1*59c8e88eSDag-Erling Smørgrav/* $OpenBSD: softraid_crypto.c,v 1.104 2014/01/21 04:23:14 jsing Exp $ */
2*59c8e88eSDag-Erling Smørgrav/*
3*59c8e88eSDag-Erling Smørgrav * Copyright (c) 2007 Marco Peereboom <marco@peereboom.us>
4*59c8e88eSDag-Erling Smørgrav * Copyright (c) 2008 Hans-Joerg Hoexer <hshoexer@openbsd.org>
5*59c8e88eSDag-Erling Smørgrav * Copyright (c) 2008 Damien Miller <djm@mindrot.org>
6*59c8e88eSDag-Erling Smørgrav * Copyright (c) 2009 Joel Sing <jsing@openbsd.org>
7*59c8e88eSDag-Erling Smørgrav *
8*59c8e88eSDag-Erling Smørgrav * Permission to use, copy, modify, and distribute this software for any
9*59c8e88eSDag-Erling Smørgrav * purpose with or without fee is hereby granted, provided that the above
10*59c8e88eSDag-Erling Smørgrav * copyright notice and this permission notice appear in all copies.
11*59c8e88eSDag-Erling Smørgrav *
12*59c8e88eSDag-Erling Smørgrav * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13*59c8e88eSDag-Erling Smørgrav * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14*59c8e88eSDag-Erling Smørgrav * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15*59c8e88eSDag-Erling Smørgrav * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16*59c8e88eSDag-Erling Smørgrav * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17*59c8e88eSDag-Erling Smørgrav * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18*59c8e88eSDag-Erling Smørgrav * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19*59c8e88eSDag-Erling Smørgrav */
20*59c8e88eSDag-Erling Smørgrav
21*59c8e88eSDag-Erling Smørgrav#include "bio.h"
22*59c8e88eSDag-Erling Smørgrav
23*59c8e88eSDag-Erling Smørgrav#include <sys/param.h>
24*59c8e88eSDag-Erling Smørgrav#include <sys/systm.h>
25*59c8e88eSDag-Erling Smørgrav#include <sys/buf.h>
26*59c8e88eSDag-Erling Smørgrav#include <sys/device.h>
27*59c8e88eSDag-Erling Smørgrav#include <sys/ioctl.h>
28*59c8e88eSDag-Erling Smørgrav#include <sys/proc.h>
29*59c8e88eSDag-Erling Smørgrav#include <sys/malloc.h>
30*59c8e88eSDag-Erling Smørgrav#include <sys/pool.h>
31*59c8e88eSDag-Erling Smørgrav#include <sys/kernel.h>
32*59c8e88eSDag-Erling Smørgrav#include <sys/disk.h>
33*59c8e88eSDag-Erling Smørgrav#include <sys/rwlock.h>
34*59c8e88eSDag-Erling Smørgrav#include <sys/queue.h>
35*59c8e88eSDag-Erling Smørgrav#include <sys/fcntl.h>
36*59c8e88eSDag-Erling Smørgrav#include <sys/disklabel.h>
37*59c8e88eSDag-Erling Smørgrav#include <sys/vnode.h>
38*59c8e88eSDag-Erling Smørgrav#include <sys/mount.h>
39*59c8e88eSDag-Erling Smørgrav#include <sys/sensors.h>
40*59c8e88eSDag-Erling Smørgrav#include <sys/stat.h>
41*59c8e88eSDag-Erling Smørgrav#include <sys/conf.h>
42*59c8e88eSDag-Erling Smørgrav#include <sys/uio.h>
43*59c8e88eSDag-Erling Smørgrav#include <sys/dkio.h>
44*59c8e88eSDag-Erling Smørgrav
45*59c8e88eSDag-Erling Smørgrav#include <crypto/cryptodev.h>
46*59c8e88eSDag-Erling Smørgrav#include <crypto/cryptosoft.h>
47*59c8e88eSDag-Erling Smørgrav#include <crypto/rijndael.h>
48*59c8e88eSDag-Erling Smørgrav#include <crypto/md5.h>
49*59c8e88eSDag-Erling Smørgrav#include <crypto/sha1.h>
50*59c8e88eSDag-Erling Smørgrav#include <crypto/sha2.h>
51*59c8e88eSDag-Erling Smørgrav#include <crypto/hmac.h>
52*59c8e88eSDag-Erling Smørgrav
53*59c8e88eSDag-Erling Smørgrav#include <scsi/scsi_all.h>
54*59c8e88eSDag-Erling Smørgrav#include <scsi/scsiconf.h>
55*59c8e88eSDag-Erling Smørgrav#include <scsi/scsi_disk.h>
56*59c8e88eSDag-Erling Smørgrav
57*59c8e88eSDag-Erling Smørgrav#include <dev/softraidvar.h>
58*59c8e88eSDag-Erling Smørgrav#include <dev/rndvar.h>
59*59c8e88eSDag-Erling Smørgrav
60*59c8e88eSDag-Erling Smørgrav/*
61*59c8e88eSDag-Erling Smørgrav * The per-I/O data that we need to preallocate. We cannot afford to allow I/O
62*59c8e88eSDag-Erling Smørgrav * to start failing when memory pressure kicks in. We can store this in the WU
63*59c8e88eSDag-Erling Smørgrav * because we assert that only one ccb per WU will ever be active.
