1 c285a1f8 2020-11-06 stsp /* $OpenBSD: softraid_crypto.c,v 1.139 2020/07/13 00:06:22 kn Exp $ */
3 c285a1f8 2020-11-06 stsp * Copyright (c) 2007 Marco Peereboom <marco@peereboom.us>
4 c285a1f8 2020-11-06 stsp * Copyright (c) 2008 Hans-Joerg Hoexer <hshoexer@openbsd.org>
5 c285a1f8 2020-11-06 stsp * Copyright (c) 2008 Damien Miller <djm@mindrot.org>
6 c285a1f8 2020-11-06 stsp * Copyright (c) 2009 Joel Sing <jsing@openbsd.org>
8 c285a1f8 2020-11-06 stsp * Permission to use, copy, modify, and distribute this software for any
9 c285a1f8 2020-11-06 stsp * purpose with or without fee is hereby granted, provided that the above
10 c285a1f8 2020-11-06 stsp * copyright notice and this permission notice appear in all copies.
12 c285a1f8 2020-11-06 stsp * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 c285a1f8 2020-11-06 stsp * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 c285a1f8 2020-11-06 stsp * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 c285a1f8 2020-11-06 stsp * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 c285a1f8 2020-11-06 stsp * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 c285a1f8 2020-11-06 stsp * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 c285a1f8 2020-11-06 stsp * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 c285a1f8 2020-11-06 stsp #include "bio.h"
23 c285a1f8 2020-11-06 stsp #include <sys/param.h>
24 c285a1f8 2020-11-06 stsp #include <sys/systm.h>
25 c285a1f8 2020-11-06 stsp #include <sys/buf.h>
26 c285a1f8 2020-11-06 stsp #include <sys/device.h>
27 c285a1f8 2020-11-06 stsp #include <sys/ioctl.h>
28 c285a1f8 2020-11-06 stsp #include <sys/malloc.h>
29 c285a1f8 2020-11-06 stsp #include <sys/pool.h>
30 c285a1f8 2020-11-06 stsp #include <sys/kernel.h>
31 c285a1f8 2020-11-06 stsp #include <sys/disk.h>
32 c285a1f8 2020-11-06 stsp #include <sys/rwlock.h>
33 c285a1f8 2020-11-06 stsp #include <sys/queue.h>
34 c285a1f8 2020-11-06 stsp #include <sys/fcntl.h>
35 c285a1f8 2020-11-06 stsp #include <sys/disklabel.h>
36 c285a1f8 2020-11-06 stsp #include <sys/vnode.h>
37 c285a1f8 2020-11-06 stsp #include <sys/mount.h>
38 c285a1f8 2020-11-06 stsp #include <sys/sensors.h>
39 c285a1f8 2020-11-06 stsp #include <sys/stat.h>
40 c285a1f8 2020-11-06 stsp #include <sys/conf.h>
41 c285a1f8 2020-11-06 stsp #include <sys/uio.h>
42 c285a1f8 2020-11-06 stsp #include <sys/dkio.h>
44 c285a1f8 2020-11-06 stsp #include <crypto/cryptodev.h>
45 c285a1f8 2020-11-06 stsp #include <crypto/rijndael.h>
46 c285a1f8 2020-11-06 stsp #include <crypto/md5.h>
47 c285a1f8 2020-11-06 stsp #include <crypto/sha1.h>
48 c285a1f8 2020-11-06 stsp #include <crypto/sha2.h>
49 c285a1f8 2020-11-06 stsp #include <crypto/hmac.h>
51 c285a1f8 2020-11-06 stsp #include <scsi/scsi_all.h>
52 c285a1f8 2020-11-06 stsp #include <scsi/scsiconf.h>
53 c285a1f8 2020-11-06 stsp #include <scsi/scsi_disk.h>
55 c285a1f8 2020-11-06 stsp #include <dev/softraidvar.h>
58 c285a1f8 2020-11-06 stsp * The per-I/O data that we need to preallocate. We cannot afford to allow I/O
59 c285a1f8 2020-11-06 stsp * to start failing when memory pressure kicks in. We can store this in the WU
60 c285a1f8 2020-11-06 stsp * because we assert that only one ccb per WU will ever be active.
62 c285a1f8 2020-11-06 stsp struct sr_crypto_wu {
63 c285a1f8 2020-11-06 stsp struct sr_workunit cr_wu; /* Must be first. */
64 c285a1f8 2020-11-06 stsp struct uio cr_uio;
65 c285a1f8 2020-11-06 stsp struct iovec cr_iov;
66 c285a1f8 2020-11-06 stsp struct cryptop *cr_crp;
67 c285a1f8 2020-11-06 stsp void *cr_dmabuf;
71 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *sr_crypto_prepare(struct sr_workunit *, int);
72 c285a1f8 2020-11-06 stsp int sr_crypto_create_keys(struct sr_discipline *);
73 c285a1f8 2020-11-06 stsp int sr_crypto_get_kdf(struct bioc_createraid *,
74 c285a1f8 2020-11-06 stsp struct sr_discipline *);
75 c285a1f8 2020-11-06 stsp int sr_crypto_decrypt(u_char *, u_char *, u_char *, size_t, int);
76 c285a1f8 2020-11-06 stsp int sr_crypto_encrypt(u_char *, u_char *, u_char *, size_t, int);
77 c285a1f8 2020-11-06 stsp int sr_crypto_decrypt_key(struct sr_discipline *);
78 c285a1f8 2020-11-06 stsp int sr_crypto_change_maskkey(struct sr_discipline *,
79 c285a1f8 2020-11-06 stsp struct sr_crypto_kdfinfo *, struct sr_crypto_kdfinfo *);
80 c285a1f8 2020-11-06 stsp int sr_crypto_create(struct sr_discipline *,
81 c285a1f8 2020-11-06 stsp struct bioc_createraid *, int, int64_t);
82 c285a1f8 2020-11-06 stsp int sr_crypto_assemble(struct sr_discipline *,
83 c285a1f8 2020-11-06 stsp struct bioc_createraid *, int, void *);
84 c285a1f8 2020-11-06 stsp int sr_crypto_alloc_resources(struct sr_discipline *);
85 c285a1f8 2020-11-06 stsp void sr_crypto_free_resources(struct sr_discipline *);
86 c285a1f8 2020-11-06 stsp int sr_crypto_ioctl(struct sr_discipline *,
87 c285a1f8 2020-11-06 stsp struct bioc_discipline *);
88 c285a1f8 2020-11-06 stsp int sr_crypto_meta_opt_handler(struct sr_discipline *,
89 c285a1f8 2020-11-06 stsp struct sr_meta_opt_hdr *);
90 c285a1f8 2020-11-06 stsp void sr_crypto_write(struct cryptop *);
91 c285a1f8 2020-11-06 stsp int sr_crypto_rw(struct sr_workunit *);
92 c285a1f8 2020-11-06 stsp int sr_crypto_dev_rw(struct sr_workunit *, struct sr_crypto_wu *);
93 c285a1f8 2020-11-06 stsp void sr_crypto_done(struct sr_workunit *);
94 c285a1f8 2020-11-06 stsp void sr_crypto_read(struct cryptop *);
95 c285a1f8 2020-11-06 stsp void sr_crypto_calculate_check_hmac_sha1(u_int8_t *, int,
96 c285a1f8 2020-11-06 stsp u_int8_t *, int, u_char *);
97 c285a1f8 2020-11-06 stsp void sr_crypto_hotplug(struct sr_discipline *, struct disk *, int);
99 c285a1f8 2020-11-06 stsp #ifdef SR_DEBUG0
100 c285a1f8 2020-11-06 stsp void sr_crypto_dumpkeys(struct sr_discipline *);
103 c285a1f8 2020-11-06 stsp /* Discipline initialisation. */
105 c285a1f8 2020-11-06 stsp sr_crypto_discipline_init(struct sr_discipline *sd)
109 c285a1f8 2020-11-06 stsp /* Fill out discipline members. */
110 c285a1f8 2020-11-06 stsp sd->sd_wu_size = sizeof(struct sr_crypto_wu);
111 c285a1f8 2020-11-06 stsp sd->sd_type = SR_MD_CRYPTO;
112 c285a1f8 2020-11-06 stsp strlcpy(sd->sd_name, "CRYPTO", sizeof(sd->sd_name));
113 c285a1f8 2020-11-06 stsp sd->sd_capabilities = SR_CAP_SYSTEM_DISK | SR_CAP_AUTO_ASSEMBLE;
114 c285a1f8 2020-11-06 stsp sd->sd_max_wu = SR_CRYPTO_NOWU;
116 c285a1f8 2020-11-06 stsp for (i = 0; i < SR_CRYPTO_MAXKEYS; i++)
117 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
119 c285a1f8 2020-11-06 stsp /* Setup discipline specific function pointers. */
120 c285a1f8 2020-11-06 stsp sd->sd_alloc_resources = sr_crypto_alloc_resources;
121 c285a1f8 2020-11-06 stsp sd->sd_assemble = sr_crypto_assemble;
122 c285a1f8 2020-11-06 stsp sd->sd_create = sr_crypto_create;
123 c285a1f8 2020-11-06 stsp sd->sd_free_resources = sr_crypto_free_resources;
124 c285a1f8 2020-11-06 stsp sd->sd_ioctl_handler = sr_crypto_ioctl;
