Eric Biggers Committed by Jens Axboe
Browse files

blk-crypto: rename blk_keyslot_manager to blk_crypto_profile 



blk_keyslot_manager is misnamed because it doesn't necessarily manage
keyslots.  It actually does several different things:

  - Contains the crypto capabilities of the device.

  - Provides functions to control the inline encryption hardware.
    Originally these were just for programming/evicting keyslots;
    however, new functionality (hardware-wrapped keys) will require new
    functions here which are unrelated to keyslots.  Moreover,
    device-mapper devices already (ab)use "keyslot_evict" to pass key
    eviction requests to their underlying devices even though
    device-mapper devices don't have any keyslots themselves (so it
    really should be "evict_key", not "keyslot_evict").

  - Sometimes (but not always!) it manages keyslots.  Originally it
    always did, but device-mapper devices don't have keyslots
    themselves, so they use a "passthrough keyslot manager" which
    doesn't actually manage keyslots.  This hack works, but the
    terminology is unnatural.  Also, some hardware doesn't have keyslots
    and thus also uses a "passthrough keyslot manager" (support for such
    hardware is yet to be upstreamed, but it will happen eventually).

Let's stop having keyslot managers which don't actually manage keyslots.
Instead, rename blk_keyslot_manager to blk_crypto_profile.

This is a fairly big change, since for consistency it also has to update
keyslot manager-related function names, variable names, and comments --
not just the actual struct name.  However it's still a fairly
straightforward change, as it doesn't change any actual functionality.

Acked-by: Ulf Hansson <ulf.hansson@linaro.org> # For MMC
Reviewed-by: default avatarMike Snitzer <snitzer@redhat.com>
Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20211018180453.40441-4-ebiggers@kernel.org


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 1e8d44bd

block/blk-crypto-fallback.c

+35 −36
Original line number Original line Diff line number Diff line
@@ -78,7 +78,7 @@ static struct blk_crypto_fallback_keyslot { 
	struct crypto_skcipher *tfms[BLK_ENCRYPTION_MODE_MAX];

	struct crypto_skcipher *tfms[BLK_ENCRYPTION_MODE_MAX];

} *blk_crypto_keyslots;

} *blk_crypto_keyslots;





static struct blk_keyslot_manager blk_crypto_ksm;

static struct blk_crypto_profile blk_crypto_fallback_profile;

static struct workqueue_struct *blk_crypto_wq;

static struct workqueue_struct *blk_crypto_wq;

static mempool_t *blk_crypto_bounce_page_pool;

static mempool_t *blk_crypto_bounce_page_pool;

static struct bio_set crypto_bio_split;

static struct bio_set crypto_bio_split;
@@ -104,7 +104,8 @@ static void blk_crypto_fallback_evict_keyslot(unsigned int slot) 
	slotp->crypto_mode = BLK_ENCRYPTION_MODE_INVALID;

	slotp->crypto_mode = BLK_ENCRYPTION_MODE_INVALID;

}

}





static int blk_crypto_fallback_keyslot_program(struct blk_keyslot_manager *ksm,

static int

blk_crypto_fallback_keyslot_program(struct blk_crypto_profile *profile,

				    const struct blk_crypto_key *key,

				    const struct blk_crypto_key *key,

				    unsigned int slot)

				    unsigned int slot)

{

{
@@ -127,7 +128,7 @@ static int blk_crypto_fallback_keyslot_program(struct blk_keyslot_manager *ksm, 
	return 0;

	return 0;

}

}





static int blk_crypto_fallback_keyslot_evict(struct blk_keyslot_manager *ksm,

static int blk_crypto_fallback_keyslot_evict(struct blk_crypto_profile *profile,

					     const struct blk_crypto_key *key,

					     const struct blk_crypto_key *key,

					     unsigned int slot)

					     unsigned int slot)

{

{
@@ -135,12 +136,7 @@ static int blk_crypto_fallback_keyslot_evict(struct blk_keyslot_manager *ksm, 
	return 0;

	return 0;

}

}





/*

static const struct blk_crypto_ll_ops blk_crypto_fallback_ll_ops = {

 * The crypto API fallback KSM ops - only used for a bio when it specifies a

 * blk_crypto_key that was not supported by the device's inline encryption

 * hardware.