64*59c8e88eSDag-Erling Smørgrav */
65*59c8e88eSDag-Erling Smørgravstruct sr_crypto_wu {
66*59c8e88eSDag-Erling Smørgrav	TAILQ_ENTRY(sr_crypto_wu)	 cr_link;
67*59c8e88eSDag-Erling Smørgrav	struct uio			 cr_uio;
68*59c8e88eSDag-Erling Smørgrav	struct iovec			 cr_iov;
69*59c8e88eSDag-Erling Smørgrav	struct cryptop	 		*cr_crp;
70*59c8e88eSDag-Erling Smørgrav	struct cryptodesc		*cr_descs;
71*59c8e88eSDag-Erling Smørgrav	struct sr_workunit		*cr_wu;
72*59c8e88eSDag-Erling Smørgrav	void				*cr_dmabuf;
73*59c8e88eSDag-Erling Smørgrav};
74*59c8e88eSDag-Erling Smørgrav
75*59c8e88eSDag-Erling Smørgrav
76*59c8e88eSDag-Erling Smørgravstruct sr_crypto_wu *sr_crypto_wu_get(struct sr_workunit *, int);
77*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_wu_put(struct sr_crypto_wu *);
78*59c8e88eSDag-Erling Smørgravint		sr_crypto_create_keys(struct sr_discipline *);
79*59c8e88eSDag-Erling Smørgravint		sr_crypto_get_kdf(struct bioc_createraid *,
80*59c8e88eSDag-Erling Smørgrav		    struct sr_discipline *);
81*59c8e88eSDag-Erling Smørgravint		sr_crypto_decrypt(u_char *, u_char *, u_char *, size_t, int);
82*59c8e88eSDag-Erling Smørgravint		sr_crypto_encrypt(u_char *, u_char *, u_char *, size_t, int);
83*59c8e88eSDag-Erling Smørgravint		sr_crypto_decrypt_key(struct sr_discipline *);
84*59c8e88eSDag-Erling Smørgravint		sr_crypto_change_maskkey(struct sr_discipline *,
85*59c8e88eSDag-Erling Smørgrav		    struct sr_crypto_kdfinfo *, struct sr_crypto_kdfinfo *);
86*59c8e88eSDag-Erling Smørgravint		sr_crypto_create(struct sr_discipline *,
87*59c8e88eSDag-Erling Smørgrav		    struct bioc_createraid *, int, int64_t);
88*59c8e88eSDag-Erling Smørgravint		sr_crypto_assemble(struct sr_discipline *,
89*59c8e88eSDag-Erling Smørgrav		    struct bioc_createraid *, int, void *);
90*59c8e88eSDag-Erling Smørgravint		sr_crypto_alloc_resources(struct sr_discipline *);
91*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_free_resources(struct sr_discipline *);
92*59c8e88eSDag-Erling Smørgravint		sr_crypto_ioctl(struct sr_discipline *,
93*59c8e88eSDag-Erling Smørgrav		    struct bioc_discipline *);
94*59c8e88eSDag-Erling Smørgravint		sr_crypto_meta_opt_handler(struct sr_discipline *,
95*59c8e88eSDag-Erling Smørgrav		    struct sr_meta_opt_hdr *);
96*59c8e88eSDag-Erling Smørgravint		sr_crypto_write(struct cryptop *);
97*59c8e88eSDag-Erling Smørgravint		sr_crypto_rw(struct sr_workunit *);
98*59c8e88eSDag-Erling Smørgravint		sr_crypto_dev_rw(struct sr_workunit *, struct sr_crypto_wu *);
99*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_done(struct sr_workunit *);
100*59c8e88eSDag-Erling Smørgravint		sr_crypto_read(struct cryptop *);
101*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_finish_io(struct sr_workunit *);