125 c285a1f8 2020-11-06 stsp sd->sd_meta_opt_handler = sr_crypto_meta_opt_handler;
126 c285a1f8 2020-11-06 stsp sd->sd_scsi_rw = sr_crypto_rw;
127 c285a1f8 2020-11-06 stsp sd->sd_scsi_done = sr_crypto_done;
131 c285a1f8 2020-11-06 stsp sr_crypto_create(struct sr_discipline *sd, struct bioc_createraid *bc,
132 c285a1f8 2020-11-06 stsp int no_chunk, int64_t coerced_size)
134 c285a1f8 2020-11-06 stsp struct sr_meta_opt_item *omi;
135 c285a1f8 2020-11-06 stsp int rv = EINVAL;
137 c285a1f8 2020-11-06 stsp if (no_chunk != 1) {
138 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "%s requires exactly one chunk",
139 c285a1f8 2020-11-06 stsp sd->sd_name);
143 c285a1f8 2020-11-06 stsp if (coerced_size > SR_CRYPTO_MAXSIZE) {
144 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "%s exceeds maximum size (%lli > %llu)",
145 c285a1f8 2020-11-06 stsp sd->sd_name, coerced_size, SR_CRYPTO_MAXSIZE);
149 c285a1f8 2020-11-06 stsp /* Create crypto optional metadata. */
150 c285a1f8 2020-11-06 stsp omi = malloc(sizeof(struct sr_meta_opt_item), M_DEVBUF,
151 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
152 c285a1f8 2020-11-06 stsp omi->omi_som = malloc(sizeof(struct sr_meta_crypto), M_DEVBUF,
153 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
154 c285a1f8 2020-11-06 stsp omi->omi_som->som_type = SR_OPT_CRYPTO;
155 c285a1f8 2020-11-06 stsp omi->omi_som->som_length = sizeof(struct sr_meta_crypto);
156 c285a1f8 2020-11-06 stsp SLIST_INSERT_HEAD(&sd->sd_meta_opt, omi, omi_link);
157 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta = (struct sr_meta_crypto *)omi->omi_som;
158 c285a1f8 2020-11-06 stsp sd->sd_meta->ssdi.ssd_opt_no++;
160 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.key_disk = NULL;
162 c285a1f8 2020-11-06 stsp if (bc->bc_key_disk != NODEV) {
164 c285a1f8 2020-11-06 stsp /* Create a key disk. */
165 c285a1f8 2020-11-06 stsp if (sr_crypto_get_kdf(bc, sd))
167 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.key_disk =
168 c285a1f8 2020-11-06 stsp sr_crypto_create_key_disk(sd, bc->bc_key_disk);
169 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.key_disk == NULL)
171 c285a1f8 2020-11-06 stsp sd->sd_capabilities |= SR_CAP_AUTO_ASSEMBLE;
173 c285a1f8 2020-11-06 stsp } else if (bc->bc_opaque_flags & BIOC_SOOUT) {
175 c285a1f8 2020-11-06 stsp /* No hint available yet. */
176 c285a1f8 2020-11-06 stsp bc->bc_opaque_status = BIOC_SOINOUT_FAILED;
177 c285a1f8 2020-11-06 stsp rv = EAGAIN;
180 c285a1f8 2020-11-06 stsp } else if (sr_crypto_get_kdf(bc, sd))
183 c285a1f8 2020-11-06 stsp /* Passphrase volumes cannot be automatically assembled. */
184 c285a1f8 2020-11-06 stsp if (!(bc->bc_flags & BIOC_SCNOAUTOASSEMBLE) && bc->bc_key_disk == NODEV)
187 c285a1f8 2020-11-06 stsp sd->sd_meta->ssdi.ssd_size = coerced_size;
189 c285a1f8 2020-11-06 stsp sr_crypto_create_keys(sd);
191 c285a1f8 2020-11-06 stsp sd->sd_max_ccb_per_wu = no_chunk;
195 c285a1f8 2020-11-06 stsp return (rv);
199 c285a1f8 2020-11-06 stsp sr_crypto_assemble(struct sr_discipline *sd, struct bioc_createraid *bc,
200 c285a1f8 2020-11-06 stsp int no_chunk, void *data)
202 c285a1f8 2020-11-06 stsp int rv = EINVAL;
204 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.key_disk = NULL;
206 c285a1f8 2020-11-06 stsp /* Crypto optional metadata must already exist... */
207 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.scr_meta == NULL)
210 c285a1f8 2020-11-06 stsp if (data != NULL) {
211 c285a1f8 2020-11-06 stsp /* Kernel already has mask key. */
212 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_maskkey, data,
213 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey));
214 c285a1f8 2020-11-06 stsp } else if (bc->bc_key_disk != NODEV) {
215 c285a1f8 2020-11-06 stsp /* Read the mask key from the key disk. */
216 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.key_disk =
217 c285a1f8 2020-11-06 stsp sr_crypto_read_key_disk(sd, bc->bc_key_disk);
218 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.key_disk == NULL)
220 c285a1f8 2020-11-06 stsp } else if (bc->bc_opaque_flags & BIOC_SOOUT) {
221 c285a1f8 2020-11-06 stsp /* provide userland with kdf hint */
222 c285a1f8 2020-11-06 stsp if (bc->bc_opaque == NULL)
225 c285a1f8 2020-11-06 stsp if (sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint) <
226 c285a1f8 2020-11-06 stsp bc->bc_opaque_size)
229 c285a1f8 2020-11-06 stsp if (copyout(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
230 c285a1f8 2020-11-06 stsp bc->bc_opaque, bc->bc_opaque_size))
233 c285a1f8 2020-11-06 stsp /* we're done */
234 c285a1f8 2020-11-06 stsp bc->bc_opaque_status = BIOC_SOINOUT_OK;
235 c285a1f8 2020-11-06 stsp rv = EAGAIN;
237 c285a1f8 2020-11-06 stsp } else if (bc->bc_opaque_flags & BIOC_SOIN) {
238 c285a1f8 2020-11-06 stsp /* get kdf with maskkey from userland */
239 c285a1f8 2020-11-06 stsp if (sr_crypto_get_kdf(bc, sd))
244 c285a1f8 2020-11-06 stsp sd->sd_max_ccb_per_wu = sd->sd_meta->ssdi.ssd_chunk_no;
248 c285a1f8 2020-11-06 stsp return (rv);
251 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *
252 c285a1f8 2020-11-06 stsp sr_crypto_prepare(struct sr_workunit *wu, int encrypt)
254 c285a1f8 2020-11-06 stsp struct scsi_xfer *xs = wu->swu_xs;
255 c285a1f8 2020-11-06 stsp struct sr_discipline *sd = wu->swu_dis;
256 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu;
257 c285a1f8 2020-11-06 stsp struct cryptodesc *crd;
258 c285a1f8 2020-11-06 stsp int flags, i, n;
259 c285a1f8 2020-11-06 stsp daddr_t blkno;
260 c285a1f8 2020-11-06 stsp u_int keyndx;
262 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_prepare wu %p encrypt %d\n",
263 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc), wu, encrypt);
265 c285a1f8 2020-11-06 stsp crwu = (struct sr_crypto_wu *)wu;
266 c285a1f8 2020-11-06 stsp crwu->cr_uio.uio_iovcnt = 1;
267 c285a1f8 2020-11-06 stsp crwu->cr_uio.uio_iov->iov_len = xs->datalen;
268 c285a1f8 2020-11-06 stsp if (xs->flags & SCSI_DATA_OUT) {
269 c285a1f8 2020-11-06 stsp crwu->cr_uio.uio_iov->iov_base = crwu->cr_dmabuf;
270 c285a1f8 2020-11-06 stsp memcpy(crwu->cr_uio.uio_iov->iov_base, xs->data, xs->datalen);
272 c285a1f8 2020-11-06 stsp crwu->cr_uio.uio_iov->iov_base = xs->data;
274 c285a1f8 2020-11-06 stsp blkno = wu->swu_blk_start;
275 c285a1f8 2020-11-06 stsp n = xs->datalen >> DEV_BSHIFT;
278 c285a1f8 2020-11-06 stsp * We preallocated enough crypto descs for up to MAXPHYS of I/O.
279 c285a1f8 2020-11-06 stsp * Since there may be less than that we need to tweak the amount
280 c285a1f8 2020-11-06 stsp * of crypto desc structures to be just long enough for our needs.
282 c285a1f8 2020-11-06 stsp KASSERT(crwu->cr_crp->crp_ndescalloc >= n);
283 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_ndesc = n;
284 c285a1f8 2020-11-06 stsp flags = (encrypt ? CRD_F_ENCRYPT : 0) |
285 c285a1f8 2020-11-06 stsp CRD_F_IV_PRESENT | CRD_F_IV_EXPLICIT;
288 c285a1f8 2020-11-06 stsp * Select crypto session based on block number.
