X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=lib%2Flibdevmapper.c;h=f7113925e8eff25998aa069a2326d2ff00279bef;hb=f45d4d0755239da85e553dcfe24e6c9b82ac7818;hp=036b9a70f3662586a97e41a1769ca052b1191aa2;hpb=4a42f27d78e260fcc641150d6a0ab2569df569f0;p=platform%2Fupstream%2Fcryptsetup.git

diff --git a/lib/libdevmapper.c b/lib/libdevmapper.c
index 036b9a7..f711392 100644
--- a/lib/libdevmapper.c
+++ b/lib/libdevmapper.c
@@ -1,34 +1,68 @@
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <unistd.h>
+/*
+ * libdevmapper - device-mapper backend for cryptsetup
+ *
+ * Copyright (C) 2004, Christophe Saout <christophe@saout.de>
+ * Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
+ * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <stdio.h>
 #include <dirent.h>
 #include <errno.h>
 #include <libdevmapper.h>
-#include <linux/dm-ioctl.h>
 #include <fcntl.h>
 #include <linux/fs.h>
 #include <uuid/uuid.h>
 
 #include "internal.h"
-#include "luks.h"
 
-#define DEVICE_DIR		"/dev"
+#define DM_UUID_LEN		129
 #define DM_UUID_PREFIX		"CRYPT-"
 #define DM_UUID_PREFIX_LEN	6
 #define DM_CRYPT_TARGET		"crypt"
+#define DM_VERITY_TARGET	"verity"
 #define RETRY_COUNT		5
 
-static int _dm_use_count = 0;
+/* Set if dm-crypt version was probed */
+static int _dm_crypt_checked = 0;
+static int _quiet_log = 0;
+static uint32_t _dm_crypt_flags = 0;
+
 static struct crypt_device *_context = NULL;
+static int _dm_use_count = 0;
+
+/* Check if we have DM flag to instruct kernel to force wipe buffers */
+#if !HAVE_DECL_DM_TASK_SECURE_DATA
+static int dm_task_secure_data(struct dm_task *dmt) { return 1; }
+#endif
 
 /* Compatibility for old device-mapper without udev support */
-#ifndef HAVE_DM_TASK_SET_COOKIE
-static int dm_task_set_cookie(struct dm_task *dmt, uint32_t *cookie, uint16_t flags) { return 0; }
-static int dm_udev_wait(uint32_t cookie) { return 0; };
+#if HAVE_DECL_DM_UDEV_DISABLE_DISK_RULES_FLAG
+#define CRYPT_TEMP_UDEV_FLAGS	DM_UDEV_DISABLE_SUBSYSTEM_RULES_FLAG | \
+				DM_UDEV_DISABLE_DISK_RULES_FLAG | \
+				DM_UDEV_DISABLE_OTHER_RULES_FLAG
+#define _dm_task_set_cookie	dm_task_set_cookie
+#define _dm_udev_wait		dm_udev_wait
+#else
+#define CRYPT_TEMP_UDEV_FLAGS	0
+static int _dm_task_set_cookie(struct dm_task *dmt, uint32_t *cookie, uint16_t flags) { return 0; }
+static int _dm_udev_wait(uint32_t cookie) { return 0; };
 #endif
 
-static int _dm_use_udev()
+static int _dm_use_udev(void)
 {
 #ifdef USE_UDEV /* cannot be enabled if devmapper is too old */
 	return dm_udev_get_sync_support();
@@ -37,7 +71,10 @@ static int _dm_use_udev()
 #endif
 }
 
-static void set_dm_error(int level, const char *file, int line,
+__attribute__((format(printf, 4, 5)))
+static void set_dm_error(int level,
+			 const char *file __attribute__((unused)),
+			 int line __attribute__((unused)),
 			 const char *f, ...)
 {
 	char *msg = NULL;
@@ -45,11 +82,14 @@ static void set_dm_error(int level, const char *file, int line,
 
 	va_start(va, f);
 	if (vasprintf(&msg, f, va) > 0) {
-		if (level < 4) {
+		if (level < 4 && !_quiet_log) {
 			log_err(_context, msg);
 			log_err(_context, "\n");
-		} else
-			log_dbg(msg);
+		} else {
+			/* We do not use DM visual stack backtrace here */
+			if (strncmp(msg, "<backtrace>", 11))
+				log_dbg(msg);
+		}
 	}
 	free(msg);
 	va_end(va);
@@ -57,169 +97,282 @@ static void set_dm_error(int level, const char *file, int line,
 
 static int _dm_simple(int task, const char *name, int udev_wait);
 
-int dm_init(struct crypt_device *context, int check_kernel)
+static void _dm_set_crypt_compat(const char *dm_version, unsigned crypt_maj,
+				 unsigned crypt_min, unsigned crypt_patch)
 {
-	if (!_dm_use_count++) {
-		log_dbg("Initialising device-mapper backend%s, UDEV is %sabled.",
-			check_kernel ? "" : " (NO kernel check requested)",
-			_dm_use_udev() ? "en" : "dis");
-		if (check_kernel && !_dm_simple(DM_DEVICE_LIST_VERSIONS, NULL, 0)) {
-			log_err(context, _("Cannot initialize device-mapper. Is dm_mod kernel module loaded?\n"));
-			return -1;
-		}
-		if (getuid() || geteuid())
-			log_dbg(("WARNING: Running as a non-root user. Functionality may be unavailable."));
-		dm_log_init(set_dm_error);
-		dm_log_init_verbose(10);
-	}
+	unsigned dm_maj, dm_min, dm_patch;
+
+	if (sscanf(dm_version, "%u.%u.%u", &dm_maj, &dm_min, &dm_patch) != 3)
+		dm_maj = dm_min = dm_patch = 0;
+
+	log_dbg("Detected dm-crypt version %i.%i.%i, dm-ioctl version %u.%u.%u.",
+		crypt_maj, crypt_min, crypt_patch, dm_maj, dm_min, dm_patch);
+
+	if (crypt_maj >= 1 && crypt_min >= 2)
+		_dm_crypt_flags |= DM_KEY_WIPE_SUPPORTED;
+	else
+		log_dbg("Suspend and resume disabled, no wipe key support.");
+
+	if (crypt_maj >= 1 && crypt_min >= 10)
+		_dm_crypt_flags |= DM_LMK_SUPPORTED;
 