102*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_calculate_check_hmac_sha1(u_int8_t *, int,
103*59c8e88eSDag-Erling Smørgrav		   u_int8_t *, int, u_char *);
104*59c8e88eSDag-Erling Smørgravvoid		sr_crypto_hotplug(struct sr_discipline *, struct disk *, int);
105*59c8e88eSDag-Erling Smørgrav
106*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG0
107*59c8e88eSDag-Erling Smørgravvoid		 sr_crypto_dumpkeys(struct sr_discipline *);
108*59c8e88eSDag-Erling Smørgrav#endif
109*59c8e88eSDag-Erling Smørgrav
110*59c8e88eSDag-Erling Smørgrav/* Discipline initialisation. */
111*59c8e88eSDag-Erling Smørgravvoid
112*59c8e88eSDag-Erling Smørgravsr_crypto_discipline_init(struct sr_discipline *sd)
113*59c8e88eSDag-Erling Smørgrav{
114*59c8e88eSDag-Erling Smørgrav	int i;
115*59c8e88eSDag-Erling Smørgrav
116*59c8e88eSDag-Erling Smørgrav	/* Fill out discipline members. */
117*59c8e88eSDag-Erling Smørgrav	sd->sd_type = SR_MD_CRYPTO;
118*59c8e88eSDag-Erling Smørgrav	strlcpy(sd->sd_name, "CRYPTO", sizeof(sd->sd_name));
119*59c8e88eSDag-Erling Smørgrav	sd->sd_capabilities = SR_CAP_SYSTEM_DISK | SR_CAP_AUTO_ASSEMBLE;
120*59c8e88eSDag-Erling Smørgrav	sd->sd_max_wu = SR_CRYPTO_NOWU;
121*59c8e88eSDag-Erling Smørgrav
122*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < SR_CRYPTO_MAXKEYS; i++)
123*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
124*59c8e88eSDag-Erling Smørgrav
125*59c8e88eSDag-Erling Smørgrav	/* Setup discipline specific function pointers. */
126*59c8e88eSDag-Erling Smørgrav	sd->sd_alloc_resources = sr_crypto_alloc_resources;
127*59c8e88eSDag-Erling Smørgrav	sd->sd_assemble = sr_crypto_assemble;
128*59c8e88eSDag-Erling Smørgrav	sd->sd_create = sr_crypto_create;
129*59c8e88eSDag-Erling Smørgrav	sd->sd_free_resources = sr_crypto_free_resources;
130*59c8e88eSDag-Erling Smørgrav	sd->sd_ioctl_handler = sr_crypto_ioctl;
131*59c8e88eSDag-Erling Smørgrav	sd->sd_meta_opt_handler = sr_crypto_meta_opt_handler;
132*59c8e88eSDag-Erling Smørgrav	sd->sd_scsi_rw = sr_crypto_rw;
133*59c8e88eSDag-Erling Smørgrav	sd->sd_scsi_done = sr_crypto_done;
134*59c8e88eSDag-Erling Smørgrav}
135*59c8e88eSDag-Erling Smørgrav
136*59c8e88eSDag-Erling Smørgravint
137*59c8e88eSDag-Erling Smørgravsr_crypto_create(struct sr_discipline *sd, struct bioc_createraid *bc,
138*59c8e88eSDag-Erling Smørgrav    int no_chunk, int64_t coerced_size)
139*59c8e88eSDag-Erling Smørgrav{
140*59c8e88eSDag-Erling Smørgrav	struct sr_meta_opt_item	*omi;
141*59c8e88eSDag-Erling Smørgrav	int			rv = EINVAL;
142*59c8e88eSDag-Erling Smørgrav
143*59c8e88eSDag-Erling Smørgrav	if (no_chunk != 1) {
144*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "%s requires exactly one chunk",
145*59c8e88eSDag-Erling Smørgrav		    sd->sd_name);
146*59c8e88eSDag-Erling Smørgrav		goto done;
147*59c8e88eSDag-Erling Smørgrav        }