290 c285a1f8 2020-11-06 stsp * XXX - this does not handle the case where the read/write spans
291 c285a1f8 2020-11-06 stsp * across a different key blocks (e.g. 0.5TB boundary). Currently
292 c285a1f8 2020-11-06 stsp * this is already broken by the use of scr_key[0] below.
294 c285a1f8 2020-11-06 stsp keyndx = blkno >> SR_CRYPTO_KEY_BLKSHIFT;
295 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_sid = sd->mds.mdd_crypto.scr_sid[keyndx];
297 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_opaque = crwu;
298 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_ilen = xs->datalen;
299 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_alloctype = M_DEVBUF;
300 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_flags = CRYPTO_F_IOV | CRYPTO_F_NOQUEUE;
301 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_buf = &crwu->cr_uio;
302 c285a1f8 2020-11-06 stsp for (i = 0; i < crwu->cr_crp->crp_ndesc; i++, blkno++) {
303 c285a1f8 2020-11-06 stsp crd = &crwu->cr_crp->crp_desc[i];
304 c285a1f8 2020-11-06 stsp crd->crd_skip = i << DEV_BSHIFT;
305 c285a1f8 2020-11-06 stsp crd->crd_len = DEV_BSIZE;
306 c285a1f8 2020-11-06 stsp crd->crd_inject = 0;
307 c285a1f8 2020-11-06 stsp crd->crd_flags = flags;
308 c285a1f8 2020-11-06 stsp crd->crd_alg = sd->mds.mdd_crypto.scr_alg;
309 c285a1f8 2020-11-06 stsp crd->crd_klen = sd->mds.mdd_crypto.scr_klen;
310 c285a1f8 2020-11-06 stsp crd->crd_key = sd->mds.mdd_crypto.scr_key[0];
311 c285a1f8 2020-11-06 stsp memcpy(crd->crd_iv, &blkno, sizeof(blkno));
314 c285a1f8 2020-11-06 stsp return (crwu);
318 c285a1f8 2020-11-06 stsp sr_crypto_get_kdf(struct bioc_createraid *bc, struct sr_discipline *sd)
320 c285a1f8 2020-11-06 stsp int rv = EINVAL;
321 c285a1f8 2020-11-06 stsp struct sr_crypto_kdfinfo *kdfinfo;
323 c285a1f8 2020-11-06 stsp if (!(bc->bc_opaque_flags & BIOC_SOIN))
324 c285a1f8 2020-11-06 stsp return (rv);
325 c285a1f8 2020-11-06 stsp if (bc->bc_opaque == NULL)
326 c285a1f8 2020-11-06 stsp return (rv);
327 c285a1f8 2020-11-06 stsp if (bc->bc_opaque_size != sizeof(*kdfinfo))
328 c285a1f8 2020-11-06 stsp return (rv);
330 c285a1f8 2020-11-06 stsp kdfinfo = malloc(bc->bc_opaque_size, M_DEVBUF, M_WAITOK | M_ZERO);
331 c285a1f8 2020-11-06 stsp if (copyin(bc->bc_opaque, kdfinfo, bc->bc_opaque_size))
334 c285a1f8 2020-11-06 stsp if (kdfinfo->len != bc->bc_opaque_size)
337 c285a1f8 2020-11-06 stsp /* copy KDF hint to disk meta data */
338 c285a1f8 2020-11-06 stsp if (kdfinfo->flags & SR_CRYPTOKDF_HINT) {
339 c285a1f8 2020-11-06 stsp if (sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint) <
340 c285a1f8 2020-11-06 stsp kdfinfo->genkdf.len)
342 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
343 c285a1f8 2020-11-06 stsp &kdfinfo->genkdf, kdfinfo->genkdf.len);
346 c285a1f8 2020-11-06 stsp /* copy mask key to run-time meta data */
347 c285a1f8 2020-11-06 stsp if ((kdfinfo->flags & SR_CRYPTOKDF_KEY)) {
348 c285a1f8 2020-11-06 stsp if (sizeof(sd->mds.mdd_crypto.scr_maskkey) <
349 c285a1f8 2020-11-06 stsp sizeof(kdfinfo->maskkey))
351 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_maskkey, &kdfinfo->maskkey,
352 c285a1f8 2020-11-06 stsp sizeof(kdfinfo->maskkey));
355 c285a1f8 2020-11-06 stsp bc->bc_opaque_status = BIOC_SOINOUT_OK;
358 c285a1f8 2020-11-06 stsp explicit_bzero(kdfinfo, bc->bc_opaque_size);
359 c285a1f8 2020-11-06 stsp free(kdfinfo, M_DEVBUF, bc->bc_opaque_size);
361 c285a1f8 2020-11-06 stsp return (rv);
365 c285a1f8 2020-11-06 stsp sr_crypto_encrypt(u_char *p, u_char *c, u_char *key, size_t size, int alg)
367 c285a1f8 2020-11-06 stsp rijndael_ctx ctx;
368 c285a1f8 2020-11-06 stsp int i, rv = 1;
370 c285a1f8 2020-11-06 stsp switch (alg) {
371 c285a1f8 2020-11-06 stsp case SR_CRYPTOM_AES_ECB_256:
372 c285a1f8 2020-11-06 stsp if (rijndael_set_key_enc_only(&ctx, key, 256) != 0)
374 c285a1f8 2020-11-06 stsp for (i = 0; i < size; i += RIJNDAEL128_BLOCK_LEN)
375 c285a1f8 2020-11-06 stsp rijndael_encrypt(&ctx, &p[i], &c[i]);
379 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: unsupported encryption algorithm %d\n",
380 c285a1f8 2020-11-06 stsp "softraid", alg);
386 c285a1f8 2020-11-06 stsp explicit_bzero(&ctx, sizeof(ctx));
387 c285a1f8 2020-11-06 stsp return (rv);
391 c285a1f8 2020-11-06 stsp sr_crypto_decrypt(u_char *c, u_char *p, u_char *key, size_t size, int alg)
393 c285a1f8 2020-11-06 stsp rijndael_ctx ctx;
394 c285a1f8 2020-11-06 stsp int i, rv = 1;
396 c285a1f8 2020-11-06 stsp switch (alg) {
397 c285a1f8 2020-11-06 stsp case SR_CRYPTOM_AES_ECB_256:
398 c285a1f8 2020-11-06 stsp if (rijndael_set_key(&ctx, key, 256) != 0)
400 c285a1f8 2020-11-06 stsp for (i = 0; i < size; i += RIJNDAEL128_BLOCK_LEN)
401 c285a1f8 2020-11-06 stsp rijndael_decrypt(&ctx, &c[i], &p[i]);
405 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: unsupported encryption algorithm %d\n",
406 c285a1f8 2020-11-06 stsp "softraid", alg);
412 c285a1f8 2020-11-06 stsp explicit_bzero(&ctx, sizeof(ctx));
413 c285a1f8 2020-11-06 stsp return (rv);
417 c285a1f8 2020-11-06 stsp sr_crypto_calculate_check_hmac_sha1(u_int8_t *maskkey, int maskkey_size,
418 c285a1f8 2020-11-06 stsp u_int8_t *key, int key_size, u_char *check_digest)
420 c285a1f8 2020-11-06 stsp u_char check_key[SHA1_DIGEST_LENGTH];
421 c285a1f8 2020-11-06 stsp HMAC_SHA1_CTX hmacctx;
422 c285a1f8 2020-11-06 stsp SHA1_CTX shactx;
424 c285a1f8 2020-11-06 stsp bzero(check_key, sizeof(check_key));
425 c285a1f8 2020-11-06 stsp bzero(&hmacctx, sizeof(hmacctx));
426 c285a1f8 2020-11-06 stsp bzero(&shactx, sizeof(shactx));
428 c285a1f8 2020-11-06 stsp /* k = SHA1(mask_key) */
429 c285a1f8 2020-11-06 stsp SHA1Init(&shactx);
430 c285a1f8 2020-11-06 stsp SHA1Update(&shactx, maskkey, maskkey_size);
431 c285a1f8 2020-11-06 stsp SHA1Final(check_key, &shactx);
433 c285a1f8 2020-11-06 stsp /* mac = HMAC_SHA1_k(unencrypted key) */
434 c285a1f8 2020-11-06 stsp HMAC_SHA1_Init(&hmacctx, check_key, sizeof(check_key));
435 c285a1f8 2020-11-06 stsp HMAC_SHA1_Update(&hmacctx, key, key_size);
436 c285a1f8 2020-11-06 stsp HMAC_SHA1_Final(check_digest, &hmacctx);
438 c285a1f8 2020-11-06 stsp explicit_bzero(check_key, sizeof(check_key));
439 c285a1f8 2020-11-06 stsp explicit_bzero(&hmacctx, sizeof(hmacctx));
440 c285a1f8 2020-11-06 stsp explicit_bzero(&shactx, sizeof(shactx));
444 c285a1f8 2020-11-06 stsp sr_crypto_decrypt_key(struct sr_discipline *sd)
446 c285a1f8 2020-11-06 stsp u_char check_digest[SHA1_DIGEST_LENGTH];
447 c285a1f8 2020-11-06 stsp int rv = 1;
449 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_decrypt_key\n", DEVNAME(sd->sd_sc));
451 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.scr_meta->scm_check_alg != SR_CRYPTOC_HMAC_SHA1)
454 c285a1f8 2020-11-06 stsp if (sr_crypto_decrypt((u_char *)sd->mds.mdd_crypto.scr_meta->scm_key,
455 c285a1f8 2020-11-06 stsp (u_char *)sd->mds.mdd_crypto.scr_key,
456 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_maskkey, sizeof(sd->mds.mdd_crypto.scr_key),
457 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
460 c285a1f8 2020-11-06 stsp #ifdef SR_DEBUG0
461 c285a1f8 2020-11-06 stsp sr_crypto_dumpkeys(sd);
464 c285a1f8 2020-11-06 stsp /* Check that the key decrypted properly. */
465 c285a1f8 2020-11-06 stsp sr_crypto_calculate_check_hmac_sha1(sd->mds.mdd_crypto.scr_maskkey,
466 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey),
467 c285a1f8 2020-11-06 stsp (u_int8_t *)sd->mds.mdd_crypto.scr_key,
