ext4 crypto: add ext4 encryption facilities (b30ab0e0) · Commits · 戴 / test

fs/ext4/Makefile

+1 −1

Original line number	Diff line number	Diff line
		@@ -12,4 +12,4 @@ ext4-y := balloc.o bitmap.o dir.o file.o fsync.o ialloc.o inode.o page-io.o \

		ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o
		ext4-$(CONFIG_EXT4_FS_SECURITY) += xattr_security.o
		ext4-$(CONFIG_EXT4_FS_ENCRYPTION) += crypto_policy.o
		ext4-$(CONFIG_EXT4_FS_ENCRYPTION) += crypto_policy.o crypto.o

fs/ext4/crypto.c

0 → 100644

+558 −0

Original line number	Diff line number	Diff line
		/*
		* linux/fs/ext4/crypto.c
		*
		* Copyright (C) 2015, Google, Inc.
		*
		* This contains encryption functions for ext4
		*
		* Written by Michael Halcrow, 2014.
		*
		* Filename encryption additions
		* Uday Savagaonkar, 2014
		* Encryption policy handling additions
		* Ildar Muslukhov, 2014
		*
		* This has not yet undergone a rigorous security audit.
		*
		* The usage of AES-XTS should conform to recommendations in NIST
		* Special Publication 800-38E and IEEE P1619/D16.
		*/

		#include <crypto/hash.h>
		#include <crypto/sha.h>
		#include <keys/user-type.h>
		#include <keys/encrypted-type.h>
		#include <linux/crypto.h>
		#include <linux/ecryptfs.h>
		#include <linux/gfp.h>
		#include <linux/kernel.h>
		#include <linux/key.h>
		#include <linux/list.h>
		#include <linux/mempool.h>
		#include <linux/module.h>
		#include <linux/mutex.h>
		#include <linux/random.h>
		#include <linux/scatterlist.h>
		#include <linux/spinlock_types.h>

		#include "ext4_extents.h"
		#include "xattr.h"

		/* Encryption added and removed here! (L: */

		static unsigned int num_prealloc_crypto_pages = 32;
		static unsigned int num_prealloc_crypto_ctxs = 128;

		module_param(num_prealloc_crypto_pages, uint, 0444);
		MODULE_PARM_DESC(num_prealloc_crypto_pages,
		"Number of crypto pages to preallocate");
		module_param(num_prealloc_crypto_ctxs, uint, 0444);
		MODULE_PARM_DESC(num_prealloc_crypto_ctxs,
		"Number of crypto contexts to preallocate");

		static mempool_t *ext4_bounce_page_pool;

		static LIST_HEAD(ext4_free_crypto_ctxs);
		static DEFINE_SPINLOCK(ext4_crypto_ctx_lock);

		/**
		* ext4_release_crypto_ctx() - Releases an encryption context
		* @ctx: The encryption context to release.
		*
		* If the encryption context was allocated from the pre-allocated pool, returns
		* it to that pool. Else, frees it.
		*
		* If there's a bounce page in the context, this frees that.
		*/
		void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx)
		{
		unsigned long flags;

		if (ctx->bounce_page) {
		if (ctx->flags & EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL)
		__free_page(ctx->bounce_page);
		else
		mempool_free(ctx->bounce_page, ext4_bounce_page_pool);
		ctx->bounce_page = NULL;
		}
		ctx->control_page = NULL;
		if (ctx->flags & EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL) {
		if (ctx->tfm)
		crypto_free_tfm(ctx->tfm);
		kfree(ctx);
		} else {
		spin_lock_irqsave(&ext4_crypto_ctx_lock, flags);
		list_add(&ctx->free_list, &ext4_free_crypto_ctxs);
		spin_unlock_irqrestore(&ext4_crypto_ctx_lock, flags);
		}
		}

		/**
		* ext4_alloc_and_init_crypto_ctx() - Allocates and inits an encryption context
		* @mask: The allocation mask.
		*
		* Return: An allocated and initialized encryption context on success. An error
		* value or NULL otherwise.
		*/
		static struct ext4_crypto_ctx *ext4_alloc_and_init_crypto_ctx(gfp_t mask)
		{
		struct ext4_crypto_ctx *ctx = kzalloc(sizeof(struct ext4_crypto_ctx),
		mask);

		if (!ctx)
		return ERR_PTR(-ENOMEM);
		return ctx;
		}

		/**
		* ext4_get_crypto_ctx() - Gets an encryption context
		* @inode: The inode for which we are doing the crypto
		*
		* Allocates and initializes an encryption context.
		*
		* Return: An allocated and initialized encryption context on success; error
		* value or NULL otherwise.
		*/
		struct ext4_crypto_ctx ext4_get_crypto_ctx(struct inode inode)
		{
		struct ext4_crypto_ctx *ctx = NULL;
		int res = 0;
		unsigned long flags;
		struct ext4_encryption_key *key = &EXT4_I(inode)->i_encryption_key;

		if (!ext4_read_workqueue)
		ext4_init_crypto();