148*59c8e88eSDag-Erling Smørgrav
149*59c8e88eSDag-Erling Smørgrav	/* Create crypto optional metadata. */
150*59c8e88eSDag-Erling Smørgrav	omi = malloc(sizeof(struct sr_meta_opt_item), M_DEVBUF,
151*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
152*59c8e88eSDag-Erling Smørgrav	omi->omi_som = malloc(sizeof(struct sr_meta_crypto), M_DEVBUF,
153*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
154*59c8e88eSDag-Erling Smørgrav	omi->omi_som->som_type = SR_OPT_CRYPTO;
155*59c8e88eSDag-Erling Smørgrav	omi->omi_som->som_length = sizeof(struct sr_meta_crypto);
156*59c8e88eSDag-Erling Smørgrav	SLIST_INSERT_HEAD(&sd->sd_meta_opt, omi, omi_link);
157*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta = (struct sr_meta_crypto *)omi->omi_som;
158*59c8e88eSDag-Erling Smørgrav	sd->sd_meta->ssdi.ssd_opt_no++;
159*59c8e88eSDag-Erling Smørgrav
160*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.key_disk = NULL;
161*59c8e88eSDag-Erling Smørgrav
162*59c8e88eSDag-Erling Smørgrav	if (bc->bc_key_disk != NODEV) {
163*59c8e88eSDag-Erling Smørgrav
164*59c8e88eSDag-Erling Smørgrav		/* Create a key disk. */
165*59c8e88eSDag-Erling Smørgrav		if (sr_crypto_get_kdf(bc, sd))
166*59c8e88eSDag-Erling Smørgrav			goto done;
167*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.key_disk =
168*59c8e88eSDag-Erling Smørgrav		    sr_crypto_create_key_disk(sd, bc->bc_key_disk);
169*59c8e88eSDag-Erling Smørgrav		if (sd->mds.mdd_crypto.key_disk == NULL)
170*59c8e88eSDag-Erling Smørgrav			goto done;
171*59c8e88eSDag-Erling Smørgrav		sd->sd_capabilities |= SR_CAP_AUTO_ASSEMBLE;
172*59c8e88eSDag-Erling Smørgrav
173*59c8e88eSDag-Erling Smørgrav	} else if (bc->bc_opaque_flags & BIOC_SOOUT) {
174*59c8e88eSDag-Erling Smørgrav
175*59c8e88eSDag-Erling Smørgrav		/* No hint available yet. */
176*59c8e88eSDag-Erling Smørgrav		bc->bc_opaque_status = BIOC_SOINOUT_FAILED;
177*59c8e88eSDag-Erling Smørgrav		rv = EAGAIN;
178*59c8e88eSDag-Erling Smørgrav		goto done;
179*59c8e88eSDag-Erling Smørgrav
180*59c8e88eSDag-Erling Smørgrav	} else if (sr_crypto_get_kdf(bc, sd))
181*59c8e88eSDag-Erling Smørgrav		goto done;
182*59c8e88eSDag-Erling Smørgrav
183*59c8e88eSDag-Erling Smørgrav	/* Passphrase volumes cannot be automatically assembled. */
184*59c8e88eSDag-Erling Smørgrav	if (!(bc->bc_flags & BIOC_SCNOAUTOASSEMBLE) && bc->bc_key_disk == NODEV)
185*59c8e88eSDag-Erling Smørgrav		goto done;
186*59c8e88eSDag-Erling Smørgrav
187*59c8e88eSDag-Erling Smørgrav	sd->sd_meta->ssdi.ssd_size = coerced_size;
188*59c8e88eSDag-Erling Smørgrav
189*59c8e88eSDag-Erling Smørgrav	sr_crypto_create_keys(sd);
190*59c8e88eSDag-Erling Smørgrav
191*59c8e88eSDag-Erling Smørgrav	sd->sd_max_ccb_per_wu = no_chunk;
192*59c8e88eSDag-Erling Smørgrav
193*59c8e88eSDag-Erling Smørgrav	rv = 0;