468 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key),
469 c285a1f8 2020-11-06 stsp check_digest);
470 c285a1f8 2020-11-06 stsp if (memcmp(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac,
471 c285a1f8 2020-11-06 stsp check_digest, sizeof(check_digest)) != 0) {
472 c285a1f8 2020-11-06 stsp explicit_bzero(sd->mds.mdd_crypto.scr_key,
473 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key));
477 c285a1f8 2020-11-06 stsp rv = 0; /* Success */
479 c285a1f8 2020-11-06 stsp /* we don't need the mask key anymore */
480 c285a1f8 2020-11-06 stsp explicit_bzero(&sd->mds.mdd_crypto.scr_maskkey,
481 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey));
483 c285a1f8 2020-11-06 stsp explicit_bzero(check_digest, sizeof(check_digest));
489 c285a1f8 2020-11-06 stsp sr_crypto_create_keys(struct sr_discipline *sd)
492 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_create_keys\n",
493 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc));
495 c285a1f8 2020-11-06 stsp if (AES_MAXKEYBYTES < sizeof(sd->mds.mdd_crypto.scr_maskkey))
496 c285a1f8 2020-11-06 stsp return (1);
498 c285a1f8 2020-11-06 stsp /* XXX allow user to specify */
499 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_alg = SR_CRYPTOA_AES_XTS_256;
501 c285a1f8 2020-11-06 stsp /* generate crypto keys */
502 c285a1f8 2020-11-06 stsp arc4random_buf(sd->mds.mdd_crypto.scr_key,
503 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key));
505 c285a1f8 2020-11-06 stsp /* Mask the disk keys. */
506 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_mask_alg = SR_CRYPTOM_AES_ECB_256;
507 c285a1f8 2020-11-06 stsp sr_crypto_encrypt((u_char *)sd->mds.mdd_crypto.scr_key,
508 c285a1f8 2020-11-06 stsp (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key,
509 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_maskkey, sizeof(sd->mds.mdd_crypto.scr_key),
510 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_mask_alg);
512 c285a1f8 2020-11-06 stsp /* Prepare key decryption check code. */
513 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_check_alg = SR_CRYPTOC_HMAC_SHA1;
514 c285a1f8 2020-11-06 stsp sr_crypto_calculate_check_hmac_sha1(sd->mds.mdd_crypto.scr_maskkey,
515 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey),
516 c285a1f8 2020-11-06 stsp (u_int8_t *)sd->mds.mdd_crypto.scr_key,
517 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key),
518 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac);
520 c285a1f8 2020-11-06 stsp /* Erase the plaintext disk keys */
521 c285a1f8 2020-11-06 stsp explicit_bzero(sd->mds.mdd_crypto.scr_key,
522 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key));
524 c285a1f8 2020-11-06 stsp #ifdef SR_DEBUG0
525 c285a1f8 2020-11-06 stsp sr_crypto_dumpkeys(sd);
528 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_flags = SR_CRYPTOF_KEY |
529 c285a1f8 2020-11-06 stsp SR_CRYPTOF_KDFHINT;
531 c285a1f8 2020-11-06 stsp return (0);
535 c285a1f8 2020-11-06 stsp sr_crypto_change_maskkey(struct sr_discipline *sd,
536 c285a1f8 2020-11-06 stsp struct sr_crypto_kdfinfo *kdfinfo1, struct sr_crypto_kdfinfo *kdfinfo2)
538 c285a1f8 2020-11-06 stsp u_char check_digest[SHA1_DIGEST_LENGTH];
539 c285a1f8 2020-11-06 stsp u_char *c, *p = NULL;
540 c285a1f8 2020-11-06 stsp size_t ksz;
541 c285a1f8 2020-11-06 stsp int rv = 1;
543 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_change_maskkey\n",
544 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc));
546 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.scr_meta->scm_check_alg != SR_CRYPTOC_HMAC_SHA1)
549 c285a1f8 2020-11-06 stsp c = (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key;
550 c285a1f8 2020-11-06 stsp ksz = sizeof(sd->mds.mdd_crypto.scr_key);
551 c285a1f8 2020-11-06 stsp p = malloc(ksz, M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
552 c285a1f8 2020-11-06 stsp if (p == NULL)
555 c285a1f8 2020-11-06 stsp if (sr_crypto_decrypt(c, p, kdfinfo1->maskkey, ksz,
556 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
559 c285a1f8 2020-11-06 stsp #ifdef SR_DEBUG0
560 c285a1f8 2020-11-06 stsp sr_crypto_dumpkeys(sd);
563 c285a1f8 2020-11-06 stsp sr_crypto_calculate_check_hmac_sha1(kdfinfo1->maskkey,
564 c285a1f8 2020-11-06 stsp sizeof(kdfinfo1->maskkey), p, ksz, check_digest);
565 c285a1f8 2020-11-06 stsp if (memcmp(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac,
566 c285a1f8 2020-11-06 stsp check_digest, sizeof(check_digest)) != 0) {
567 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "incorrect key or passphrase");
568 c285a1f8 2020-11-06 stsp rv = EPERM;
572 c285a1f8 2020-11-06 stsp /* Copy new KDF hint to metadata, if supplied. */
573 c285a1f8 2020-11-06 stsp if (kdfinfo2->flags & SR_CRYPTOKDF_HINT) {
574 c285a1f8 2020-11-06 stsp if (kdfinfo2->genkdf.len >
575 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint))
577 c285a1f8 2020-11-06 stsp explicit_bzero(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
578 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint));
579 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
580 c285a1f8 2020-11-06 stsp &kdfinfo2->genkdf, kdfinfo2->genkdf.len);
583 c285a1f8 2020-11-06 stsp /* Mask the disk keys. */
584 c285a1f8 2020-11-06 stsp c = (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key;
585 c285a1f8 2020-11-06 stsp if (sr_crypto_encrypt(p, c, kdfinfo2->maskkey, ksz,
586 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
589 c285a1f8 2020-11-06 stsp /* Prepare key decryption check code. */
590 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_check_alg = SR_CRYPTOC_HMAC_SHA1;
591 c285a1f8 2020-11-06 stsp sr_crypto_calculate_check_hmac_sha1(kdfinfo2->maskkey,
592 c285a1f8 2020-11-06 stsp sizeof(kdfinfo2->maskkey), (u_int8_t *)sd->mds.mdd_crypto.scr_key,
593 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_key), check_digest);
595 c285a1f8 2020-11-06 stsp /* Copy new encrypted key and HMAC to metadata. */
596 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac, check_digest,
597 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac));
599 c285a1f8 2020-11-06 stsp rv = 0; /* Success */
603 c285a1f8 2020-11-06 stsp explicit_bzero(p, ksz);
604 c285a1f8 2020-11-06 stsp free(p, M_DEVBUF, ksz);
607 c285a1f8 2020-11-06 stsp explicit_bzero(check_digest, sizeof(check_digest));
608 c285a1f8 2020-11-06 stsp explicit_bzero(&kdfinfo1->maskkey, sizeof(kdfinfo1->maskkey));
609 c285a1f8 2020-11-06 stsp explicit_bzero(&kdfinfo2->maskkey, sizeof(kdfinfo2->maskkey));
611 c285a1f8 2020-11-06 stsp return (rv);
614 c285a1f8 2020-11-06 stsp struct sr_chunk *
615 c285a1f8 2020-11-06 stsp sr_crypto_create_key_disk(struct sr_discipline *sd, dev_t dev)
617 c285a1f8 2020-11-06 stsp struct sr_softc *sc = sd->sd_sc;
618 c285a1f8 2020-11-06 stsp struct sr_discipline *fakesd = NULL;
619 c285a1f8 2020-11-06 stsp struct sr_metadata *sm = NULL;
620 c285a1f8 2020-11-06 stsp struct sr_meta_chunk *km;
621 c285a1f8 2020-11-06 stsp struct sr_meta_opt_item *omi = NULL;
622 c285a1f8 2020-11-06 stsp struct sr_meta_keydisk *skm;
623 c285a1f8 2020-11-06 stsp struct sr_chunk *key_disk = NULL;
624 c285a1f8 2020-11-06 stsp struct disklabel label;
625 c285a1f8 2020-11-06 stsp struct vnode *vn;
626 c285a1f8 2020-11-06 stsp char devname[32];
627 c285a1f8 2020-11-06 stsp int c, part, open = 0;
630 c285a1f8 2020-11-06 stsp * Create a metadata structure on the key disk and store
631 c285a1f8 2020-11-06 stsp * keying material in the optional metadata.