		/*
		* We first try getting the ctx from a free list because in
		* the common case the ctx will have an allocated and
		* initialized crypto tfm, so it's probably a worthwhile
		* optimization. For the bounce page, we first try getting it
		* from the kernel allocator because that's just about as fast
		* as getting it from a list and because a cache of free pages
		* should generally be a "last resort" option for a filesystem
		* to be able to do its job.
		*/
		spin_lock_irqsave(&ext4_crypto_ctx_lock, flags);
		ctx = list_first_entry_or_null(&ext4_free_crypto_ctxs,
		struct ext4_crypto_ctx, free_list);
		if (ctx)
		list_del(&ctx->free_list);
		spin_unlock_irqrestore(&ext4_crypto_ctx_lock, flags);
		if (!ctx) {
		ctx = ext4_alloc_and_init_crypto_ctx(GFP_NOFS);
		if (IS_ERR(ctx)) {
		res = PTR_ERR(ctx);
		goto out;
		}
		ctx->flags \|= EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL;
		} else {
		ctx->flags &= ~EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL;
		}

		/* Allocate a new Crypto API context if we don't already have
		* one or if it isn't the right mode. */
		BUG_ON(key->mode == EXT4_ENCRYPTION_MODE_INVALID);
		if (ctx->tfm && (ctx->mode != key->mode)) {
		crypto_free_tfm(ctx->tfm);
		ctx->tfm = NULL;
		ctx->mode = EXT4_ENCRYPTION_MODE_INVALID;
		}
		if (!ctx->tfm) {
		switch (key->mode) {
		case EXT4_ENCRYPTION_MODE_AES_256_XTS:
		ctx->tfm = crypto_ablkcipher_tfm(
		crypto_alloc_ablkcipher("xts(aes)", 0, 0));
		break;
		case EXT4_ENCRYPTION_MODE_AES_256_GCM:
		/* TODO(mhalcrow): AEAD w/ gcm(aes);
		* crypto_aead_setauthsize() */
		ctx->tfm = ERR_PTR(-ENOTSUPP);
		break;
		default:
		BUG();
		}
		if (IS_ERR_OR_NULL(ctx->tfm)) {
		res = PTR_ERR(ctx->tfm);
		ctx->tfm = NULL;
		goto out;
		}
		ctx->mode = key->mode;
		}
		BUG_ON(key->size != ext4_encryption_key_size(key->mode));

		/* There shouldn't be a bounce page attached to the crypto
		* context at this point. */
		BUG_ON(ctx->bounce_page);

		out:
		if (res) {
		if (!IS_ERR_OR_NULL(ctx))
		ext4_release_crypto_ctx(ctx);
		ctx = ERR_PTR(res);
		}
		return ctx;
		}

		struct workqueue_struct *ext4_read_workqueue;
		static DEFINE_MUTEX(crypto_init);

		/**
		* ext4_exit_crypto() - Shutdown the ext4 encryption system
		*/
		void ext4_exit_crypto(void)
		{
		struct ext4_crypto_ctx pos, n;

		list_for_each_entry_safe(pos, n, &ext4_free_crypto_ctxs, free_list) {
		if (pos->bounce_page) {
		if (pos->flags &
		EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL) {
		__free_page(pos->bounce_page);
		} else {
		mempool_free(pos->bounce_page,
		ext4_bounce_page_pool);
		}
		}
		if (pos->tfm)
		crypto_free_tfm(pos->tfm);
		kfree(pos);
		}
		INIT_LIST_HEAD(&ext4_free_crypto_ctxs);
		if (ext4_bounce_page_pool)
		mempool_destroy(ext4_bounce_page_pool);
		ext4_bounce_page_pool = NULL;
		if (ext4_read_workqueue)
		destroy_workqueue(ext4_read_workqueue);
		ext4_read_workqueue = NULL;
		}