 */

static const struct blk_ksm_ll_ops blk_crypto_ksm_ll_ops = {

	.keyslot_program        = blk_crypto_fallback_keyslot_program,

	.keyslot_program        = blk_crypto_fallback_keyslot_program,

	.keyslot_evict          = blk_crypto_fallback_keyslot_evict,

	.keyslot_evict          = blk_crypto_fallback_keyslot_evict,

};

};
@@ -188,13 +184,13 @@ static struct bio *blk_crypto_fallback_clone_bio(struct bio *bio_src) 
}

}





static bool

static bool

blk_crypto_fallback_alloc_cipher_req(struct blk_ksm_keyslot *slot,

blk_crypto_fallback_alloc_cipher_req(struct blk_crypto_keyslot *slot,

				     struct skcipher_request **ciph_req_ret,

				     struct skcipher_request **ciph_req_ret,

				     struct crypto_wait *wait)

				     struct crypto_wait *wait)

{

{

	struct skcipher_request *ciph_req;

	struct skcipher_request *ciph_req;

	const struct blk_crypto_fallback_keyslot *slotp;

	const struct blk_crypto_fallback_keyslot *slotp;

	int keyslot_idx = blk_ksm_get_slot_idx(slot);

	int keyslot_idx = blk_crypto_keyslot_index(slot);





	slotp = &blk_crypto_keyslots[keyslot_idx];

	slotp = &blk_crypto_keyslots[keyslot_idx];

	ciph_req = skcipher_request_alloc(slotp->tfms[slotp->crypto_mode],

	ciph_req = skcipher_request_alloc(slotp->tfms[slotp->crypto_mode],
@@ -266,7 +262,7 @@ static bool blk_crypto_fallback_encrypt_bio(struct bio **bio_ptr) 
{

{

	struct bio *src_bio, *enc_bio;

	struct bio *src_bio, *enc_bio;

	struct bio_crypt_ctx *bc;

	struct bio_crypt_ctx *bc;

	struct blk_ksm_keyslot *slot;

	struct blk_crypto_keyslot *slot;

	int data_unit_size;

	int data_unit_size;

	struct skcipher_request *ciph_req = NULL;

	struct skcipher_request *ciph_req = NULL;

	DECLARE_CRYPTO_WAIT(wait);

	DECLARE_CRYPTO_WAIT(wait);
@@ -293,10 +289,11 @@ static bool blk_crypto_fallback_encrypt_bio(struct bio **bio_ptr) 
	}

	}





	/*

	/*

	 * Use the crypto API fallback keyslot manager to get a crypto_skcipher

	 * Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for

	 * for the algorithm and key specified for this bio.

	 * this bio's algorithm and key.

	 */

	 */

	blk_st = blk_ksm_get_slot_for_key(&blk_crypto_ksm, bc->bc_key, &slot);

	blk_st = blk_crypto_get_keyslot(&blk_crypto_fallback_profile,

					bc->bc_key, &slot);

	if (blk_st != BLK_STS_OK) {

	if (blk_st != BLK_STS_OK) {

		src_bio->bi_status = blk_st;

		src_bio->bi_status = blk_st;

		goto out_put_enc_bio;

		goto out_put_enc_bio;
@@ -364,7 +361,7 @@ static bool blk_crypto_fallback_encrypt_bio(struct bio **bio_ptr) 
out_free_ciph_req:

out_free_ciph_req:

	skcipher_request_free(ciph_req);

	skcipher_request_free(ciph_req);

out_release_keyslot:

out_release_keyslot:

	blk_ksm_put_slot(slot);

	blk_crypto_put_keyslot(slot);

out_put_enc_bio:

out_put_enc_bio:

	if (enc_bio)

	if (enc_bio)

		bio_put(enc_bio);

		bio_put(enc_bio);
@@ -382,7 +379,7 @@ static void blk_crypto_fallback_decrypt_bio(struct work_struct *work) 
		container_of(work, struct bio_fallback_crypt_ctx, work);

		container_of(work, struct bio_fallback_crypt_ctx, work);

	struct bio *bio = f_ctx->bio;

	struct bio *bio = f_ctx->bio;

	struct bio_crypt_ctx *bc = &f_ctx->crypt_ctx;

	struct bio_crypt_ctx *bc = &f_ctx->crypt_ctx;

	struct blk_ksm_keyslot *slot;

	struct blk_crypto_keyslot *slot;

	struct skcipher_request *ciph_req = NULL;

	struct skcipher_request *ciph_req = NULL;

	DECLARE_CRYPTO_WAIT(wait);

	DECLARE_CRYPTO_WAIT(wait);

	u64 curr_dun[BLK_CRYPTO_DUN_ARRAY_SIZE];

	u64 curr_dun[BLK_CRYPTO_DUN_ARRAY_SIZE];
@@ -395,10 +392,11 @@ static void blk_crypto_fallback_decrypt_bio(struct work_struct *work) 
	blk_status_t blk_st;

	blk_status_t blk_st;





	/*

	/*

	 * Use the crypto API fallback keyslot manager to get a crypto_skcipher

	 * Get a blk-crypto-fallback keyslot that contains a crypto_skcipher for

	 * for the algorithm and key specified for this bio.

	 * this bio's algorithm and key.