634 c285a1f8 2020-11-06 stsp sr_meta_getdevname(sc, dev, devname, sizeof(devname));
636 c285a1f8 2020-11-06 stsp /* Make sure chunk is not already in use. */
637 c285a1f8 2020-11-06 stsp c = sr_chunk_in_use(sc, dev);
638 c285a1f8 2020-11-06 stsp if (c != BIOC_SDINVALID && c != BIOC_SDOFFLINE) {
639 c285a1f8 2020-11-06 stsp sr_error(sc, "%s is already in use", devname);
643 c285a1f8 2020-11-06 stsp /* Open device. */
644 c285a1f8 2020-11-06 stsp if (bdevvp(dev, &vn)) {
645 c285a1f8 2020-11-06 stsp sr_error(sc, "cannot open key disk %s", devname);
648 c285a1f8 2020-11-06 stsp if (VOP_OPEN(vn, FREAD | FWRITE, NOCRED, curproc)) {
649 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_META,"%s: sr_crypto_create_key_disk cannot "
650 c285a1f8 2020-11-06 stsp "open %s\n", DEVNAME(sc), devname);
654 c285a1f8 2020-11-06 stsp open = 1; /* close dev on error */
656 c285a1f8 2020-11-06 stsp /* Get partition details. */
657 c285a1f8 2020-11-06 stsp part = DISKPART(dev);
658 c285a1f8 2020-11-06 stsp if (VOP_IOCTL(vn, DIOCGDINFO, (caddr_t)&label,
659 c285a1f8 2020-11-06 stsp FREAD, NOCRED, curproc)) {
660 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_META, "%s: sr_crypto_create_key_disk ioctl "
661 c285a1f8 2020-11-06 stsp "failed\n", DEVNAME(sc));
664 c285a1f8 2020-11-06 stsp if (label.d_partitions[part].p_fstype != FS_RAID) {
665 c285a1f8 2020-11-06 stsp sr_error(sc, "%s partition not of type RAID (%d)",
666 c285a1f8 2020-11-06 stsp devname, label.d_partitions[part].p_fstype);
671 c285a1f8 2020-11-06 stsp * Create and populate chunk metadata.
674 c285a1f8 2020-11-06 stsp key_disk = malloc(sizeof(struct sr_chunk), M_DEVBUF, M_WAITOK | M_ZERO);
675 c285a1f8 2020-11-06 stsp km = &key_disk->src_meta;
677 c285a1f8 2020-11-06 stsp key_disk->src_dev_mm = dev;
678 c285a1f8 2020-11-06 stsp key_disk->src_vn = vn;
679 c285a1f8 2020-11-06 stsp strlcpy(key_disk->src_devname, devname, sizeof(km->scmi.scm_devname));
680 c285a1f8 2020-11-06 stsp key_disk->src_size = 0;
682 c285a1f8 2020-11-06 stsp km->scmi.scm_volid = sd->sd_meta->ssdi.ssd_level;
683 c285a1f8 2020-11-06 stsp km->scmi.scm_chunk_id = 0;
684 c285a1f8 2020-11-06 stsp km->scmi.scm_size = 0;
685 c285a1f8 2020-11-06 stsp km->scmi.scm_coerced_size = 0;
686 c285a1f8 2020-11-06 stsp strlcpy(km->scmi.scm_devname, devname, sizeof(km->scmi.scm_devname));
687 c285a1f8 2020-11-06 stsp memcpy(&km->scmi.scm_uuid, &sd->sd_meta->ssdi.ssd_uuid,
688 c285a1f8 2020-11-06 stsp sizeof(struct sr_uuid));
690 c285a1f8 2020-11-06 stsp sr_checksum(sc, km, &km->scm_checksum,
691 c285a1f8 2020-11-06 stsp sizeof(struct sr_meta_chunk_invariant));
693 c285a1f8 2020-11-06 stsp km->scm_status = BIOC_SDONLINE;
696 c285a1f8 2020-11-06 stsp * Create and populate our own discipline and metadata.
699 c285a1f8 2020-11-06 stsp sm = malloc(sizeof(struct sr_metadata), M_DEVBUF, M_WAITOK | M_ZERO);
700 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_magic = SR_MAGIC;
701 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_version = SR_META_VERSION;
702 c285a1f8 2020-11-06 stsp sm->ssd_ondisk = 0;
703 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_vol_flags = 0;
704 c285a1f8 2020-11-06 stsp memcpy(&sm->ssdi.ssd_uuid, &sd->sd_meta->ssdi.ssd_uuid,
705 c285a1f8 2020-11-06 stsp sizeof(struct sr_uuid));
706 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_chunk_no = 1;
707 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_volid = SR_KEYDISK_VOLID;
708 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_level = SR_KEYDISK_LEVEL;
709 c285a1f8 2020-11-06 stsp sm->ssdi.ssd_size = 0;
710 c285a1f8 2020-11-06 stsp strlcpy(sm->ssdi.ssd_vendor, "OPENBSD", sizeof(sm->ssdi.ssd_vendor));
711 c285a1f8 2020-11-06 stsp snprintf(sm->ssdi.ssd_product, sizeof(sm->ssdi.ssd_product),
712 c285a1f8 2020-11-06 stsp "SR %s", "KEYDISK");
713 c285a1f8 2020-11-06 stsp snprintf(sm->ssdi.ssd_revision, sizeof(sm->ssdi.ssd_revision),
714 c285a1f8 2020-11-06 stsp "%03d", SR_META_VERSION);
716 c285a1f8 2020-11-06 stsp fakesd = malloc(sizeof(struct sr_discipline), M_DEVBUF,
717 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
718 c285a1f8 2020-11-06 stsp fakesd->sd_sc = sd->sd_sc;
719 c285a1f8 2020-11-06 stsp fakesd->sd_meta = sm;
720 c285a1f8 2020-11-06 stsp fakesd->sd_meta_type = SR_META_F_NATIVE;
721 c285a1f8 2020-11-06 stsp fakesd->sd_vol_status = BIOC_SVONLINE;
722 c285a1f8 2020-11-06 stsp strlcpy(fakesd->sd_name, "KEYDISK", sizeof(fakesd->sd_name));
723 c285a1f8 2020-11-06 stsp SLIST_INIT(&fakesd->sd_meta_opt);
725 c285a1f8 2020-11-06 stsp /* Add chunk to volume. */
726 c285a1f8 2020-11-06 stsp fakesd->sd_vol.sv_chunks = malloc(sizeof(struct sr_chunk *), M_DEVBUF,
727 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
728 c285a1f8 2020-11-06 stsp fakesd->sd_vol.sv_chunks[0] = key_disk;
729 c285a1f8 2020-11-06 stsp SLIST_INIT(&fakesd->sd_vol.sv_chunk_list);
730 c285a1f8 2020-11-06 stsp SLIST_INSERT_HEAD(&fakesd->sd_vol.sv_chunk_list, key_disk, src_link);
732 c285a1f8 2020-11-06 stsp /* Generate mask key. */
733 c285a1f8 2020-11-06 stsp arc4random_buf(sd->mds.mdd_crypto.scr_maskkey,
734 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey));
736 c285a1f8 2020-11-06 stsp /* Copy mask key to optional metadata area. */
737 c285a1f8 2020-11-06 stsp omi = malloc(sizeof(struct sr_meta_opt_item), M_DEVBUF,
738 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
739 c285a1f8 2020-11-06 stsp omi->omi_som = malloc(sizeof(struct sr_meta_keydisk), M_DEVBUF,
740 c285a1f8 2020-11-06 stsp M_WAITOK | M_ZERO);
741 c285a1f8 2020-11-06 stsp omi->omi_som->som_type = SR_OPT_KEYDISK;
742 c285a1f8 2020-11-06 stsp omi->omi_som->som_length = sizeof(struct sr_meta_keydisk);
743 c285a1f8 2020-11-06 stsp skm = (struct sr_meta_keydisk *)omi->omi_som;
744 c285a1f8 2020-11-06 stsp memcpy(&skm->skm_maskkey, sd->mds.mdd_crypto.scr_maskkey,
745 c285a1f8 2020-11-06 stsp sizeof(skm->skm_maskkey));
746 c285a1f8 2020-11-06 stsp SLIST_INSERT_HEAD(&fakesd->sd_meta_opt, omi, omi_link);
747 c285a1f8 2020-11-06 stsp fakesd->sd_meta->ssdi.ssd_opt_no++;
749 c285a1f8 2020-11-06 stsp /* Save metadata. */
750 c285a1f8 2020-11-06 stsp if (sr_meta_save(fakesd, SR_META_DIRTY)) {
751 c285a1f8 2020-11-06 stsp sr_error(sc, "could not save metadata to %s", devname);
758 c285a1f8 2020-11-06 stsp free(key_disk, M_DEVBUF, sizeof(struct sr_chunk));
759 c285a1f8 2020-11-06 stsp key_disk = NULL;
762 c285a1f8 2020-11-06 stsp free(omi, M_DEVBUF, sizeof(struct sr_meta_opt_item));
763 c285a1f8 2020-11-06 stsp if (fakesd && fakesd->sd_vol.sv_chunks)
764 c285a1f8 2020-11-06 stsp free(fakesd->sd_vol.sv_chunks, M_DEVBUF,
765 c285a1f8 2020-11-06 stsp sizeof(struct sr_chunk *));
766 c285a1f8 2020-11-06 stsp free(fakesd, M_DEVBUF, sizeof(struct sr_discipline));
767 c285a1f8 2020-11-06 stsp free(sm, M_DEVBUF, sizeof(struct sr_metadata));
768 c285a1f8 2020-11-06 stsp if (open) {
769 c285a1f8 2020-11-06 stsp VOP_CLOSE(vn, FREAD | FWRITE, NOCRED, curproc);
773 c285a1f8 2020-11-06 stsp return key_disk;
776 c285a1f8 2020-11-06 stsp struct sr_chunk *
777 c285a1f8 2020-11-06 stsp sr_crypto_read_key_disk(struct sr_discipline *sd, dev_t dev)
779 c285a1f8 2020-11-06 stsp struct sr_softc *sc = sd->sd_sc;
780 c285a1f8 2020-11-06 stsp struct sr_metadata *sm = NULL;
781 c285a1f8 2020-11-06 stsp struct sr_meta_opt_item *omi, *omi_next;
782 c285a1f8 2020-11-06 stsp struct sr_meta_opt_hdr *omh;
783 c285a1f8 2020-11-06 stsp struct sr_meta_keydisk *skm;
784 c285a1f8 2020-11-06 stsp struct sr_meta_opt_head som;
785 c285a1f8 2020-11-06 stsp struct sr_chunk *key_disk = NULL;
786 c285a1f8 2020-11-06 stsp struct disklabel label;
787 c285a1f8 2020-11-06 stsp struct vnode *vn = NULL;
788 c285a1f8 2020-11-06 stsp char devname[32];
789 c285a1f8 2020-11-06 stsp int c, part, open = 0;
792 c285a1f8 2020-11-06 stsp * Load a key disk and load keying material into memory.
795 c285a1f8 2020-11-06 stsp SLIST_INIT(&som);
797 c285a1f8 2020-11-06 stsp sr_meta_getdevname(sc, dev, devname, sizeof(devname));
799 c285a1f8 2020-11-06 stsp /* Make sure chunk is not already in use. */
800 c285a1f8 2020-11-06 stsp c = sr_chunk_in_use(sc, dev);
801 c285a1f8 2020-11-06 stsp if (c != BIOC_SDINVALID && c != BIOC_SDOFFLINE) {
802 c285a1f8 2020-11-06 stsp sr_error(sc, "%s is already in use", devname);
806 c285a1f8 2020-11-06 stsp /* Open device. */
807 c285a1f8 2020-11-06 stsp if (bdevvp(dev, &vn)) {
808 c285a1f8 2020-11-06 stsp sr_error(sc, "cannot open key disk %s", devname);
811 c285a1f8 2020-11-06 stsp if (VOP_OPEN(vn, FREAD, NOCRED, curproc)) {
812 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_META,"%s: sr_crypto_read_key_disk cannot "
813 c285a1f8 2020-11-06 stsp "open %s\n", DEVNAME(sc), devname);
817 c285a1f8 2020-11-06 stsp open = 1; /* close dev on error */
819 c285a1f8 2020-11-06 stsp /* Get partition details. */
820 c285a1f8 2020-11-06 stsp part = DISKPART(dev);
821 c285a1f8 2020-11-06 stsp if (VOP_IOCTL(vn, DIOCGDINFO, (caddr_t)&label, FREAD,
822 c285a1f8 2020-11-06 stsp NOCRED, curproc)) {
823 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_META, "%s: sr_crypto_read_key_disk ioctl "
824 c285a1f8 2020-11-06 stsp "failed\n", DEVNAME(sc));
827 c285a1f8 2020-11-06 stsp if (label.d_partitions[part].p_fstype != FS_RAID) {
828 c285a1f8 2020-11-06 stsp sr_error(sc, "%s partition not of type RAID (%d)",
829 c285a1f8 2020-11-06 stsp devname, label.d_partitions[part].p_fstype);
834 c285a1f8 2020-11-06 stsp * Read and validate key disk metadata.
836 c285a1f8 2020-11-06 stsp sm = malloc(SR_META_SIZE * DEV_BSIZE, M_DEVBUF, M_WAITOK | M_ZERO);
837 c285a1f8 2020-11-06 stsp if (sr_meta_native_read(sd, dev, sm, NULL)) {
838 c285a1f8 2020-11-06 stsp sr_error(sc, "native bootprobe could not read native metadata");
842 c285a1f8 2020-11-06 stsp if (sr_meta_validate(sd, dev, sm, NULL)) {
843 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_META, "%s: invalid metadata\n",
844 c285a1f8 2020-11-06 stsp DEVNAME(sc));
848 c285a1f8 2020-11-06 stsp /* Make sure this is a key disk. */
849 c285a1f8 2020-11-06 stsp if (sm->ssdi.ssd_level != SR_KEYDISK_LEVEL) {
850 c285a1f8 2020-11-06 stsp sr_error(sc, "%s is not a key disk", devname);
854 c285a1f8 2020-11-06 stsp /* Construct key disk chunk. */
855 c285a1f8 2020-11-06 stsp key_disk = malloc(sizeof(struct sr_chunk), M_DEVBUF, M_WAITOK | M_ZERO);
856 c285a1f8 2020-11-06 stsp key_disk->src_dev_mm = dev;
857 c285a1f8 2020-11-06 stsp key_disk->src_vn = vn;
858 c285a1f8 2020-11-06 stsp key_disk->src_size = 0;
860 c285a1f8 2020-11-06 stsp memcpy(&key_disk->src_meta, (struct sr_meta_chunk *)(sm + 1),
861 c285a1f8 2020-11-06 stsp sizeof(key_disk->src_meta));
863 c285a1f8 2020-11-06 stsp /* Read mask key from optional metadata. */
864 c285a1f8 2020-11-06 stsp sr_meta_opt_load(sc, sm, &som);
865 c285a1f8 2020-11-06 stsp SLIST_FOREACH(omi, &som, omi_link) {
866 c285a1f8 2020-11-06 stsp omh = omi->omi_som;
867 c285a1f8 2020-11-06 stsp if (omh->som_type == SR_OPT_KEYDISK) {
868 c285a1f8 2020-11-06 stsp skm = (struct sr_meta_keydisk *)omh;
869 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_maskkey, &skm->skm_maskkey,
870 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey));
871 c285a1f8 2020-11-06 stsp } else if (omh->som_type == SR_OPT_CRYPTO) {
872 c285a1f8 2020-11-06 stsp /* Original keydisk format with key in crypto area. */
873 c285a1f8 2020-11-06 stsp memcpy(sd->mds.mdd_crypto.scr_maskkey,
874 c285a1f8 2020-11-06 stsp omh + sizeof(struct sr_meta_opt_hdr),
875 c285a1f8 2020-11-06 stsp sizeof(sd->mds.mdd_crypto.scr_maskkey));
882 c285a1f8 2020-11-06 stsp for (omi = SLIST_FIRST(&som); omi != NULL; omi = omi_next) {
883 c285a1f8 2020-11-06 stsp omi_next = SLIST_NEXT(omi, omi_link);
884 c285a1f8 2020-11-06 stsp free(omi->omi_som, M_DEVBUF, 0);
885 c285a1f8 2020-11-06 stsp free(omi, M_DEVBUF, sizeof(struct sr_meta_opt_item));
888 c285a1f8 2020-11-06 stsp free(sm, M_DEVBUF, SR_META_SIZE * DEV_BSIZE);
890 c285a1f8 2020-11-06 stsp if (vn && open) {
891 c285a1f8 2020-11-06 stsp VOP_CLOSE(vn, FREAD, NOCRED, curproc);
895 c285a1f8 2020-11-06 stsp return key_disk;
898 c285a1f8 2020-11-06 stsp static void
899 c285a1f8 2020-11-06 stsp sr_crypto_free_sessions(struct sr_discipline *sd)
903 c285a1f8 2020-11-06 stsp for (i = 0; i < SR_CRYPTO_MAXKEYS; i++) {
904 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.scr_sid[i] != (u_int64_t)-1) {
905 c285a1f8 2020-11-06 stsp crypto_freesession(sd->mds.mdd_crypto.scr_sid[i]);
906 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
912 c285a1f8 2020-11-06 stsp sr_crypto_alloc_resources(struct sr_discipline *sd)
914 c285a1f8 2020-11-06 stsp struct sr_workunit *wu;
915 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu;
916 c285a1f8 2020-11-06 stsp struct cryptoini cri;
917 c285a1f8 2020-11-06 stsp u_int num_keys, i;
919 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_alloc_resources\n",
920 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc));
922 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_alg = CRYPTO_AES_XTS;
923 c285a1f8 2020-11-06 stsp switch (sd->mds.mdd_crypto.scr_meta->scm_alg) {
924 c285a1f8 2020-11-06 stsp case SR_CRYPTOA_AES_XTS_128:
925 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_klen = 256;
927 c285a1f8 2020-11-06 stsp case SR_CRYPTOA_AES_XTS_256:
928 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_klen = 512;
931 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "unknown crypto algorithm");
932 c285a1f8 2020-11-06 stsp return (EINVAL);
935 c285a1f8 2020-11-06 stsp for (i = 0; i < SR_CRYPTO_MAXKEYS; i++)
936 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
938 c285a1f8 2020-11-06 stsp if (sr_wu_alloc(sd)) {
939 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "unable to allocate work units");
940 c285a1f8 2020-11-06 stsp return (ENOMEM);
942 c285a1f8 2020-11-06 stsp if (sr_ccb_alloc(sd)) {
943 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "unable to allocate CCBs");
944 c285a1f8 2020-11-06 stsp return (ENOMEM);
946 c285a1f8 2020-11-06 stsp if (sr_crypto_decrypt_key(sd)) {
947 c285a1f8 2020-11-06 stsp sr_error(sd->sd_sc, "incorrect key or passphrase");
948 c285a1f8 2020-11-06 stsp return (EPERM);
952 c285a1f8 2020-11-06 stsp * For each work unit allocate the uio, iovec and crypto structures.