		/**
		* ext4_init_crypto() - Set up for ext4 encryption.
		*
		* We only call this when we start accessing encrypted files, since it
		* results in memory getting allocated that wouldn't otherwise be used.
		*
		* Return: Zero on success, non-zero otherwise.
		*/
		int ext4_init_crypto(void)
		{
		int i, res;

		mutex_lock(&crypto_init);
		if (ext4_read_workqueue)
		goto already_initialized;
		ext4_read_workqueue = alloc_workqueue("ext4_crypto", WQ_HIGHPRI, 0);
		if (!ext4_read_workqueue) {
		res = -ENOMEM;
		goto fail;
		}

		for (i = 0; i < num_prealloc_crypto_ctxs; i++) {
		struct ext4_crypto_ctx *ctx;

		ctx = ext4_alloc_and_init_crypto_ctx(GFP_KERNEL);
		if (IS_ERR(ctx)) {
		res = PTR_ERR(ctx);
		goto fail;
		}
		list_add(&ctx->free_list, &ext4_free_crypto_ctxs);
		}

		ext4_bounce_page_pool =
		mempool_create_page_pool(num_prealloc_crypto_pages, 0);
		if (!ext4_bounce_page_pool) {
		res = -ENOMEM;
		goto fail;
		}
		already_initialized:
		mutex_unlock(&crypto_init);
		return 0;
		fail:
		ext4_exit_crypto();
		mutex_unlock(&crypto_init);
		return res;
		}

		void ext4_restore_control_page(struct page *data_page)
		{
		struct ext4_crypto_ctx *ctx =
		(struct ext4_crypto_ctx *)page_private(data_page);

		set_page_private(data_page, (unsigned long)NULL);
		ClearPagePrivate(data_page);
		unlock_page(data_page);
		ext4_release_crypto_ctx(ctx);
		}

		/**
		* ext4_crypt_complete() - The completion callback for page encryption
		* @req: The asynchronous encryption request context
		* @res: The result of the encryption operation
		*/
		static void ext4_crypt_complete(struct crypto_async_request *req, int res)
		{
		struct ext4_completion_result *ecr = req->data;

		if (res == -EINPROGRESS)
		return;
		ecr->res = res;
		complete(&ecr->completion);
		}

		typedef enum {
		EXT4_DECRYPT = 0,
		EXT4_ENCRYPT,
		} ext4_direction_t;

		static int ext4_page_crypto(struct ext4_crypto_ctx *ctx,
		struct inode *inode,
		ext4_direction_t rw,
		pgoff_t index,
		struct page *src_page,
		struct page *dest_page)

		{
		u8 xts_tweak[EXT4_XTS_TWEAK_SIZE];
		struct ablkcipher_request *req = NULL;
		DECLARE_EXT4_COMPLETION_RESULT(ecr);
		struct scatterlist dst, src;
		struct ext4_inode_info *ei = EXT4_I(inode);
		struct crypto_ablkcipher *atfm = __crypto_ablkcipher_cast(ctx->tfm);
		int res = 0;

		BUG_ON(!ctx->tfm);
		BUG_ON(ctx->mode != ei->i_encryption_key.mode);

		if (ctx->mode != EXT4_ENCRYPTION_MODE_AES_256_XTS) {
		printk_ratelimited(KERN_ERR
		"%s: unsupported crypto algorithm: %d\n",
		__func__, ctx->mode);
		return -ENOTSUPP;
		}

		crypto_ablkcipher_clear_flags(atfm, ~0);
		crypto_tfm_set_flags(ctx->tfm, CRYPTO_TFM_REQ_WEAK_KEY);

		res = crypto_ablkcipher_setkey(atfm, ei->i_encryption_key.raw,
		ei->i_encryption_key.size);
		if (res) {
		printk_ratelimited(KERN_ERR
		"%s: crypto_ablkcipher_setkey() failed\n",
		__func__);
		return res;
		}
		req = ablkcipher_request_alloc(atfm, GFP_NOFS);
		if (!req) {
		printk_ratelimited(KERN_ERR
		"%s: crypto_request_alloc() failed\n",
		__func__);
		return -ENOMEM;
		}
		ablkcipher_request_set_callback(
		req, CRYPTO_TFM_REQ_MAY_BACKLOG \| CRYPTO_TFM_REQ_MAY_SLEEP,
		ext4_crypt_complete, &ecr);