-	// FIXME: global context is not safe
-	if (context)
-		_context = context;
+	if (dm_maj >= 4 && dm_min >= 20)
+		_dm_crypt_flags |= DM_SECURE_SUPPORTED;
 
-	return 1;	/* unsafe memory */
+	/* not perfect, 2.6.33 supports with 1.7.0 */
+	if (crypt_maj >= 1 && crypt_min >= 8)
+		_dm_crypt_flags |= DM_PLAIN64_SUPPORTED;
+
+	if (crypt_maj >= 1 && crypt_min >= 11)
+		_dm_crypt_flags |= DM_DISCARDS_SUPPORTED;
+
+	/* Repeat test if dm-crypt is not present */
+	if (crypt_maj > 0)
+		_dm_crypt_checked = 1;
 }
 
-void dm_exit(void)
+static void _dm_set_verity_compat(const char *dm_version, unsigned verity_maj,
+				   unsigned verity_min, unsigned verity_patch)
 {
-	if (_dm_use_count && (!--_dm_use_count)) {
-		log_dbg("Releasing device-mapper backend.");
-		dm_log_init_verbose(0);
-		dm_log_init(NULL);
-		dm_lib_release();
-		_context = NULL;
-	}
+	if (verity_maj > 0)
+		_dm_crypt_flags |= DM_VERITY_SUPPORTED;
+
+	log_dbg("Detected dm-verity version %i.%i.%i.",
+		verity_maj, verity_min, verity_patch);
 }
 
-static char *__lookup_dev(char *path, dev_t dev, int dir_level, const int max_level)
+static int _dm_check_versions(void)
 {
-	struct dirent *entry;
-	struct stat st;
-	char *ptr;
-	char *result = NULL;
-	DIR *dir;
-	int space;
+	struct dm_task *dmt;
+	struct dm_versions *target, *last_target;
+	char dm_version[16];
+	int r = 0;
 
-	/* Ignore strange nested directories */
-	if (dir_level > max_level)
-		return NULL;
+	if (_dm_crypt_checked)
+		return 1;
 
-	path[PATH_MAX - 1] = '\0';
-	ptr = path + strlen(path);
-	*ptr++ = '/';
-	*ptr = '\0';
-	space = PATH_MAX - (ptr - path);
+	/* Shut up DM while checking */
+	_quiet_log = 1;
 
-	dir = opendir(path);
-	if (!dir)
-		return NULL;
+	/* FIXME: add support to DM so it forces crypt target module load here */
+	if (!(dmt = dm_task_create(DM_DEVICE_LIST_VERSIONS)))
+		goto out;
 
-	while((entry = readdir(dir))) {
-		if (entry->d_name[0] == '.' ||
-		    !strncmp(entry->d_name, "..", 2))
-			continue;
-
-		strncpy(ptr, entry->d_name, space);
-		if (lstat(path, &st) < 0)
-			continue;
-
-		if (S_ISDIR(st.st_mode)) {
-			result = __lookup_dev(path, dev, dir_level + 1, max_level);
-			if (result)
-				break;
-		} else if (S_ISBLK(st.st_mode)) {
-			/* workaround: ignore dm-X devices, these are internal kernel names */
-			if (dir_level == 0 && !strncmp(entry->d_name, "dm-", 3))
-				continue;
-			if (st.st_rdev == dev) {
-				result = strdup(path);
-				break;
-			}
-		}
-	}
+	if (!dm_task_run(dmt))
+		goto out;
 
-	closedir(dir);
-	return result;
-}
+	if (!dm_task_get_driver_version(dmt, dm_version, sizeof(dm_version)))
+		goto out;
 
-static char *lookup_dev(const char *dev_id)
-{
-	uint32_t major, minor;
-	dev_t dev;
-	char *result, buf[PATH_MAX + 1];
+	target = dm_task_get_versions(dmt);
+	do {
+		last_target = target;
+		if (!strcmp(DM_CRYPT_TARGET, target->name)) {
+			_dm_set_crypt_compat(dm_version,
+					     (unsigned)target->version[0],
+					     (unsigned)target->version[1],
+					     (unsigned)target->version[2]);
+		} else if (!strcmp(DM_VERITY_TARGET, target->name)) {
+			_dm_set_verity_compat(dm_version,
+					     (unsigned)target->version[0],
+					     (unsigned)target->version[1],
+					     (unsigned)target->version[2]);
+		}
+		target = (struct dm_versions *)((char *) target + target->next);
+	} while (last_target != target);
 
-	if (sscanf(dev_id, "%" PRIu32 ":%" PRIu32, &major, &minor) != 2)
-		return NULL;
+	r = 1;
+	log_dbg("Device-mapper backend running with UDEV support %sabled.",
+		_dm_use_udev() ? "en" : "dis");
+out:
+	if (dmt)
+		dm_task_destroy(dmt);
 
-	dev = makedev(major, minor);
-	strncpy(buf, DEVICE_DIR, PATH_MAX);
-	buf[PATH_MAX] = '\0';
+	_quiet_log = 0;
+	return r;
+}
 
-	/* First try low level device */
-	if ((result = __lookup_dev(buf, dev, 0, 0)))
-		return result;
+uint32_t dm_flags(void)
+{
+	_dm_check_versions();
+	return _dm_crypt_flags;
+}
 
-	/* If it is dm, try DM dir  */
-	if (dm_is_dm_major(major)) {
-		strncpy(buf, dm_dir(), PATH_MAX);
-		if ((result = __lookup_dev(buf, dev, 0, 0)))
-			return result;
+/* This doesn't run any kernel checks, just set up userspace libdevmapper */
+void dm_backend_init(void)
+{
+	if (!_dm_use_count++) {
+		log_dbg("Initialising device-mapper backend library.");
+		dm_log_init(set_dm_error);
+		dm_log_init_verbose(10);
 	}
+}
 
-	strncpy(buf, DEVICE_DIR, PATH_MAX);
-	result = __lookup_dev(buf, dev, 0, 4);
+void dm_backend_exit(void)
+{
+	if (_dm_use_count && (!--_dm_use_count)) {
+		log_dbg("Releasing device-mapper backend.");
+		dm_log_init_verbose(0);
+		dm_log_init(NULL);
+		dm_lib_release();
+	}
+}
 
-	/* If not found, return major:minor */
-	return result ?: strdup(dev_id);
+/*
+ * libdevmapper is not context friendly, switch context on every DM call.
+ * FIXME: this is not safe if called in parallel but neither is DM lib.
+ */
+static int dm_init_context(struct crypt_device *cd)
+{
+	_context = cd;
+	if (!_dm_check_versions()) {
+		if (getuid() || geteuid())
+			log_err(cd, _("Cannot initialize device-mapper, "
+				      "running as non-root user.\n"));
+		else
+			log_err(cd, _("Cannot initialize device-mapper. "
+				      "Is dm_mod kernel module loaded?\n"));
+		_context = NULL;
+		return -ENOTSUP;
+	}
+	return 0;
+}
+static void dm_exit_context(void)
+{
+	_context = NULL;
 }
 
-static int _dev_read_ahead(const char *dev, uint32_t *read_ahead)
+/* Return path to DM device */
+char *dm_device_path(const char *prefix, int major, int minor)
 {
-	int fd, r = 0;
-	long read_ahead_long;
+	struct dm_task *dmt;
+	const char *name;
+	char path[PATH_MAX];
 
-	if ((fd = open(dev, O_RDONLY)) < 0)
-		return 0;
+	if (!(dmt = dm_task_create(DM_DEVICE_STATUS)))
+		return NULL;
+	if (!dm_task_set_minor(dmt, minor) ||
+	    !dm_task_set_major(dmt, major) ||
+	    !dm_task_run(dmt) ||
+	    !(name = dm_task_get_name(dmt))) {
+		dm_task_destroy(dmt);
+		return NULL;
+	}
 
-	r = ioctl(fd, BLKRAGET, &read_ahead_long) ? 0 : 1;
-	close(fd);
+	if (snprintf(path, sizeof(path), "%s%s", prefix ?: "", name) < 0)
+		path[0] = '\0';
 
-	if (r)
-		*read_ahead = (uint32_t) read_ahead_long;
+	dm_task_destroy(dmt);
 
-	return r;
+	return strdup(path);
 }
 
 static void hex_key(char *hexkey, size_t key_size, const char *key)
 {
-	int i;
+	unsigned i;
 
 	for(i = 0; i < key_size; i++)
 		sprintf(&hexkey[i * 2], "%02x", (unsigned char)key[i]);
 }
 
-static char *get_params(const char *device, uint64_t skip, uint64_t offset,
-			const char *cipher, size_t key_size, const char *key)
+/* http://code.google.com/p/cryptsetup/wiki/DMCrypt */
+static char *get_dm_crypt_params(struct crypt_dm_active_device *dmd)
 {
-	char *params;
-	char *hexkey;
+	int r, max_size, null_cipher = 0;
+	char *params, *hexkey;
+	const char *features = "";
 
-	hexkey = safe_alloc(key_size * 2 + 1);
+	if (!dmd)
+		return NULL;
+
+	if (dmd->flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) {
+		if (dm_flags() & DM_DISCARDS_SUPPORTED) {
+			features = " 1 allow_discards";
+			log_dbg("Discard/TRIM is allowed.");
+		} else
+			log_dbg("Discard/TRIM is not supported by the kernel.");
+	}
+
+	if (!strncmp(dmd->u.crypt.cipher, "cipher_null-", 12))
+		null_cipher = 1;
+
+	hexkey = crypt_safe_alloc(null_cipher ? 2 : (dmd->u.crypt.vk->keylength * 2 + 1));
 	if (!hexkey)
 		return NULL;
 
-	hex_key(hexkey, key_size, key);
+	if (null_cipher)
+		strncpy(hexkey, "-", 2);
+	else
+		hex_key(hexkey, dmd->u.crypt.vk->keylength, dmd->u.crypt.vk->key);
 
-	params = safe_alloc(strlen(hexkey) + strlen(cipher) + strlen(device) + 64);
+	max_size = strlen(hexkey) + strlen(dmd->u.crypt.cipher) +
+		   strlen(device_block_path(dmd->data_device)) +
+		   strlen(features) + 64;
+	params = crypt_safe_alloc(max_size);
 	if (!params)
 		goto out;
 
-	sprintf(params, "%s %s %" PRIu64 " %s %" PRIu64,
-	        cipher, hexkey, skip, device, offset);
+	r = snprintf(params, max_size, "%s %s %" PRIu64 " %s %" PRIu64 "%s",
+		     dmd->u.crypt.cipher, hexkey, dmd->u.crypt.iv_offset,
+		     device_block_path(dmd->data_device), dmd->u.crypt.offset,
+		     features);
+	if (r < 0 || r >= max_size) {
+		crypt_safe_free(params);
+		params = NULL;
+	}
+out:
+	crypt_safe_free(hexkey);
+	return params;
+}
+
+/* http://code.google.com/p/cryptsetup/wiki/DMVerity */
+static char *get_dm_verity_params(struct crypt_params_verity *vp,
+				   struct crypt_dm_active_device *dmd)
+{
+	int max_size, r;
+	char *params = NULL, *hexroot = NULL, *hexsalt = NULL;
+
+	if (!vp || !dmd)
+		return NULL;
+
+	hexroot = crypt_safe_alloc(dmd->u.verity.root_hash_size * 2 + 1);
+	if (!hexroot)
+		goto out;
+	hex_key(hexroot, dmd->u.verity.root_hash_size, dmd->u.verity.root_hash);
+
+	hexsalt = crypt_safe_alloc(vp->salt_size ? vp->salt_size * 2 + 1 : 2);
+	if (!hexsalt)
+		goto out;
+	if (vp->salt_size)
+		hex_key(hexsalt, vp->salt_size, vp->salt);
+	else
+		strncpy(hexsalt, "-", 2);
 
+	max_size = strlen(hexroot) + strlen(hexsalt) +
+		   strlen(device_block_path(dmd->data_device)) +
+		   strlen(device_block_path(dmd->u.verity.hash_device)) +
+		   strlen(vp->hash_name) + 128;
+
+	params = crypt_safe_alloc(max_size);
+	if (!params)
+		goto out;
+
+	r = snprintf(params, max_size,
+		     "%u %s %s %u %u %" PRIu64 " %" PRIu64 " %s %s %s",
+		     vp->hash_type, device_block_path(dmd->data_device),
+		     device_block_path(dmd->u.verity.hash_device),
+		     vp->data_block_size, vp->hash_block_size,
+		     vp->data_size, dmd->u.verity.hash_offset,
+		     vp->hash_name, hexroot, hexsalt);
+	if (r < 0 || r >= max_size) {
+		crypt_safe_free(params);
+		params = NULL;
+	}
 out:
-	safe_free(hexkey);
+	crypt_safe_free(hexroot);
+	crypt_safe_free(hexsalt);
 	return params;
+
 }
 
 /* DM helpers */
@@ -238,12 +391,18 @@ static int _dm_simple(int task, const char *name, int udev_wait)
 	if (name && !dm_task_set_name(dmt, name))
 		goto out;
 
-	if (udev_wait && !dm_task_set_cookie(dmt, &cookie, 0));
+#if HAVE_DECL_DM_TASK_RETRY_REMOVE
+	/* Used only in DM_DEVICE_REMOVE */
+	if (name && !dm_task_retry_remove(dmt))
+		goto out;
+#endif
+	if (udev_wait && !_dm_task_set_cookie(dmt, &cookie, 0))
+		goto out;
 
 	r = dm_task_run(dmt);
 
-	if (r && udev_wait)
-		(void)dm_udev_wait(cookie);
+	if (udev_wait)
+		(void)_dm_udev_wait(cookie);
 
       out:
 	dm_task_destroy(dmt);
@@ -285,7 +444,8 @@ error:
 	return r;
 }
 
-int dm_remove_device(const char *name, int force, uint64_t size)
+int dm_remove_device(struct crypt_device *cd, const char *name,
+		     int force, uint64_t size)
 {
 	int r = -EINVAL;
 	int retries = force ? RETRY_COUNT : 1;
@@ -294,13 +454,14 @@ int dm_remove_device(const char *name, int force, uint64_t size)
 	if (!name || (force && !size))
 		return -EINVAL;
 
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+
 	do {
 		r = _dm_simple(DM_DEVICE_REMOVE, name, 1) ? 0 : -EINVAL;
 		if (--retries && r) {
 			log_dbg("WARNING: other process locked internal device %s, %s.",
 				name, retries ? "retrying remove" : "giving up");
-			if (force && (crypt_get_debug_level() == CRYPT_LOG_DEBUG))
-				debug_processes_using_device(name);
 			sleep(1);
 			if (force && !error_target) {
 				/* If force flag is set, replace device with error, read-only target.
@@ -318,6 +479,7 @@ int dm_remove_device(const char *name, int force, uint64_t size)
 	} while (r == -EINVAL && retries);
 
 	dm_task_update_nodes();
+	dm_exit_context();
 
 	return r;
 }
@@ -333,7 +495,7 @@ static void dm_prepare_uuid(const char *name, const char *type, const char *uuid
 {
 	char *ptr, uuid2[UUID_LEN] = {0};
 	uuid_t uu;
-	int i = 0;
+	unsigned i = 0;
 
 	/* Remove '-' chars */
 	if (uuid && !uuid_parse(uuid, uu)) {
@@ -354,32 +516,21 @@ static void dm_prepare_uuid(const char *name, const char *type, const char *uuid
 		log_err(NULL, _("DM-UUID for device %s was truncated.\n"), name);
 }
 
-int dm_create_device(const char *name,
-		     const char *device,
-		     const char *cipher,
-		     const char *type,
-		     const char *uuid,
-		     uint64_t size,
-		     uint64_t skip,
-		     uint64_t offset,
-		     size_t key_size,
-		     const char *key,
-		     int read_only,
-		     int reload)
+static int _dm_create_device(const char *name, const char *type,
+			     struct device *device, uint32_t flags,
+			     const char *uuid, uint64_t size,
+			     char *params, int reload)
 {
 	struct dm_task *dmt = NULL;
-	struct dm_task *dmt_query = NULL;
 	struct dm_info dmi;
-	char *params = NULL;
-	char *error = NULL;
 	char dev_uuid[DM_UUID_LEN] = {0};
 	int r = -EINVAL;
 	uint32_t read_ahead = 0;
 	uint32_t cookie = 0;
+	uint16_t udev_flags = 0;
 
-	params = get_params(device, skip, offset, cipher, key_size, key);
-	if (!params)
-		goto out_no_removal;
+	if (flags & CRYPT_ACTIVATE_PRIVATE)
+		udev_flags = CRYPT_TEMP_UDEV_FLAGS;
 
 	/* All devices must have DM_UUID, only resize on old device is exception */
 	if (reload) {
@@ -400,17 +551,21 @@ int dm_create_device(const char *name,
 		if (!dm_task_set_uuid(dmt, dev_uuid))
 			goto out_no_removal;
 
-		if (_dm_use_udev() && !dm_task_set_cookie(dmt, &cookie, 0))
+		if (_dm_use_udev() && !_dm_task_set_cookie(dmt, &cookie, udev_flags))
 			goto out_no_removal;
 	}
 
-	if (read_only && !dm_task_set_ro(dmt))
+	if ((dm_flags() & DM_SECURE_SUPPORTED) && !dm_task_secure_data(dmt))
+		goto out_no_removal;
+	if ((flags & CRYPT_ACTIVATE_READONLY) && !dm_task_set_ro(dmt))
 		goto out_no_removal;
-	if (!dm_task_add_target(dmt, 0, size, DM_CRYPT_TARGET, params))
+
+	if (!dm_task_add_target(dmt, 0, size,
+		!strcmp("VERITY", type) ? DM_VERITY_TARGET : DM_CRYPT_TARGET, params))
 		goto out_no_removal;
 
 #ifdef DM_READ_AHEAD_MINIMUM_FLAG
-	if (_dev_read_ahead(device, &read_ahead) &&
+	if (device_read_ahead(device, &read_ahead) &&
 	    !dm_task_set_read_ahead(dmt, read_ahead, DM_READ_AHEAD_MINIMUM_FLAG))
 		goto out_no_removal;
 #endif
@@ -426,204 +581,475 @@ int dm_create_device(const char *name,
 			goto out;
 		if (uuid && !dm_task_set_uuid(dmt, dev_uuid))
 			goto out;
-		if (_dm_use_udev() && !dm_task_set_cookie(dmt, &cookie, 0))
+		if (_dm_use_udev() && !_dm_task_set_cookie(dmt, &cookie, udev_flags))
 			goto out;
 		if (!dm_task_run(dmt))
 			goto out;
 	}
 
-	if (_dm_use_udev())
-		(void)dm_udev_wait(cookie);
-
 	if (!dm_task_get_info(dmt, &dmi))
 		goto out;
 
 	r = 0;
 out:
-	if (r < 0 && !reload) {
-		if (get_error())
-			error = strdup(get_error());
-
-		dm_remove_device(name, 0, 0);
-
-		if (error) {
-			set_error(error);
-			free(error);
-		}
+	if (_dm_use_udev()) {
+		(void)_dm_udev_wait(cookie);
+		cookie = 0;
 	}
 
+	if (r < 0 && !reload)
+		_dm_simple(DM_DEVICE_REMOVE, name, 1);
+
 out_no_removal:
+	if (cookie && _dm_use_udev())
+		(void)_dm_udev_wait(cookie);
+
 	if (params)
-		safe_free(params);
+		crypt_safe_free(params);
 	if (dmt)
 		dm_task_destroy(dmt);
-	if(dmt_query)
-		dm_task_destroy(dmt_query);
+
 	dm_task_update_nodes();
 	return r;
 }
 
-int dm_status_device(const char *name)
+int dm_create_device(struct crypt_device *cd, const char *name,
+		     const char *type,
+		     struct crypt_dm_active_device *dmd,
+		     int reload)
+{
+	char *table_params = NULL;
+	int r = -EINVAL;
+
+	if (!type)
+		return -EINVAL;
+
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+
+	if (dmd->target == DM_CRYPT)
+		table_params = get_dm_crypt_params(dmd);
+	else if (dmd->target == DM_VERITY)
+		table_params = get_dm_verity_params(dmd->u.verity.vp, dmd);
+
+	if (table_params)
+		r = _dm_create_device(name, type, dmd->data_device,
+				      dmd->flags, dmd->uuid, dmd->size,
+				      table_params, reload);
+	dm_exit_context();
+	return r;
+}
+
+static int dm_status_dmi(const char *name, struct dm_info *dmi,
+			  const char *target, char **status_line)
 {
 	struct dm_task *dmt;
-	struct dm_info dmi;
 	uint64_t start, length;
-	char *target_type, *params;
+	char *target_type, *params = NULL;
 	void *next = NULL;
 	int r = -EINVAL;
 
 	if (!(dmt = dm_task_create(DM_DEVICE_STATUS)))
-		return -EINVAL;
+		goto out;
 
-	if (!dm_task_set_name(dmt, name)) {
-		r = -EINVAL;
+	if (!dm_task_set_name(dmt, name))
 		goto out;
-	}
 
-	if (!dm_task_run(dmt)) {
-		r = -EINVAL;
+	if (!dm_task_run(dmt))
 		goto out;
-	}
 
-	if (!dm_task_get_info(dmt, &dmi)) {
-		r = -EINVAL;
+	if (!dm_task_get_info(dmt, dmi))
 		goto out;
-	}
 