953 c285a1f8 2020-11-06 stsp * These have to be allocated now because during runtime we cannot
954 c285a1f8 2020-11-06 stsp * fail an allocation without failing the I/O (which can cause real
955 c285a1f8 2020-11-06 stsp * problems).
957 c285a1f8 2020-11-06 stsp TAILQ_FOREACH(wu, &sd->sd_wu, swu_next) {
958 c285a1f8 2020-11-06 stsp crwu = (struct sr_crypto_wu *)wu;
959 c285a1f8 2020-11-06 stsp crwu->cr_uio.uio_iov = &crwu->cr_iov;
960 c285a1f8 2020-11-06 stsp crwu->cr_dmabuf = dma_alloc(MAXPHYS, PR_WAITOK);
961 c285a1f8 2020-11-06 stsp crwu->cr_crp = crypto_getreq(MAXPHYS >> DEV_BSHIFT);
962 c285a1f8 2020-11-06 stsp if (crwu->cr_crp == NULL)
963 c285a1f8 2020-11-06 stsp return (ENOMEM);
966 c285a1f8 2020-11-06 stsp memset(&cri, 0, sizeof(cri));
967 c285a1f8 2020-11-06 stsp cri.cri_alg = sd->mds.mdd_crypto.scr_alg;
968 c285a1f8 2020-11-06 stsp cri.cri_klen = sd->mds.mdd_crypto.scr_klen;
970 c285a1f8 2020-11-06 stsp /* Allocate a session for every 2^SR_CRYPTO_KEY_BLKSHIFT blocks. */
971 c285a1f8 2020-11-06 stsp num_keys = ((sd->sd_meta->ssdi.ssd_size - 1) >>
972 c285a1f8 2020-11-06 stsp SR_CRYPTO_KEY_BLKSHIFT) + 1;
973 c285a1f8 2020-11-06 stsp if (num_keys > SR_CRYPTO_MAXKEYS)
974 c285a1f8 2020-11-06 stsp return (EFBIG);
975 c285a1f8 2020-11-06 stsp for (i = 0; i < num_keys; i++) {
976 c285a1f8 2020-11-06 stsp cri.cri_key = sd->mds.mdd_crypto.scr_key[i];
977 c285a1f8 2020-11-06 stsp if (crypto_newsession(&sd->mds.mdd_crypto.scr_sid[i],
978 c285a1f8 2020-11-06 stsp &cri, 0) != 0) {
979 c285a1f8 2020-11-06 stsp sr_crypto_free_sessions(sd);
980 c285a1f8 2020-11-06 stsp return (EINVAL);
984 c285a1f8 2020-11-06 stsp sr_hotplug_register(sd, sr_crypto_hotplug);
986 c285a1f8 2020-11-06 stsp return (0);
990 c285a1f8 2020-11-06 stsp sr_crypto_free_resources(struct sr_discipline *sd)
992 c285a1f8 2020-11-06 stsp struct sr_workunit *wu;
993 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu;
995 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_free_resources\n",
996 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc));
998 c285a1f8 2020-11-06 stsp if (sd->mds.mdd_crypto.key_disk != NULL) {
999 c285a1f8 2020-11-06 stsp explicit_bzero(sd->mds.mdd_crypto.key_disk,
1000 c285a1f8 2020-11-06 stsp sizeof(*sd->mds.mdd_crypto.key_disk));
1001 c285a1f8 2020-11-06 stsp free(sd->mds.mdd_crypto.key_disk, M_DEVBUF,
1002 c285a1f8 2020-11-06 stsp sizeof(*sd->mds.mdd_crypto.key_disk));
1005 c285a1f8 2020-11-06 stsp sr_hotplug_unregister(sd, sr_crypto_hotplug);
1007 c285a1f8 2020-11-06 stsp sr_crypto_free_sessions(sd);
1009 c285a1f8 2020-11-06 stsp TAILQ_FOREACH(wu, &sd->sd_wu, swu_next) {
1010 c285a1f8 2020-11-06 stsp crwu = (struct sr_crypto_wu *)wu;
1011 c285a1f8 2020-11-06 stsp if (crwu->cr_dmabuf)
1012 c285a1f8 2020-11-06 stsp dma_free(crwu->cr_dmabuf, MAXPHYS);
1013 c285a1f8 2020-11-06 stsp if (crwu->cr_crp)
1014 c285a1f8 2020-11-06 stsp crypto_freereq(crwu->cr_crp);
1017 c285a1f8 2020-11-06 stsp sr_wu_free(sd);
1018 c285a1f8 2020-11-06 stsp sr_ccb_free(sd);
1022 c285a1f8 2020-11-06 stsp sr_crypto_ioctl(struct sr_discipline *sd, struct bioc_discipline *bd)
1024 c285a1f8 2020-11-06 stsp struct sr_crypto_kdfpair kdfpair;
1025 c285a1f8 2020-11-06 stsp struct sr_crypto_kdfinfo kdfinfo1, kdfinfo2;
1026 c285a1f8 2020-11-06 stsp int size, rv = 1;
1028 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_IOCTL, "%s: sr_crypto_ioctl %u\n",
1029 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc), bd->bd_cmd);
1031 c285a1f8 2020-11-06 stsp switch (bd->bd_cmd) {
1032 c285a1f8 2020-11-06 stsp case SR_IOCTL_GET_KDFHINT:
1034 c285a1f8 2020-11-06 stsp /* Get KDF hint for userland. */
1035 c285a1f8 2020-11-06 stsp size = sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint);
1036 c285a1f8 2020-11-06 stsp if (bd->bd_data == NULL || bd->bd_size > size)
1038 c285a1f8 2020-11-06 stsp if (copyout(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
1039 c285a1f8 2020-11-06 stsp bd->bd_data, bd->bd_size))
1046 c285a1f8 2020-11-06 stsp case SR_IOCTL_CHANGE_PASSPHRASE:
1048 c285a1f8 2020-11-06 stsp /* Attempt to change passphrase. */
1050 c285a1f8 2020-11-06 stsp size = sizeof(kdfpair);
1051 c285a1f8 2020-11-06 stsp if (bd->bd_data == NULL || bd->bd_size > size)
1053 c285a1f8 2020-11-06 stsp if (copyin(bd->bd_data, &kdfpair, size))
1056 c285a1f8 2020-11-06 stsp size = sizeof(kdfinfo1);
1057 c285a1f8 2020-11-06 stsp if (kdfpair.kdfinfo1 == NULL || kdfpair.kdfsize1 > size)
1059 c285a1f8 2020-11-06 stsp if (copyin(kdfpair.kdfinfo1, &kdfinfo1, size))
1062 c285a1f8 2020-11-06 stsp size = sizeof(kdfinfo2);
1063 c285a1f8 2020-11-06 stsp if (kdfpair.kdfinfo2 == NULL || kdfpair.kdfsize2 > size)
1065 c285a1f8 2020-11-06 stsp if (copyin(kdfpair.kdfinfo2, &kdfinfo2, size))
1068 c285a1f8 2020-11-06 stsp if (sr_crypto_change_maskkey(sd, &kdfinfo1, &kdfinfo2))
1071 c285a1f8 2020-11-06 stsp /* Save metadata to disk. */
1072 c285a1f8 2020-11-06 stsp rv = sr_meta_save(sd, SR_META_DIRTY);
1078 c285a1f8 2020-11-06 stsp explicit_bzero(&kdfpair, sizeof(kdfpair));
1079 c285a1f8 2020-11-06 stsp explicit_bzero(&kdfinfo1, sizeof(kdfinfo1));
1080 c285a1f8 2020-11-06 stsp explicit_bzero(&kdfinfo2, sizeof(kdfinfo2));
1082 c285a1f8 2020-11-06 stsp return (rv);
1086 c285a1f8 2020-11-06 stsp sr_crypto_meta_opt_handler(struct sr_discipline *sd, struct sr_meta_opt_hdr *om)
1088 c285a1f8 2020-11-06 stsp int rv = EINVAL;
1090 c285a1f8 2020-11-06 stsp if (om->som_type == SR_OPT_CRYPTO) {
1091 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta = (struct sr_meta_crypto *)om;
1095 c285a1f8 2020-11-06 stsp return (rv);
1099 c285a1f8 2020-11-06 stsp sr_crypto_rw(struct sr_workunit *wu)
1101 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu;
1102 c285a1f8 2020-11-06 stsp daddr_t blkno;