		BUILD_BUG_ON(EXT4_XTS_TWEAK_SIZE < sizeof(index));
		memcpy(xts_tweak, &index, sizeof(index));
		memset(&xts_tweak[sizeof(index)], 0,
		EXT4_XTS_TWEAK_SIZE - sizeof(index));

		sg_init_table(&dst, 1);
		sg_set_page(&dst, dest_page, PAGE_CACHE_SIZE, 0);
		sg_init_table(&src, 1);
		sg_set_page(&src, src_page, PAGE_CACHE_SIZE, 0);
		ablkcipher_request_set_crypt(req, &src, &dst, PAGE_CACHE_SIZE,
		xts_tweak);
		if (rw == EXT4_DECRYPT)
		res = crypto_ablkcipher_decrypt(req);
		else
		res = crypto_ablkcipher_encrypt(req);
		if (res == -EINPROGRESS \|\| res == -EBUSY) {
		BUG_ON(req->base.data != &ecr);
		wait_for_completion(&ecr.completion);
		res = ecr.res;
		}
		ablkcipher_request_free(req);
		if (res) {
		printk_ratelimited(
		KERN_ERR
		"%s: crypto_ablkcipher_encrypt() returned %d\n",
		__func__, res);
		return res;
		}
		return 0;
		}

		/**
		* ext4_encrypt() - Encrypts a page
		* @inode: The inode for which the encryption should take place
		* @plaintext_page: The page to encrypt. Must be locked.
		*
		* Allocates a ciphertext page and encrypts plaintext_page into it using the ctx
		* encryption context.
		*
		* Called on the page write path. The caller must call
		* ext4_restore_control_page() on the returned ciphertext page to
		* release the bounce buffer and the encryption context.
		*
		* Return: An allocated page with the encrypted content on success. Else, an
		* error value or NULL.
		*/
		struct page ext4_encrypt(struct inode inode,
		struct page *plaintext_page)
		{
		struct ext4_crypto_ctx *ctx;
		struct page *ciphertext_page = NULL;
		int err;

		BUG_ON(!PageLocked(plaintext_page));

		ctx = ext4_get_crypto_ctx(inode);
		if (IS_ERR(ctx))
		return (struct page *) ctx;

		/* The encryption operation will require a bounce page. */
		ciphertext_page = alloc_page(GFP_NOFS);
		if (!ciphertext_page) {
		/* This is a potential bottleneck, but at least we'll have
		* forward progress. */
		ciphertext_page = mempool_alloc(ext4_bounce_page_pool,
		GFP_NOFS);
		if (WARN_ON_ONCE(!ciphertext_page)) {
		ciphertext_page = mempool_alloc(ext4_bounce_page_pool,
		GFP_NOFS \| __GFP_WAIT);
		}
		ctx->flags &= ~EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL;
		} else {
		ctx->flags \|= EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL;
		}
		ctx->bounce_page = ciphertext_page;
		ctx->control_page = plaintext_page;
		err = ext4_page_crypto(ctx, inode, EXT4_ENCRYPT, plaintext_page->index,
		plaintext_page, ciphertext_page);
		if (err) {
		ext4_release_crypto_ctx(ctx);
		return ERR_PTR(err);
		}
		SetPagePrivate(ciphertext_page);
		set_page_private(ciphertext_page, (unsigned long)ctx);
		lock_page(ciphertext_page);
		return ciphertext_page;
		}

		/**
		* ext4_decrypt() - Decrypts a page in-place
		* @ctx: The encryption context.
		* @page: The page to decrypt. Must be locked.
		*
		* Decrypts page in-place using the ctx encryption context.
		*
		* Called from the read completion callback.
		*
		* Return: Zero on success, non-zero otherwise.
		*/
		int ext4_decrypt(struct ext4_crypto_ctx ctx, struct page page)
		{
		BUG_ON(!PageLocked(page));

		return ext4_page_crypto(ctx, page->mapping->host,
		EXT4_DECRYPT, page->index, page, page);
		}

		/*
		* Convenience function which takes care of allocating and
		* deallocating the encryption context
		*/
		int ext4_decrypt_one(struct inode inode, struct page page)
		{
		int ret;

		struct ext4_crypto_ctx *ctx = ext4_get_crypto_ctx(inode);

		if (!ctx)
		return -ENOMEM;
		ret = ext4_decrypt(ctx, page);
		ext4_release_crypto_ctx(ctx);
		return ret;
		}

		int ext4_encrypted_zeroout(struct inode inode, struct ext4_extent ex)
		{
		struct ext4_crypto_ctx *ctx;
		struct page *ciphertext_page = NULL;
		struct bio *bio;
		ext4_lblk_t lblk = ex->ee_block;
		ext4_fsblk_t pblk = ext4_ext_pblock(ex);
		unsigned int len = ext4_ext_get_actual_len(ex);
		int err = 0;

