2 * libdevmapper - device-mapper backend for cryptsetup
4 * Copyright (C) 2004 Jana Saout <jana@saout.de>
5 * Copyright (C) 2004-2007 Clemens Fruhwirth <clemens@endorphin.org>
6 * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
7 * Copyright (C) 2009-2023 Milan Broz
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version 2
12 * of the License, or (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
27 /* device-mapper library helpers */
33 struct crypt_params_verity;
35 struct crypt_params_integrity;
37 /* Device mapper internal flags */
38 #define DM_RESUME_PRIVATE (1 << 4) /* CRYPT_ACTIVATE_PRIVATE */
39 #define DM_SUSPEND_SKIP_LOCKFS (1 << 5)
40 #define DM_SUSPEND_WIPE_KEY (1 << 6)
41 #define DM_SUSPEND_NOFLUSH (1 << 7)
43 static inline uint32_t act2dmflags(uint32_t act_flags)
45 return (act_flags & DM_RESUME_PRIVATE);
48 /* Device mapper backend - kernel support flags */
49 #define DM_KEY_WIPE_SUPPORTED (1 << 0) /* key wipe message */
50 #define DM_LMK_SUPPORTED (1 << 1) /* lmk mode */
51 #define DM_SECURE_SUPPORTED (1 << 2) /* wipe (secure) buffer flag */
52 #define DM_PLAIN64_SUPPORTED (1 << 3) /* plain64 IV */
53 #define DM_DISCARDS_SUPPORTED (1 << 4) /* discards/TRIM option is supported */
54 #define DM_VERITY_SUPPORTED (1 << 5) /* dm-verity target supported */
55 #define DM_TCW_SUPPORTED (1 << 6) /* tcw (TCRYPT CBC with whitening) */
56 #define DM_SAME_CPU_CRYPT_SUPPORTED (1 << 7) /* same_cpu_crypt */
57 #define DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED (1 << 8) /* submit_from_crypt_cpus */
58 #define DM_VERITY_ON_CORRUPTION_SUPPORTED (1 << 9) /* ignore/restart_on_corruption, ignore_zero_block */
59 #define DM_VERITY_FEC_SUPPORTED (1 << 10) /* Forward Error Correction (FEC) */
60 #define DM_KERNEL_KEYRING_SUPPORTED (1 << 11) /* dm-crypt allows loading kernel keyring keys */
61 #define DM_INTEGRITY_SUPPORTED (1 << 12) /* dm-integrity target supported */
62 #define DM_SECTOR_SIZE_SUPPORTED (1 << 13) /* support for sector size setting in dm-crypt/dm-integrity */
63 #define DM_CAPI_STRING_SUPPORTED (1 << 14) /* support for cryptoapi format cipher definition */
64 #define DM_DEFERRED_SUPPORTED (1 << 15) /* deferred removal of device */
65 #define DM_INTEGRITY_RECALC_SUPPORTED (1 << 16) /* dm-integrity automatic recalculation supported */
66 #define DM_INTEGRITY_BITMAP_SUPPORTED (1 << 17) /* dm-integrity bitmap mode supported */
67 #define DM_GET_TARGET_VERSION_SUPPORTED (1 << 18) /* dm DM_GET_TARGET version ioctl supported */
68 #define DM_INTEGRITY_FIX_PADDING_SUPPORTED (1 << 19) /* supports the parameter fix_padding that fixes a bug that caused excessive padding */
69 #define DM_BITLK_EBOIV_SUPPORTED (1 << 20) /* EBOIV for BITLK supported */
70 #define DM_BITLK_ELEPHANT_SUPPORTED (1 << 21) /* Elephant diffuser for BITLK supported */
71 #define DM_VERITY_SIGNATURE_SUPPORTED (1 << 22) /* Verity option root_hash_sig_key_desc supported */
72 #define DM_INTEGRITY_DISCARDS_SUPPORTED (1 << 23) /* dm-integrity discards/TRIM option is supported */
73 #define DM_INTEGRITY_RESIZE_SUPPORTED (1 << 23) /* dm-integrity resize of the integrity device supported (introduced in the same version as discards)*/
74 #define DM_VERITY_PANIC_CORRUPTION_SUPPORTED (1 << 24) /* dm-verity panic on corruption */
75 #define DM_CRYPT_NO_WORKQUEUE_SUPPORTED (1 << 25) /* dm-crypt suppot for bypassing workqueues */
76 #define DM_INTEGRITY_FIX_HMAC_SUPPORTED (1 << 26) /* hmac covers also superblock */
77 #define DM_INTEGRITY_RESET_RECALC_SUPPORTED (1 << 27) /* dm-integrity automatic recalculation supported */
78 #define DM_VERITY_TASKLETS_SUPPORTED (1 << 28) /* dm-verity tasklets supported */
80 typedef enum { DM_CRYPT = 0, DM_VERITY, DM_INTEGRITY, DM_LINEAR, DM_ERROR, DM_ZERO, DM_UNKNOWN } dm_target_type;
81 enum tdirection { TARGET_EMPTY = 0, TARGET_SET, TARGET_QUERY };
83 int dm_flags(struct crypt_device *cd, dm_target_type target, uint32_t *flags);
85 #define DM_ACTIVE_DEVICE (1 << 0)
86 #define DM_ACTIVE_UUID (1 << 1)
87 #define DM_ACTIVE_HOLDERS (1 << 2)
89 #define DM_ACTIVE_CRYPT_CIPHER (1 << 3)
90 #define DM_ACTIVE_CRYPT_KEYSIZE (1 << 4)
91 #define DM_ACTIVE_CRYPT_KEY (1 << 5)
93 #define DM_ACTIVE_VERITY_ROOT_HASH (1 << 6)
94 #define DM_ACTIVE_VERITY_HASH_DEVICE (1 << 7)
95 #define DM_ACTIVE_VERITY_PARAMS (1 << 8)
97 #define DM_ACTIVE_INTEGRITY_PARAMS (1 << 9)
99 #define DM_ACTIVE_JOURNAL_CRYPT_KEY (1 << 10)
100 #define DM_ACTIVE_JOURNAL_CRYPT_KEYSIZE (1 << 11)
102 #define DM_ACTIVE_JOURNAL_MAC_KEY (1 << 12)
103 #define DM_ACTIVE_JOURNAL_MAC_KEYSIZE (1 << 13)
107 enum tdirection direction;
110 struct device *data_device;
114 const char *integrity;
116 /* Active key for device */
117 struct volume_key *vk;
119 /* struct crypt_active_device */
120 uint64_t offset; /* offset in sectors */
121 uint64_t iv_offset; /* IV initialisation sector */
122 uint32_t tag_size; /* additional on-disk tag size */
123 uint32_t sector_size; /* encryption sector size */
126 struct device *hash_device;
127 struct device *fec_device;
129 const char *root_hash;
130 uint32_t root_hash_size;
131 const char *root_hash_sig_key_desc;
133 uint64_t hash_offset; /* hash offset in blocks (not header) */
134 uint64_t fec_offset; /* FEC offset in blocks (not header) */
135 uint64_t fec_blocks; /* FEC blocks covering data + hash + padding (foreign metadata)*/
136 struct crypt_params_verity *vp;
139 uint64_t journal_size;
140 uint32_t journal_watermark;
141 uint32_t journal_commit_time;
142 uint32_t interleave_sectors;
144 uint64_t offset; /* offset in sectors */
145 uint32_t sector_size; /* integrity sector size */
146 uint32_t buffer_sectors;
148 const char *integrity;
149 /* Active key for device */
150 struct volume_key *vk;
152 const char *journal_integrity;
153 struct volume_key *journal_integrity_key;
155 const char *journal_crypt;
156 struct volume_key *journal_crypt_key;
158 struct device *meta_device;
172 struct dm_target *next;
175 struct crypt_dm_active_device {
176 uint64_t size; /* active device size */
177 uint32_t flags; /* activation flags */
180 unsigned holders:1; /* device holders detected (on query only) */
182 struct dm_target segment;
185 static inline bool single_segment(const struct crypt_dm_active_device *dmd)
187 return dmd && !dmd->segment.next;
190 void dm_backend_init(struct crypt_device *cd);
191 void dm_backend_exit(struct crypt_device *cd);
193 int dm_targets_allocate(struct dm_target *first, unsigned count);
194 void dm_targets_free(struct crypt_device *cd, struct crypt_dm_active_device *dmd);
196 int dm_crypt_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
197 struct device *data_device, struct volume_key *vk, const char *cipher,
198 uint64_t iv_offset, uint64_t data_offset, const char *integrity,
199 uint32_t tag_size, uint32_t sector_size);
200 int dm_verity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
201 struct device *data_device, struct device *hash_device, struct device *fec_device,
202 const char *root_hash, uint32_t root_hash_size, const char* root_hash_sig_key_desc,
203 uint64_t hash_offset_block, uint64_t fec_blocks, struct crypt_params_verity *vp);
204 int dm_integrity_target_set(struct crypt_device *cd,
205 struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
206 struct device *meta_device,
207 struct device *data_device, uint64_t tag_size, uint64_t offset, uint32_t sector_size,
208 struct volume_key *vk,
209 struct volume_key *journal_crypt_key, struct volume_key *journal_mac_key,
210 const struct crypt_params_integrity *ip);
211 int dm_linear_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
212 struct device *data_device, uint64_t data_offset);
213 int dm_zero_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size);
215 int dm_remove_device(struct crypt_device *cd, const char *name, uint32_t flags);
216 int dm_status_device(struct crypt_device *cd, const char *name);
217 int dm_status_suspended(struct crypt_device *cd, const char *name);
218 int dm_status_verity_ok(struct crypt_device *cd, const char *name);
219 int dm_status_integrity_failures(struct crypt_device *cd, const char *name, uint64_t *count);
220 int dm_query_device(struct crypt_device *cd, const char *name,
221 uint32_t get_flags, struct crypt_dm_active_device *dmd);
222 int dm_device_deps(struct crypt_device *cd, const char *name, const char *prefix,
223 char **names, size_t names_length);
224 int dm_create_device(struct crypt_device *cd, const char *name,
225 const char *type, struct crypt_dm_active_device *dmd);
226 int dm_reload_device(struct crypt_device *cd, const char *name,
227 struct crypt_dm_active_device *dmd, uint32_t dmflags, unsigned resume);
228 int dm_suspend_device(struct crypt_device *cd, const char *name, uint32_t dmflags);
229 int dm_resume_device(struct crypt_device *cd, const char *name, uint32_t dmflags);
230 int dm_resume_and_reinstate_key(struct crypt_device *cd, const char *name,
231 const struct volume_key *vk);
232 int dm_error_device(struct crypt_device *cd, const char *name);
233 int dm_clear_device(struct crypt_device *cd, const char *name);
234 int dm_cancel_deferred_removal(const char *name);
236 const char *dm_get_dir(void);
238 int lookup_dm_dev_by_uuid(struct crypt_device *cd, const char *uuid, const char *type);
240 /* These are DM helpers used only by utils_devpath file */
241 int dm_is_dm_device(int major);
242 int dm_is_dm_kernel_name(const char *name);
243 char *dm_device_path(const char *prefix, int major, int minor);
244 char *dm_device_name(const char *path);
246 #endif /* _UTILS_DM_H */