	 */

	 */

	blk_st = blk_ksm_get_slot_for_key(&blk_crypto_ksm, bc->bc_key, &slot);

	blk_st = blk_crypto_get_keyslot(&blk_crypto_fallback_profile,

					bc->bc_key, &slot);

	if (blk_st != BLK_STS_OK) {

	if (blk_st != BLK_STS_OK) {

		bio->bi_status = blk_st;

		bio->bi_status = blk_st;

		goto out_no_keyslot;

		goto out_no_keyslot;
@@ -436,7 +434,7 @@ static void blk_crypto_fallback_decrypt_bio(struct work_struct *work) 




out:

out:

	skcipher_request_free(ciph_req);

	skcipher_request_free(ciph_req);

	blk_ksm_put_slot(slot);

	blk_crypto_put_keyslot(slot);

out_no_keyslot:

out_no_keyslot:

	mempool_free(f_ctx, bio_fallback_crypt_ctx_pool);

	mempool_free(f_ctx, bio_fallback_crypt_ctx_pool);

	bio_endio(bio);

	bio_endio(bio);
@@ -501,7 +499,7 @@ bool blk_crypto_fallback_bio_prep(struct bio **bio_ptr) 
		return false;

		return false;

	}

	}





	if (!blk_ksm_crypto_cfg_supported(&blk_crypto_ksm,

	if (!__blk_crypto_cfg_supported(&blk_crypto_fallback_profile,

					&bc->bc_key->crypto_cfg)) {

					&bc->bc_key->crypto_cfg)) {

		bio->bi_status = BLK_STS_NOTSUPP;

		bio->bi_status = BLK_STS_NOTSUPP;

		return false;

		return false;
@@ -528,7 +526,7 @@ bool blk_crypto_fallback_bio_prep(struct bio **bio_ptr) 




int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key)

int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key)

{

{

	return blk_ksm_evict_key(&blk_crypto_ksm, key);

	return __blk_crypto_evict_key(&blk_crypto_fallback_profile, key);

}

}





static bool blk_crypto_fallback_inited;

static bool blk_crypto_fallback_inited;
@@ -536,6 +534,7 @@ static int blk_crypto_fallback_init(void) 
{

{

	int i;

	int i;

	int err;

	int err;

	struct blk_crypto_profile *profile = &blk_crypto_fallback_profile;





	if (blk_crypto_fallback_inited)

	if (blk_crypto_fallback_inited)

		return 0;

		return 0;
@@ -546,24 +545,24 @@ static int blk_crypto_fallback_init(void) 
	if (err)

	if (err)

		goto out;

		goto out;





	err = blk_ksm_init(&blk_crypto_ksm, blk_crypto_num_keyslots);

	err = blk_crypto_profile_init(profile, blk_crypto_num_keyslots);

	if (err)

	if (err)

		goto fail_free_bioset;

		goto fail_free_bioset;

	err = -ENOMEM;

	err = -ENOMEM;





	blk_crypto_ksm.ksm_ll_ops = blk_crypto_ksm_ll_ops;

	profile->ll_ops = blk_crypto_fallback_ll_ops;

	blk_crypto_ksm.max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE;

	profile->max_dun_bytes_supported = BLK_CRYPTO_MAX_IV_SIZE;





	/* All blk-crypto modes have a crypto API fallback. */

	/* All blk-crypto modes have a crypto API fallback. */

	for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++)

	for (i = 0; i < BLK_ENCRYPTION_MODE_MAX; i++)

		blk_crypto_ksm.crypto_modes_supported[i] = 0xFFFFFFFF;

		profile->modes_supported[i] = 0xFFFFFFFF;

	blk_crypto_ksm.crypto_modes_supported[BLK_ENCRYPTION_MODE_INVALID] = 0;

	profile->modes_supported[BLK_ENCRYPTION_MODE_INVALID] = 0;





	blk_crypto_wq = alloc_workqueue("blk_crypto_wq",

	blk_crypto_wq = alloc_workqueue("blk_crypto_wq",

					WQ_UNBOUND | WQ_HIGHPRI |

					WQ_UNBOUND | WQ_HIGHPRI |

					WQ_MEM_RECLAIM, num_online_cpus());

					WQ_MEM_RECLAIM, num_online_cpus());

	if (!blk_crypto_wq)

	if (!blk_crypto_wq)

		goto fail_free_ksm;

		goto fail_destroy_profile;





	blk_crypto_keyslots = kcalloc(blk_crypto_num_keyslots,

	blk_crypto_keyslots = kcalloc(blk_crypto_num_keyslots,

				      sizeof(blk_crypto_keyslots[0]),

				      sizeof(blk_crypto_keyslots[0]),
@@ -597,8 +596,8 @@ static int blk_crypto_fallback_init(void) 
	kfree(blk_crypto_keyslots);

	kfree(blk_crypto_keyslots);

fail_free_wq:

fail_free_wq:

	destroy_workqueue(blk_crypto_wq);

	destroy_workqueue(blk_crypto_wq);

fail_free_ksm:

fail_destroy_profile:

	blk_ksm_destroy(&blk_crypto_ksm);

	blk_crypto_profile_destroy(profile);

fail_free_bioset:

fail_free_bioset:

	bioset_exit(&crypto_bio_split);

	bioset_exit(&crypto_bio_split);

out:

out: