1 /* $OpenBSD: uvm_swap_encrypt.c,v 1.16 2010/04/20 22:05:44 tedu Exp $ */ 2 3 /* 4 * Copyright 1999 Niels Provos <provos@citi.umich.edu> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by Niels Provos. 18 * 4. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/kernel.h> 36 #include <sys/malloc.h> 37 #include <sys/proc.h> 38 #include <sys/sysctl.h> 39 #include <sys/time.h> 40 #include <sys/conf.h> 41 #include <dev/rndvar.h> 42 #include <crypto/rijndael.h> 43 44 #include <uvm/uvm.h> 45 46 struct swap_key *kcur = NULL; 47 rijndael_ctx swap_ctxt; 48 49 int uvm_doswapencrypt = 1; 50 u_int uvm_swpkeyscreated = 0; 51 u_int uvm_swpkeysdeleted = 0; 52 53 int swap_encrypt_initialized = 0; 54 55 int 56 swap_encrypt_ctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, 57 void *newp, size_t newlen, struct proc *p) 58 { 59 /* all sysctl names at this level are terminal */ 60 if (namelen != 1) 61 return (ENOTDIR); /* overloaded */ 62 63 switch (name[0]) { 64 case SWPENC_ENABLE: { 65 int doencrypt = uvm_doswapencrypt; 66 int result; 67 68 result = sysctl_int(oldp, oldlenp, newp, newlen, &doencrypt); 69 if (result) 70 return result; 71 72 /* 73 * Swap Encryption has been turned on, we need to 74 * initialize state for swap devices that have been 75 * added. 76 */ 77 if (doencrypt) 78 uvm_swap_initcrypt_all(); 79 uvm_doswapencrypt = doencrypt; 80 return (0); 81 } 82 case SWPENC_CREATED: 83 return (sysctl_rdint(oldp, oldlenp, newp, uvm_swpkeyscreated)); 84 case SWPENC_DELETED: 85 return (sysctl_rdint(oldp, oldlenp, newp, uvm_swpkeysdeleted)); 86 default: 87 return (EOPNOTSUPP); 88 } 89 /* NOTREACHED */ 90 } 91 92 void 93 swap_key_delete(struct swap_key *key) 94 { 95 /* Make sure that this key gets removed if we just used it */ 96 swap_key_cleanup(key); 97 98 memset(key, 0, sizeof(*key)); 99 uvm_swpkeysdeleted++; 100 } 101 102 /* 103 * Encrypt the data before it goes to swap, the size should be 64-bit 104 * aligned. 105 */ 106 107 void 108 swap_encrypt(struct swap_key *key, caddr_t src, caddr_t dst, u_int64_t block, 109 size_t count) 110 { 111 u_int32_t *dsrc = (u_int32_t *)src; 112 u_int32_t *ddst = (u_int32_t *)dst; 113 u_int32_t iv[4]; 114 u_int32_t iv1, iv2, iv3, iv4; 115 116 if (!swap_encrypt_initialized) 117 swap_encrypt_initialized = 1; 118 119 swap_key_prepare(key, 1); 120 121 count /= sizeof(u_int32_t); 122 123 iv[0] = block >> 32; iv[1] = block; iv[2] = ~iv[0]; iv[3] = ~iv[1]; 124 rijndael_encrypt(&swap_ctxt, (u_char *)iv, (u_char *)iv); 125 iv1 = iv[0]; iv2 = iv[1]; iv3 = iv[2]; iv4 = iv[3]; 126 127 for (; count > 0; count -= 4) { 128 ddst[0] = dsrc[0] ^ iv1; 129 ddst[1] = dsrc[1] ^ iv2; 130 ddst[2] = dsrc[2] ^ iv3; 131 ddst[3] = dsrc[3] ^ iv4; 132 /* 133 * Do not worry about endianess, it only needs to decrypt 134 * on this machine. 135 */ 136 rijndael_encrypt(&swap_ctxt, (u_char *)ddst, (u_char *)ddst); 137 iv1 = ddst[0]; 138 iv2 = ddst[1]; 139 iv3 = ddst[2]; 140 iv4 = ddst[3]; 141 142 dsrc += 4; 143 ddst += 4; 144 } 145 } 146 147 /* 148 * Decrypt the data after we retrieved it from swap, the size should be 64-bit 149 * aligned. 150 */ 151 152 void 153 swap_decrypt(struct swap_key *key, caddr_t src, caddr_t dst, u_int64_t block, 154 size_t count) 155 { 156 u_int32_t *dsrc = (u_int32_t *)src; 157 u_int32_t *ddst = (u_int32_t *)dst; 158 u_int32_t iv[4]; 159 u_int32_t iv1, iv2, iv3, iv4, niv1, niv2, niv3, niv4; 160 161 if (!swap_encrypt_initialized) 162 panic("swap_decrypt: key not initialized"); 163 164 swap_key_prepare(key, 0); 165 166 count /= sizeof(u_int32_t); 167 168 iv[0] = block >> 32; iv[1] = block; iv[2] = ~iv[0]; iv[3] = ~iv[1]; 169 rijndael_encrypt(&swap_ctxt, (u_char *)iv, (u_char *)iv); 170 iv1 = iv[0]; iv2 = iv[1]; iv3 = iv[2]; iv4 = iv[3]; 171 172 for (; count > 0; count -= 4) { 173 ddst[0] = niv1 = dsrc[0]; 174 ddst[1] = niv2 = dsrc[1]; 175 ddst[2] = niv3 = dsrc[2]; 176 ddst[3] = niv4 = dsrc[3]; 177 rijndael_decrypt(&swap_ctxt, (u_char *)ddst, (u_char *)ddst); 178 ddst[0] ^= iv1; 179 ddst[1] ^= iv2; 180 ddst[2] ^= iv3; 181 ddst[3] ^= iv4; 182 183 iv1 = niv1; 184 iv2 = niv2; 185 iv3 = niv3; 186 iv4 = niv4; 187 188 dsrc += 4; 189 ddst += 4; 190 } 191 } 192 193 void 194 swap_key_prepare(struct swap_key *key, int encrypt) 195 { 196 /* 197 * Check if we have prepared for this key already, 198 * if we only have the encryption schedule, we have 199 * to recompute and get the decryption schedule also. 200 */ 201 if (kcur == key && (encrypt || !swap_ctxt.enc_only)) 202 return; 203 204 if (encrypt) 205 rijndael_set_key_enc_only(&swap_ctxt, (u_char *)key->key, 206 sizeof(key->key) * 8); 207 else 208 rijndael_set_key(&swap_ctxt, (u_char *)key->key, 209 sizeof(key->key) * 8); 210 211 kcur = key; 212 } 213 214 /* 215 * Make sure that a specific key is no longer available. 216 */ 217 218 void 219 swap_key_cleanup(struct swap_key *key) 220 { 221 /* Check if we have a key */ 222 if (kcur == NULL || kcur != key) 223 return; 224 225 /* Zero out the subkeys */ 226 memset(&swap_ctxt, 0, sizeof(swap_ctxt)); 227 228 kcur = NULL; 229 } 230