		BUG_ON(inode->i_sb->s_blocksize != PAGE_CACHE_SIZE);

		ctx = ext4_get_crypto_ctx(inode);
		if (IS_ERR(ctx))
		return PTR_ERR(ctx);

		ciphertext_page = alloc_page(GFP_NOFS);
		if (!ciphertext_page) {
		/* This is a potential bottleneck, but at least we'll have
		* forward progress. */
		ciphertext_page = mempool_alloc(ext4_bounce_page_pool,
		GFP_NOFS);
		if (WARN_ON_ONCE(!ciphertext_page)) {
		ciphertext_page = mempool_alloc(ext4_bounce_page_pool,
		GFP_NOFS \| __GFP_WAIT);
		}
		ctx->flags &= ~EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL;
		} else {
		ctx->flags \|= EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL;
		}
		ctx->bounce_page = ciphertext_page;

		while (len--) {
		err = ext4_page_crypto(ctx, inode, EXT4_ENCRYPT, lblk,
		ZERO_PAGE(0), ciphertext_page);
		if (err)
		goto errout;

		bio = bio_alloc(GFP_KERNEL, 1);
		if (!bio) {
		err = -ENOMEM;
		goto errout;
		}
		bio->bi_bdev = inode->i_sb->s_bdev;
		bio->bi_iter.bi_sector = pblk;
		err = bio_add_page(bio, ciphertext_page,
		inode->i_sb->s_blocksize, 0);
		if (err) {
		bio_put(bio);
		goto errout;
		}
		err = submit_bio_wait(WRITE, bio);
		if (err)
		goto errout;
		}
		err = 0;
		errout:
		ext4_release_crypto_ctx(ctx);
		return err;
		}

		bool ext4_valid_contents_enc_mode(uint32_t mode)
		{
		return (mode == EXT4_ENCRYPTION_MODE_AES_256_XTS);
		}

		/**
		* ext4_validate_encryption_key_size() - Validate the encryption key size
		* @mode: The key mode.
		* @size: The key size to validate.
		*
		* Return: The validated key size for @mode. Zero if invalid.
		*/
		uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size)
		{
		if (size == ext4_encryption_key_size(mode))
		return size;
		return 0;
		}

fs/ext4/crypto_policy.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -52,6 +52,13 @@ static int ext4_create_encryption_context_from_policy(
		ctx.format = EXT4_ENCRYPTION_CONTEXT_FORMAT_V1;
		memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
		EXT4_KEY_DESCRIPTOR_SIZE);
		if (!ext4_valid_contents_enc_mode(policy->contents_encryption_mode)) {
		printk(KERN_WARNING
		"%s: Invalid contents encryption mode %d\n", __func__,
		policy->contents_encryption_mode);
		res = -EINVAL;
		goto out;
		}
		ctx.contents_encryption_mode = policy->contents_encryption_mode;
		ctx.filenames_encryption_mode = policy->filenames_encryption_mode;
		BUILD_BUG_ON(sizeof(ctx.nonce) != EXT4_KEY_DERIVATION_NONCE_SIZE);
		@@ -60,6 +67,7 @@ static int ext4_create_encryption_context_from_policy(
		res = ext4_xattr_set(inode, EXT4_XATTR_INDEX_ENCRYPTION,
		EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, &ctx,
		sizeof(ctx), 0);
		out:
		if (!res)
		ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT);
		return res;

fs/ext4/ext4.h

+52 −0

Original line number	Diff line number	Diff line
		@@ -951,6 +951,11 @@ struct ext4_inode_info {

		/* Precomputed uuid+inum+igen checksum for seeding inode checksums */
		__u32 i_csum_seed;

		#ifdef CONFIG_EXT4_FS_ENCRYPTION
		/* Encryption params */
		struct ext4_encryption_key i_encryption_key;
		#endif
		};

		/*
		@@ -1366,6 +1371,12 @@ struct ext4_sb_info {
		struct ratelimit_state s_err_ratelimit_state;
		struct ratelimit_state s_warning_ratelimit_state;
		struct ratelimit_state s_msg_ratelimit_state;

		#ifdef CONFIG_EXT4_FS_ENCRYPTION
		/* Encryption */
		uint32_t s_file_encryption_mode;
		uint32_t s_dir_encryption_mode;
		#endif
		};

		static inline struct ext4_sb_info EXT4_SB(struct super_block sb)
		@@ -1481,6 +1492,18 @@ static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
		#define EXT4_SB(sb) (sb)
		#endif