-	if (!dmi.exists) {
+	if (!dmi->exists) {
 		r = -ENODEV;
 		goto out;
 	}
 
 	next = dm_get_next_target(dmt, next, &start, &length,
 	                          &target_type, &params);
-	if (!target_type || strcmp(target_type, DM_CRYPT_TARGET) != 0 ||
-	    start != 0 || next)
-		r = -EINVAL;
-	else
-		r = (dmi.open_count > 0);
+
+	if (!target_type || start != 0 || next)
+		goto out;
+
+	if (target && strcmp(target_type, target))
+		goto out;
+
+	/* for target == NULL check all supported */
+	if (!target && (strcmp(target_type, DM_CRYPT_TARGET) &&
+			strcmp(target_type, DM_VERITY_TARGET)))
+		goto out;
+	r = 0;
 out:
+	if (!r && status_line && !(*status_line = strdup(params)))
+		r = -ENOMEM;
+
 	if (dmt)
 		dm_task_destroy(dmt);
 
 	return r;
 }
 
-int dm_query_device(const char *name,
-		    char **device,
-		    uint64_t *size,
-		    uint64_t *skip,
-		    uint64_t *offset,
-		    char **cipher,
-		    int *key_size,
-		    char **key,
-		    int *read_only,
-		    int *suspended,
-		    char **uuid)
+int dm_status_device(struct crypt_device *cd, const char *name)
 {
-	struct dm_task *dmt;
+	int r;
 	struct dm_info dmi;
-	uint64_t start, length, val64;
-	char *target_type, *params, *rcipher, *key_, *rdevice, *endp, buffer[3], *tmp_uuid;
-	void *next = NULL;
-	int i, r = -EINVAL;
 
-	if (!(dmt = dm_task_create(DM_DEVICE_TABLE)))
-		goto out;
-	if (!dm_task_set_name(dmt, name))
-		goto out;
-	r = -ENODEV;
-	if (!dm_task_run(dmt))
-		goto out;
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+	r = dm_status_dmi(name, &dmi, NULL, NULL);
+	dm_exit_context();
+	if (r < 0)
+		return r;
 
-	r = -EINVAL;
-	if (!dm_task_get_info(dmt, &dmi))
-		goto out;
+	return (dmi.open_count > 0);
+}
 
-	if (!dmi.exists) {
-		r = -ENODEV;
-		goto out;
+int dm_status_suspended(struct crypt_device *cd, const char *name)
+{
+	int r;
+	struct dm_info dmi;
+
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+	r = dm_status_dmi(name, &dmi, DM_CRYPT_TARGET, NULL);
+	dm_exit_context();
+	if (r < 0)
+		return r;
+
+	return dmi.suspended ? 1 : 0;
+}
+
+static int _dm_status_verity_ok(const char *name)
+{
+	int r;
+	struct dm_info dmi;
+	char *status_line = NULL;
+
+	r = dm_status_dmi(name, &dmi, DM_VERITY_TARGET, &status_line);
+	if (r < 0 || !status_line) {
+		free(status_line);
+		return r;
 	}
 
-	next = dm_get_next_target(dmt, next, &start, &length,
-	                          &target_type, &params);
-	if (!target_type || strcmp(target_type, DM_CRYPT_TARGET) != 0 ||
-	    start != 0 || next)
-		goto out;
+	log_dbg("Verity volume %s status is %s.", name, status_line ?: "");
+	r = status_line[0] == 'V' ? 1 : 0;
+	free(status_line);
 
-	if (size)
-		*size = length;
+	return r;
+}
+
+int dm_status_verity_ok(struct crypt_device *cd, const char *name)
+{
+	int r;
+
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+	r = _dm_status_verity_ok(name);
+	dm_exit_context();
+	return r;
+}
+
+/* FIXME use hex wrapper, user val wrappers for line parsing */
+static int _dm_query_crypt(uint32_t get_flags,
+			   struct dm_info *dmi,
+			   char *params,
+			   struct crypt_dm_active_device *dmd)
+{
+	uint64_t val64;
+	char *rcipher, *key_, *rdevice, *endp, buffer[3], *arg;
+	unsigned int i;
+	int r;
+
+	memset(dmd, 0, sizeof(*dmd));
+	dmd->target = DM_CRYPT;
 
 	rcipher = strsep(&params, " ");
 	/* cipher */
-	if (cipher)
-		*cipher = strdup(rcipher);
+	if (get_flags & DM_ACTIVE_CRYPT_CIPHER)
+		dmd->u.crypt.cipher = strdup(rcipher);
 
 	/* skip */
 	key_ = strsep(&params, " ");
 	if (!params)
-		goto out;
+		return -EINVAL;
 	val64 = strtoull(params, &params, 10);
 	if (*params != ' ')
-		goto out;
+		return -EINVAL;
 	params++;
-	if (skip)
-		*skip = val64;
+
+	dmd->u.crypt.iv_offset = val64;
 
 	/* device */
 	rdevice = strsep(&params, " ");
-	if (device)
-		*device = lookup_dev(rdevice);
+	if (get_flags & DM_ACTIVE_DEVICE) {
+		arg = crypt_lookup_dev(rdevice);
+		r = device_alloc(&dmd->data_device, arg);
+		free(arg);
+		if (r < 0 && r != -ENOTBLK)
+			return r;
+	}
 
 	/*offset */
 	if (!params)
-		goto out;
+		return -EINVAL;
 	val64 = strtoull(params, &params, 10);
-	if (*params)
-		goto out;
-	if (offset)
-		*offset = val64;
+	dmd->u.crypt.offset = val64;
+
+	/* Features section, available since crypt target version 1.11 */
+	if (*params) {
+		if (*params != ' ')
+			return -EINVAL;
+		params++;
+
+		/* Number of arguments */
+		val64 = strtoull(params, &params, 10);
+		if (*params != ' ')
+			return -EINVAL;
+		params++;
+
+		for (i = 0; i < val64; i++) {
+			if (!params)
+				return -EINVAL;
+			arg = strsep(&params, " ");
+			if (!strcasecmp(arg, "allow_discards"))
+				dmd->flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
+			else /* unknown option */
+				return -EINVAL;
+		}
 
-	/* key_size */
-	if (key_size)
-		*key_size = strlen(key_) / 2;
+		/* All parameters shold be processed */
+		if (params)
+			return -EINVAL;
+	}
 
-	/* key */
-	if (key_size && key) {
-		*key = safe_alloc(*key_size);
-		if (!*key) {
-			r = -ENOMEM;
-			goto out;
-		}
+	/* Never allow to return empty key */
+	if ((get_flags & DM_ACTIVE_CRYPT_KEY) && dmi->suspended) {
+		log_dbg("Cannot read volume key while suspended.");
+		return -EINVAL;
+	}
 
-		buffer[2] = '\0';
-		for(i = 0; i < *key_size; i++) {
-			memcpy(buffer, &key_[i * 2], 2);
-			(*key)[i] = strtoul(buffer, &endp, 16);
-			if (endp != &buffer[2]) {
-				safe_free(key);
-				*key = NULL;
-				goto out;
+	if (get_flags & DM_ACTIVE_CRYPT_KEYSIZE) {
+		dmd->u.crypt.vk = crypt_alloc_volume_key(strlen(key_) / 2, NULL);
+		if (!dmd->u.crypt.vk)
+			return -ENOMEM;
+
+		if (get_flags & DM_ACTIVE_CRYPT_KEY) {
+			buffer[2] = '\0';
+			for(i = 0; i < dmd->u.crypt.vk->keylength; i++) {
+				memcpy(buffer, &key_[i * 2], 2);
+				dmd->u.crypt.vk->key[i] = strtoul(buffer, &endp, 16);
+				if (endp != &buffer[2]) {
+					crypt_free_volume_key(dmd->u.crypt.vk);
+					dmd->u.crypt.vk = NULL;
+					return -EINVAL;
+				}
 			}
 		}
 	}
 	memset(key_, 0, strlen(key_));
 
-	if (read_only)
-		*read_only = dmi.read_only;
+	return 0;
+}
+
+static int _dm_query_verity(uint32_t get_flags,
+			     struct dm_info *dmi,
+			     char *params,
+			     struct crypt_dm_active_device *dmd)
+{
+	struct crypt_params_verity *vp = NULL;
+	uint32_t val32;
+	uint64_t val64;
+	ssize_t len;
+	char *str, *str2;
+	int r;
+
+	if (get_flags & DM_ACTIVE_VERITY_PARAMS)
+		vp = dmd->u.verity.vp;
+
+	memset(dmd, 0, sizeof(*dmd));
+
+	dmd->target = DM_VERITY;
+	dmd->u.verity.vp = vp;
+
+	/* version */
+	val32 = strtoul(params, &params, 10);
+	if (*params != ' ')
+		return -EINVAL;
+	if (vp)
+		vp->hash_type = val32;
+	params++;
+
+	/* data device */
+	str = strsep(&params, " ");
+	if (!params)
+		return -EINVAL;
+	if (get_flags & DM_ACTIVE_DEVICE) {
+		str2 = crypt_lookup_dev(str);
+		r = device_alloc(&dmd->data_device, str2);
+		free(str2);
+		if (r < 0 && r != -ENOTBLK)
+			return r;
+	}
+
+	/* hash device */
+	str = strsep(&params, " ");
+	if (!params)
+		return -EINVAL;
+	if (get_flags & DM_ACTIVE_VERITY_HASH_DEVICE) {
+		str2 = crypt_lookup_dev(str);
+		r = device_alloc(&dmd->u.verity.hash_device, str2);
+		free(str2);
+		if (r < 0 && r != -ENOTBLK)
+			return r;
+	}
+
+	/* data block size*/
+	val32 = strtoul(params, &params, 10);
+	if (*params != ' ')
+		return -EINVAL;
+	if (vp)
+		vp->data_block_size = val32;
+	params++;
+
+	/* hash block size */
+	val32 = strtoul(params, &params, 10);
+	if (*params != ' ')
+		return -EINVAL;
+	if (vp)
+		vp->hash_block_size = val32;
+	params++;
+
+	/* data blocks */
+	val64 = strtoull(params, &params, 10);
+	if (*params != ' ')
+		return -EINVAL;
+	if (vp)
+		vp->data_size = val64;
+	params++;
+
+	/* hash start */
+	val64 = strtoull(params, &params, 10);
+	if (*params != ' ')
+		return -EINVAL;
+	dmd->u.verity.hash_offset = val64;
+	params++;
+
+	/* hash algorithm */
+	str = strsep(&params, " ");
+	if (!params)
+		return -EINVAL;
+	if (vp)
+		vp->hash_name = strdup(str);
+
+	/* root digest */
+	str = strsep(&params, " ");
+	if (!params)
+		return -EINVAL;
+	len = crypt_hex_to_bytes(str, &str2, 0);
+	if (len < 0)
+		return len;
+	dmd->u.verity.root_hash_size = len;
+	if (get_flags & DM_ACTIVE_VERITY_ROOT_HASH)
+		dmd->u.verity.root_hash = str2;
+	else
+		free(str2);
+
+	/* salt */
+	str = strsep(&params, " ");
+	if (params)
+		return -EINVAL;
+	if (vp) {
+		if (!strcmp(str, "-")) {
+			vp->salt_size = 0;
+			vp->salt = NULL;
+		} else {
+			len = crypt_hex_to_bytes(str, &str2, 0);
+			if (len < 0)
+				return len;
+			vp->salt_size = len;
+			vp->salt = str2;
+		}
+	}
+
+	return 0;
+}
+
+int dm_query_device(struct crypt_device *cd, const char *name,
+		    uint32_t get_flags, struct crypt_dm_active_device *dmd)
+{
+	struct dm_task *dmt;
+	struct dm_info dmi;
+	uint64_t start, length;
+	char *target_type, *params;
+	const char *tmp_uuid;
+	void *next = NULL;
+	int r = -EINVAL;
+
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+	if (!(dmt = dm_task_create(DM_DEVICE_TABLE)))
+		goto out;
+	if ((dm_flags() & DM_SECURE_SUPPORTED) && !dm_task_secure_data(dmt))
+		goto out;
+	if (!dm_task_set_name(dmt, name))
+		goto out;
+	r = -ENODEV;
+	if (!dm_task_run(dmt))
+		goto out;
+
+	r = -EINVAL;
+	if (!dm_task_get_info(dmt, &dmi))
+		goto out;
+
+	if (!dmi.exists) {
+		r = -ENODEV;
+		goto out;
+	}
+
+	next = dm_get_next_target(dmt, next, &start, &length,
+	                          &target_type, &params);
+
+	if (!target_type || start != 0 || next)
+		goto out;
+
+	if (!strcmp(target_type, DM_CRYPT_TARGET)) {
+		r = _dm_query_crypt(get_flags, &dmi, params, dmd);
+	} else if (!strcmp(target_type, DM_VERITY_TARGET)) {
+		r = _dm_query_verity(get_flags, &dmi, params, dmd);
+		if (r < 0)
+			goto out;
+		r = _dm_status_verity_ok(name);
+		if (r < 0)
+			goto out;
+		if (r == 0)
+			dmd->flags |= CRYPT_ACTIVATE_CORRUPTED;
+		r = 0;
+	} else
+		r = -EINVAL;
 