194*59c8e88eSDag-Erling Smørgravdone:
195*59c8e88eSDag-Erling Smørgrav	return (rv);
196*59c8e88eSDag-Erling Smørgrav}
197*59c8e88eSDag-Erling Smørgrav
198*59c8e88eSDag-Erling Smørgravint
199*59c8e88eSDag-Erling Smørgravsr_crypto_assemble(struct sr_discipline *sd, struct bioc_createraid *bc,
200*59c8e88eSDag-Erling Smørgrav    int no_chunk, void *data)
201*59c8e88eSDag-Erling Smørgrav{
202*59c8e88eSDag-Erling Smørgrav	int	rv = EINVAL;
203*59c8e88eSDag-Erling Smørgrav
204*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.key_disk = NULL;
205*59c8e88eSDag-Erling Smørgrav
206*59c8e88eSDag-Erling Smørgrav	/* Crypto optional metadata must already exist... */
207*59c8e88eSDag-Erling Smørgrav	if (sd->mds.mdd_crypto.scr_meta == NULL)
208*59c8e88eSDag-Erling Smørgrav		goto done;
209*59c8e88eSDag-Erling Smørgrav
210*59c8e88eSDag-Erling Smørgrav	if (data != NULL) {
211*59c8e88eSDag-Erling Smørgrav		/* Kernel already has mask key. */
212*59c8e88eSDag-Erling Smørgrav		bcopy(data, sd->mds.mdd_crypto.scr_maskkey,
213*59c8e88eSDag-Erling Smørgrav		    sizeof(sd->mds.mdd_crypto.scr_maskkey));
214*59c8e88eSDag-Erling Smørgrav	} else if (bc->bc_key_disk != NODEV) {
215*59c8e88eSDag-Erling Smørgrav		/* Read the mask key from the key disk. */
216*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.key_disk =
217*59c8e88eSDag-Erling Smørgrav		    sr_crypto_read_key_disk(sd, bc->bc_key_disk);
218*59c8e88eSDag-Erling Smørgrav		if (sd->mds.mdd_crypto.key_disk == NULL)
219*59c8e88eSDag-Erling Smørgrav			goto done;
220*59c8e88eSDag-Erling Smørgrav	} else if (bc->bc_opaque_flags & BIOC_SOOUT) {
221*59c8e88eSDag-Erling Smørgrav		/* provide userland with kdf hint */
222*59c8e88eSDag-Erling Smørgrav		if (bc->bc_opaque == NULL)
223*59c8e88eSDag-Erling Smørgrav			goto done;
224*59c8e88eSDag-Erling Smørgrav
225*59c8e88eSDag-Erling Smørgrav		if (sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint) <
226*59c8e88eSDag-Erling Smørgrav		    bc->bc_opaque_size)
227*59c8e88eSDag-Erling Smørgrav			goto done;
228*59c8e88eSDag-Erling Smørgrav
229*59c8e88eSDag-Erling Smørgrav		if (copyout(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
230*59c8e88eSDag-Erling Smørgrav		    bc->bc_opaque, bc->bc_opaque_size))
231*59c8e88eSDag-Erling Smørgrav			goto done;
232*59c8e88eSDag-Erling Smørgrav
233*59c8e88eSDag-Erling Smørgrav		/* we're done */
234*59c8e88eSDag-Erling Smørgrav		bc->bc_opaque_status = BIOC_SOINOUT_OK;
235*59c8e88eSDag-Erling Smørgrav		rv = EAGAIN;
236*59c8e88eSDag-Erling Smørgrav		goto done;
237*59c8e88eSDag-Erling Smørgrav	} else if (bc->bc_opaque_flags & BIOC_SOIN) {
238*59c8e88eSDag-Erling Smørgrav		/* get kdf with maskkey from userland */
239*59c8e88eSDag-Erling Smørgrav		if (sr_crypto_get_kdf(bc, sd))
240*59c8e88eSDag-Erling Smørgrav			goto done;