		/*
		* Returns true if the inode is inode is encrypted
		*/
		static inline int ext4_encrypted_inode(struct inode *inode)
		{
		#ifdef CONFIG_EXT4_FS_ENCRYPTION
		return ext4_test_inode_flag(inode, EXT4_INODE_ENCRYPT);
		#else
		return 0;
		#endif
		}

		#define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime

		/*
		@@ -2026,6 +2049,35 @@ int ext4_process_policy(const struct ext4_encryption_policy *policy,
		int ext4_get_policy(struct inode *inode,
		struct ext4_encryption_policy *policy);

		/* crypto.c */
		bool ext4_valid_contents_enc_mode(uint32_t mode);
		uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size);
		extern struct workqueue_struct *ext4_read_workqueue;
		struct ext4_crypto_ctx ext4_get_crypto_ctx(struct inode inode);
		void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx);
		void ext4_restore_control_page(struct page *data_page);
		struct page ext4_encrypt(struct inode inode,
		struct page *plaintext_page);
		int ext4_decrypt(struct ext4_crypto_ctx ctx, struct page page);
		int ext4_decrypt_one(struct inode inode, struct page page);
		int ext4_encrypted_zeroout(struct inode inode, struct ext4_extent ex);

		#ifdef CONFIG_EXT4_FS_ENCRYPTION
		int ext4_init_crypto(void);
		void ext4_exit_crypto(void);
		static inline int ext4_sb_has_crypto(struct super_block *sb)
		{
		return EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_ENCRYPT);
		}
		#else
		static inline int ext4_init_crypto(void) { return 0; }
		static inline void ext4_exit_crypto(void) { }
		static inline int ext4_sb_has_crypto(struct super_block *sb)
		{
		return 0;
		}
		#endif

		/* dir.c */
		extern int __ext4_check_dir_entry(const char , unsigned int, struct inode ,
		struct file *,

fs/ext4/ext4_crypto.h

+55 −0

Original line number	Diff line number	Diff line
		@@ -46,4 +46,59 @@ struct ext4_encryption_context {
		char nonce[EXT4_KEY_DERIVATION_NONCE_SIZE];
		} __attribute__((__packed__));

		/* Encryption parameters */
		#define EXT4_XTS_TWEAK_SIZE 16
		#define EXT4_AES_128_ECB_KEY_SIZE 16
		#define EXT4_AES_256_GCM_KEY_SIZE 32
		#define EXT4_AES_256_CBC_KEY_SIZE 32
		#define EXT4_AES_256_CTS_KEY_SIZE 32
		#define EXT4_AES_256_XTS_KEY_SIZE 64
		#define EXT4_MAX_KEY_SIZE 64

		struct ext4_encryption_key {
		uint32_t mode;
		char raw[EXT4_MAX_KEY_SIZE];
		uint32_t size;
		};

		#define EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001
		#define EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL 0x00000002

		struct ext4_crypto_ctx {
		struct crypto_tfm tfm; / Crypto API context */
		struct page bounce_page; / Ciphertext page on write path */
		struct page control_page; / Original page on write path */
		struct bio bio; / The bio for this context */
		struct work_struct work; /* Work queue for read complete path */
		struct list_head free_list; /* Free list */
		int flags; /* Flags */
		int mode; /* Encryption mode for tfm */
		};

		struct ext4_completion_result {
		struct completion completion;
		int res;
		};

		#define DECLARE_EXT4_COMPLETION_RESULT(ecr) \
		struct ext4_completion_result ecr = { \
		COMPLETION_INITIALIZER((ecr).completion), 0 }

		static inline int ext4_encryption_key_size(int mode)
		{
		switch (mode) {
		case EXT4_ENCRYPTION_MODE_AES_256_XTS:
		return EXT4_AES_256_XTS_KEY_SIZE;
		case EXT4_ENCRYPTION_MODE_AES_256_GCM:
		return EXT4_AES_256_GCM_KEY_SIZE;
		case EXT4_ENCRYPTION_MODE_AES_256_CBC:
		return EXT4_AES_256_CBC_KEY_SIZE;
		case EXT4_ENCRYPTION_MODE_AES_256_CTS:
		return EXT4_AES_256_CTS_KEY_SIZE;
		default:
		BUG();
		}
		return 0;
		}

		#endif /* _EXT4_CRYPTO_H */

Admin message