-	if (suspended)
-		*suspended = dmi.suspended;
+	if (r < 0)
+		goto out;
+
+	dmd->size = length;
 
-	if (uuid && (tmp_uuid = (char*)dm_task_get_uuid(dmt)) &&
-	    !strncmp(tmp_uuid, DM_UUID_PREFIX, DM_UUID_PREFIX_LEN))
-		*uuid = strdup(tmp_uuid + DM_UUID_PREFIX_LEN);
+	if (dmi.read_only)
+		dmd->flags |= CRYPT_ACTIVATE_READONLY;
+
+	tmp_uuid = dm_task_get_uuid(dmt);
+	if (!tmp_uuid)
+		dmd->flags |= CRYPT_ACTIVATE_NO_UUID;
+	else if (get_flags & DM_ACTIVE_UUID) {
+		if (!strncmp(tmp_uuid, DM_UUID_PREFIX, DM_UUID_PREFIX_LEN))
+			dmd->uuid = strdup(tmp_uuid + DM_UUID_PREFIX_LEN);
+	}
 
 	r = (dmi.open_count > 0);
 out:
 	if (dmt)
 		dm_task_destroy(dmt);
 
+	dm_exit_context();
 	return r;
 }
 
@@ -635,6 +1061,9 @@ static int _dm_message(const char *name, const char *msg)
 	if (!(dmt = dm_task_create(DM_DEVICE_TARGET_MSG)))
 		return 0;
 
+	if ((dm_flags() & DM_SECURE_SUPPORTED) && !dm_task_secure_data(dmt))
+		goto out;
+
 	if (name && !dm_task_set_name(dmt, name))
 		goto out;
 
@@ -651,40 +1080,63 @@ static int _dm_message(const char *name, const char *msg)
 	return r;
 }
 
-int dm_suspend_and_wipe_key(const char *name)
+int dm_suspend_and_wipe_key(struct crypt_device *cd, const char *name)
 {
-	if (!_dm_simple(DM_DEVICE_SUSPEND, name, 0))
-		return -EINVAL;
+	int r = -ENOTSUP;
+
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+
+	if (!(_dm_crypt_flags & DM_KEY_WIPE_SUPPORTED))
+		goto out;
+
+	if (!_dm_simple(DM_DEVICE_SUSPEND, name, 0)) {
+		r = -EINVAL;
+		goto out;
+	}
 
 	if (!_dm_message(name, "key wipe")) {
 		_dm_simple(DM_DEVICE_RESUME, name, 1);
-		return -EINVAL;
+		r = -EINVAL;
+		goto out;
 	}
-
-	return 0;
+	r = 0;
+out:
+	dm_exit_context();
+	return r;
 }
 
-int dm_resume_and_reinstate_key(const char *name,
-				size_t key_size,
-				const char *key)
+int dm_resume_and_reinstate_key(struct crypt_device *cd, const char *name,
+				size_t key_size, const char *key)
 {
 	int msg_size = key_size * 2 + 10; // key set <key>
-	char *msg;
-	int r = 0;
+	char *msg = NULL;
+	int r = -ENOTSUP;
 
-	msg = safe_alloc(msg_size);
-	if (!msg)
-		return -ENOMEM;
+	if (dm_init_context(cd))
+		return -ENOTSUP;
+
+	if (!(_dm_crypt_flags & DM_KEY_WIPE_SUPPORTED))
+		goto out;
+
+	msg = crypt_safe_alloc(msg_size);
+	if (!msg) {
+		r = -ENOMEM;
+		goto out;
+	}
 
-	memset(msg, 0, msg_size);
 	strcpy(msg, "key set ");
 	hex_key(&msg[8], key_size, key);
 
 	if (!_dm_message(name, msg) ||
-	    !_dm_simple(DM_DEVICE_RESUME, name, 1))
+	    !_dm_simple(DM_DEVICE_RESUME, name, 1)) {
 		r = -EINVAL;
-
-	safe_free(msg);
+		goto out;
+	}
+	r = 0;
+out:
+	crypt_safe_free(msg);
+	dm_exit_context();
 	return r;
 }
 
@@ -692,3 +1144,13 @@ const char *dm_get_dir(void)
 {
 	return dm_dir();
 }
+
+int dm_is_dm_device(int major, int minor)
+{
+	return dm_is_dm_major((uint32_t)major);
+}
+
+int dm_is_dm_kernel_name(const char *name)
+{
+	return strncmp(name, "dm-", 3) ? 0 : 1;
+}