241*59c8e88eSDag-Erling Smørgrav	} else
242*59c8e88eSDag-Erling Smørgrav		goto done;
243*59c8e88eSDag-Erling Smørgrav
244*59c8e88eSDag-Erling Smørgrav	sd->sd_max_ccb_per_wu = sd->sd_meta->ssdi.ssd_chunk_no;
245*59c8e88eSDag-Erling Smørgrav
246*59c8e88eSDag-Erling Smørgrav	rv = 0;
247*59c8e88eSDag-Erling Smørgravdone:
248*59c8e88eSDag-Erling Smørgrav	return (rv);
249*59c8e88eSDag-Erling Smørgrav}
250*59c8e88eSDag-Erling Smørgrav
251*59c8e88eSDag-Erling Smørgravstruct sr_crypto_wu *
252*59c8e88eSDag-Erling Smørgravsr_crypto_wu_get(struct sr_workunit *wu, int encrypt)
253*59c8e88eSDag-Erling Smørgrav{
254*59c8e88eSDag-Erling Smørgrav	struct scsi_xfer	*xs = wu->swu_xs;
255*59c8e88eSDag-Erling Smørgrav	struct sr_discipline	*sd = wu->swu_dis;
256*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu;
257*59c8e88eSDag-Erling Smørgrav	struct cryptodesc	*crd;
258*59c8e88eSDag-Erling Smørgrav	int			flags, i, n;
259*59c8e88eSDag-Erling Smørgrav	daddr_t			blk;
260*59c8e88eSDag-Erling Smørgrav	u_int			keyndx;
261*59c8e88eSDag-Erling Smørgrav
262*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_wu_get wu %p encrypt %d\n",
263*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc), wu, encrypt);
264*59c8e88eSDag-Erling Smørgrav
265*59c8e88eSDag-Erling Smørgrav	mtx_enter(&sd->mds.mdd_crypto.scr_mutex);
266*59c8e88eSDag-Erling Smørgrav	if ((crwu = TAILQ_FIRST(&sd->mds.mdd_crypto.scr_wus)) != NULL)
267*59c8e88eSDag-Erling Smørgrav		TAILQ_REMOVE(&sd->mds.mdd_crypto.scr_wus, crwu, cr_link);
268*59c8e88eSDag-Erling Smørgrav	mtx_leave(&sd->mds.mdd_crypto.scr_mutex);
269*59c8e88eSDag-Erling Smørgrav	if (crwu == NULL)
270*59c8e88eSDag-Erling Smørgrav		panic("sr_crypto_wu_get: out of work units");
271*59c8e88eSDag-Erling Smørgrav
272*59c8e88eSDag-Erling Smørgrav	crwu->cr_uio.uio_iovcnt = 1;
273*59c8e88eSDag-Erling Smørgrav	crwu->cr_uio.uio_iov->iov_len = xs->datalen;
274*59c8e88eSDag-Erling Smørgrav	if (xs->flags & SCSI_DATA_OUT) {
275*59c8e88eSDag-Erling Smørgrav		crwu->cr_uio.uio_iov->iov_base = crwu->cr_dmabuf;
276*59c8e88eSDag-Erling Smørgrav		bcopy(xs->data, crwu->cr_uio.uio_iov->iov_base, xs->datalen);
277*59c8e88eSDag-Erling Smørgrav	} else
278*59c8e88eSDag-Erling Smørgrav		crwu->cr_uio.uio_iov->iov_base = xs->data;
279*59c8e88eSDag-Erling Smørgrav
280*59c8e88eSDag-Erling Smørgrav	blk = wu->swu_blk_start;
281*59c8e88eSDag-Erling Smørgrav	n = xs->datalen >> DEV_BSHIFT;
282*59c8e88eSDag-Erling Smørgrav
283*59c8e88eSDag-Erling Smørgrav	/*
284*59c8e88eSDag-Erling Smørgrav	 * We preallocated enough crypto descs for up to MAXPHYS of I/O.
285*59c8e88eSDag-Erling Smørgrav	 * Since there may be less than that we need to tweak the linked list
286*59c8e88eSDag-Erling Smørgrav	 * of crypto desc structures to be just long enough for our needs.
287*59c8e88eSDag-Erling Smørgrav	 */
288*59c8e88eSDag-Erling Smørgrav	crd = crwu->cr_descs;
289*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < ((MAXPHYS >> DEV_BSHIFT) - n); i++) {
290*59c8e88eSDag-Erling Smørgrav		crd = crd->crd_next;
291*59c8e88eSDag-Erling Smørgrav		KASSERT(crd);
292*59c8e88eSDag-Erling Smørgrav	}
293*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_desc = crd;
294*59c8e88eSDag-Erling Smørgrav	flags = (encrypt ? CRD_F_ENCRYPT : 0) |
295*59c8e88eSDag-Erling Smørgrav	    CRD_F_IV_PRESENT | CRD_F_IV_EXPLICIT;
296*59c8e88eSDag-Erling Smørgrav
297*59c8e88eSDag-Erling Smørgrav	/*
298*59c8e88eSDag-Erling Smørgrav	 * Select crypto session based on block number.
299*59c8e88eSDag-Erling Smørgrav	 *
300*59c8e88eSDag-Erling Smørgrav	 * XXX - this does not handle the case where the read/write spans
301*59c8e88eSDag-Erling Smørgrav	 * across a different key blocks (e.g. 0.5TB boundary). Currently
302*59c8e88eSDag-Erling Smørgrav	 * this is already broken by the use of scr_key[0] below.
303*59c8e88eSDag-Erling Smørgrav	 */
304*59c8e88eSDag-Erling Smørgrav	keyndx = blk >> SR_CRYPTO_KEY_BLKSHIFT;
305*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_sid = sd->mds.mdd_crypto.scr_sid[keyndx];
306*59c8e88eSDag-Erling Smørgrav
307*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_ilen = xs->datalen;
308*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_alloctype = M_DEVBUF;
309*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_buf = &crwu->cr_uio;
310*59c8e88eSDag-Erling Smørgrav	for (i = 0, crd = crwu->cr_crp->crp_desc; crd;
311*59c8e88eSDag-Erling Smørgrav	    i++, blk++, crd = crd->crd_next) {
312*59c8e88eSDag-Erling Smørgrav		crd->crd_skip = i << DEV_BSHIFT;
313*59c8e88eSDag-Erling Smørgrav		crd->crd_len = DEV_BSIZE;
314*59c8e88eSDag-Erling Smørgrav		crd->crd_inject = 0;
315*59c8e88eSDag-Erling Smørgrav		crd->crd_flags = flags;
316*59c8e88eSDag-Erling Smørgrav		crd->crd_alg = sd->mds.mdd_crypto.scr_alg;
317*59c8e88eSDag-Erling Smørgrav		crd->crd_klen = sd->mds.mdd_crypto.scr_klen;
318*59c8e88eSDag-Erling Smørgrav		crd->crd_key = sd->mds.mdd_crypto.scr_key[0];
319*59c8e88eSDag-Erling Smørgrav		bcopy(&blk, crd->crd_iv, sizeof(blk));
320*59c8e88eSDag-Erling Smørgrav	}
321*59c8e88eSDag-Erling Smørgrav	crwu->cr_wu = wu;
322*59c8e88eSDag-Erling Smørgrav	crwu->cr_crp->crp_opaque = crwu;
323*59c8e88eSDag-Erling Smørgrav
324*59c8e88eSDag-Erling Smørgrav	return (crwu);
325*59c8e88eSDag-Erling Smørgrav}
326*59c8e88eSDag-Erling Smørgrav
327*59c8e88eSDag-Erling Smørgravvoid
328*59c8e88eSDag-Erling Smørgravsr_crypto_wu_put(struct sr_crypto_wu *crwu)
329*59c8e88eSDag-Erling Smørgrav{
330*59c8e88eSDag-Erling Smørgrav	struct sr_workunit	*wu = crwu->cr_wu;
331*59c8e88eSDag-Erling Smørgrav	struct sr_discipline	*sd = wu->swu_dis;
332*59c8e88eSDag-Erling Smørgrav