1103 c285a1f8 2020-11-06 stsp int rv = 0;
1105 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_DIS, "%s: sr_crypto_rw wu %p\n",
1106 c285a1f8 2020-11-06 stsp DEVNAME(wu->swu_dis->sd_sc), wu);
1108 c285a1f8 2020-11-06 stsp if (sr_validate_io(wu, &blkno, "sr_crypto_rw"))
1109 c285a1f8 2020-11-06 stsp return (1);
1111 c285a1f8 2020-11-06 stsp if (wu->swu_xs->flags & SCSI_DATA_OUT) {
1112 c285a1f8 2020-11-06 stsp crwu = sr_crypto_prepare(wu, 1);
1113 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_callback = sr_crypto_write;
1114 c285a1f8 2020-11-06 stsp rv = crypto_dispatch(crwu->cr_crp);
1115 c285a1f8 2020-11-06 stsp if (rv == 0)
1116 c285a1f8 2020-11-06 stsp rv = crwu->cr_crp->crp_etype;
1118 c285a1f8 2020-11-06 stsp rv = sr_crypto_dev_rw(wu, NULL);
1120 c285a1f8 2020-11-06 stsp return (rv);
1124 c285a1f8 2020-11-06 stsp sr_crypto_write(struct cryptop *crp)
1126 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu = crp->crp_opaque;
1127 c285a1f8 2020-11-06 stsp struct sr_workunit *wu = &crwu->cr_wu;
1130 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_INTR, "%s: sr_crypto_write: wu %p xs: %p\n",
1131 c285a1f8 2020-11-06 stsp DEVNAME(wu->swu_dis->sd_sc), wu, wu->swu_xs);
1133 c285a1f8 2020-11-06 stsp if (crp->crp_etype) {
1134 c285a1f8 2020-11-06 stsp /* fail io */
1135 c285a1f8 2020-11-06 stsp wu->swu_xs->error = XS_DRIVER_STUFFUP;
1136 c285a1f8 2020-11-06 stsp s = splbio();
1137 c285a1f8 2020-11-06 stsp sr_scsi_done(wu->swu_dis, wu->swu_xs);
1141 c285a1f8 2020-11-06 stsp sr_crypto_dev_rw(wu, crwu);
1145 c285a1f8 2020-11-06 stsp sr_crypto_dev_rw(struct sr_workunit *wu, struct sr_crypto_wu *crwu)
1147 c285a1f8 2020-11-06 stsp struct sr_discipline *sd = wu->swu_dis;
1148 c285a1f8 2020-11-06 stsp struct scsi_xfer *xs = wu->swu_xs;
1149 c285a1f8 2020-11-06 stsp struct sr_ccb *ccb;
1150 c285a1f8 2020-11-06 stsp struct uio *uio;
1151 c285a1f8 2020-11-06 stsp daddr_t blkno;
1153 c285a1f8 2020-11-06 stsp blkno = wu->swu_blk_start;
1155 c285a1f8 2020-11-06 stsp ccb = sr_ccb_rw(sd, 0, blkno, xs->datalen, xs->data, xs->flags, 0);
1156 c285a1f8 2020-11-06 stsp if (!ccb) {
1157 c285a1f8 2020-11-06 stsp /* should never happen but handle more gracefully */
1158 c285a1f8 2020-11-06 stsp printf("%s: %s: too many ccbs queued\n",
1159 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc), sd->sd_meta->ssd_devname);
1162 c285a1f8 2020-11-06 stsp if (!ISSET(xs->flags, SCSI_DATA_IN)) {
1163 c285a1f8 2020-11-06 stsp uio = crwu->cr_crp->crp_buf;
1164 c285a1f8 2020-11-06 stsp ccb->ccb_buf.b_data = uio->uio_iov->iov_base;
1165 c285a1f8 2020-11-06 stsp ccb->ccb_opaque = crwu;
1167 c285a1f8 2020-11-06 stsp sr_wu_enqueue_ccb(wu, ccb);
1168 c285a1f8 2020-11-06 stsp sr_schedule_wu(wu);
1170 c285a1f8 2020-11-06 stsp return (0);
1173 c285a1f8 2020-11-06 stsp /* wu is unwound by sr_wu_put */
1175 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_etype = EINVAL;
1176 c285a1f8 2020-11-06 stsp return (1);
1180 c285a1f8 2020-11-06 stsp sr_crypto_done(struct sr_workunit *wu)
1182 c285a1f8 2020-11-06 stsp struct scsi_xfer *xs = wu->swu_xs;
1183 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu;
1186 c285a1f8 2020-11-06 stsp /* If this was a successful read, initiate decryption of the data. */
1187 c285a1f8 2020-11-06 stsp if (ISSET(xs->flags, SCSI_DATA_IN) && xs->error == XS_NOERROR) {
1188 c285a1f8 2020-11-06 stsp crwu = sr_crypto_prepare(wu, 0);
1189 c285a1f8 2020-11-06 stsp crwu->cr_crp->crp_callback = sr_crypto_read;
1190 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_INTR, "%s: sr_crypto_done: crypto_dispatch %p\n",
1191 c285a1f8 2020-11-06 stsp DEVNAME(wu->swu_dis->sd_sc), crwu->cr_crp);
1192 c285a1f8 2020-11-06 stsp crypto_dispatch(crwu->cr_crp);
1196 c285a1f8 2020-11-06 stsp s = splbio();
1197 c285a1f8 2020-11-06 stsp sr_scsi_done(wu->swu_dis, wu->swu_xs);
1202 c285a1f8 2020-11-06 stsp sr_crypto_read(struct cryptop *crp)
1204 c285a1f8 2020-11-06 stsp struct sr_crypto_wu *crwu = crp->crp_opaque;
1205 c285a1f8 2020-11-06 stsp struct sr_workunit *wu = &crwu->cr_wu;
1208 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_INTR, "%s: sr_crypto_read: wu %p xs: %p\n",
1209 c285a1f8 2020-11-06 stsp DEVNAME(wu->swu_dis->sd_sc), wu, wu->swu_xs);
1211 c285a1f8 2020-11-06 stsp if (crp->crp_etype)
1212 c285a1f8 2020-11-06 stsp wu->swu_xs->error = XS_DRIVER_STUFFUP;
1214 c285a1f8 2020-11-06 stsp s = splbio();
1215 c285a1f8 2020-11-06 stsp sr_scsi_done(wu->swu_dis, wu->swu_xs);
1220 c285a1f8 2020-11-06 stsp sr_crypto_hotplug(struct sr_discipline *sd, struct disk *diskp, int action)
1222 c285a1f8 2020-11-06 stsp DNPRINTF(SR_D_MISC, "%s: sr_crypto_hotplug: %s %d\n",
1223 c285a1f8 2020-11-06 stsp DEVNAME(sd->sd_sc), diskp->dk_name, action);
1226 c285a1f8 2020-11-06 stsp #ifdef SR_DEBUG0
1228 c285a1f8 2020-11-06 stsp sr_crypto_dumpkeys(struct sr_discipline *sd)
1232 c285a1f8 2020-11-06 stsp printf("sr_crypto_dumpkeys:\n");
1233 c285a1f8 2020-11-06 stsp for (i = 0; i < SR_CRYPTO_MAXKEYS; i++) {
1234 c285a1f8 2020-11-06 stsp printf("\tscm_key[%d]: 0x", i);
1235 c285a1f8 2020-11-06 stsp for (j = 0; j < SR_CRYPTO_KEYBYTES; j++) {
1236 c285a1f8 2020-11-06 stsp printf("%02x",
1237 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_meta->scm_key[i][j]);
1239 c285a1f8 2020-11-06 stsp printf("\n");
1241 c285a1f8 2020-11-06 stsp printf("sr_crypto_dumpkeys: runtime data keys:\n");
1242 c285a1f8 2020-11-06 stsp for (i = 0; i < SR_CRYPTO_MAXKEYS; i++) {
1243 c285a1f8 2020-11-06 stsp printf("\tscr_key[%d]: 0x", i);
1244 c285a1f8 2020-11-06 stsp for (j = 0; j < SR_CRYPTO_KEYBYTES; j++) {
1245 c285a1f8 2020-11-06 stsp printf("%02x",
1246 c285a1f8 2020-11-06 stsp sd->mds.mdd_crypto.scr_key[i][j]);
1248 c285a1f8 2020-11-06 stsp printf("\n");
1251 c285a1f8 2020-11-06 stsp #endif /* SR_DEBUG */