333*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_wu_put crwu: %p\n",
334*59c8e88eSDag-Erling Smørgrav	    DEVNAME(wu->swu_dis->sd_sc), crwu);
335*59c8e88eSDag-Erling Smørgrav
336*59c8e88eSDag-Erling Smørgrav	mtx_enter(&sd->mds.mdd_crypto.scr_mutex);
337*59c8e88eSDag-Erling Smørgrav	TAILQ_INSERT_TAIL(&sd->mds.mdd_crypto.scr_wus, crwu, cr_link);
338*59c8e88eSDag-Erling Smørgrav	mtx_leave(&sd->mds.mdd_crypto.scr_mutex);
339*59c8e88eSDag-Erling Smørgrav}
340*59c8e88eSDag-Erling Smørgrav
341*59c8e88eSDag-Erling Smørgravint
342*59c8e88eSDag-Erling Smørgravsr_crypto_get_kdf(struct bioc_createraid *bc, struct sr_discipline *sd)
343*59c8e88eSDag-Erling Smørgrav{
344*59c8e88eSDag-Erling Smørgrav	int			rv = EINVAL;
345*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_kdfinfo *kdfinfo;
346*59c8e88eSDag-Erling Smørgrav
347*59c8e88eSDag-Erling Smørgrav	if (!(bc->bc_opaque_flags & BIOC_SOIN))
348*59c8e88eSDag-Erling Smørgrav		return (rv);
349*59c8e88eSDag-Erling Smørgrav	if (bc->bc_opaque == NULL)
350*59c8e88eSDag-Erling Smørgrav		return (rv);
351*59c8e88eSDag-Erling Smørgrav	if (bc->bc_opaque_size != sizeof(*kdfinfo))
352*59c8e88eSDag-Erling Smørgrav		return (rv);
353*59c8e88eSDag-Erling Smørgrav
354*59c8e88eSDag-Erling Smørgrav	kdfinfo = malloc(bc->bc_opaque_size, M_DEVBUF, M_WAITOK | M_ZERO);
355*59c8e88eSDag-Erling Smørgrav	if (copyin(bc->bc_opaque, kdfinfo, bc->bc_opaque_size))
356*59c8e88eSDag-Erling Smørgrav		goto out;
357*59c8e88eSDag-Erling Smørgrav
358*59c8e88eSDag-Erling Smørgrav	if (kdfinfo->len != bc->bc_opaque_size)
359*59c8e88eSDag-Erling Smørgrav		goto out;
360*59c8e88eSDag-Erling Smørgrav
361*59c8e88eSDag-Erling Smørgrav	/* copy KDF hint to disk meta data */
362*59c8e88eSDag-Erling Smørgrav	if (kdfinfo->flags & SR_CRYPTOKDF_HINT) {
363*59c8e88eSDag-Erling Smørgrav		if (sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint) <
364*59c8e88eSDag-Erling Smørgrav		    kdfinfo->genkdf.len)
365*59c8e88eSDag-Erling Smørgrav			goto out;
366*59c8e88eSDag-Erling Smørgrav		bcopy(&kdfinfo->genkdf,
367*59c8e88eSDag-Erling Smørgrav		    sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
368*59c8e88eSDag-Erling Smørgrav		    kdfinfo->genkdf.len);
369*59c8e88eSDag-Erling Smørgrav	}
370*59c8e88eSDag-Erling Smørgrav
371*59c8e88eSDag-Erling Smørgrav	/* copy mask key to run-time meta data */
372*59c8e88eSDag-Erling Smørgrav	if ((kdfinfo->flags & SR_CRYPTOKDF_KEY)) {
373*59c8e88eSDag-Erling Smørgrav		if (sizeof(sd->mds.mdd_crypto.scr_maskkey) <
374*59c8e88eSDag-Erling Smørgrav		    sizeof(kdfinfo->maskkey))
375*59c8e88eSDag-Erling Smørgrav			goto out;
376*59c8e88eSDag-Erling Smørgrav		bcopy(&kdfinfo->maskkey, sd->mds.mdd_crypto.scr_maskkey,
377*59c8e88eSDag-Erling Smørgrav		    sizeof(kdfinfo->maskkey));
378*59c8e88eSDag-Erling Smørgrav	}
379*59c8e88eSDag-Erling Smørgrav
380*59c8e88eSDag-Erling Smørgrav	bc->bc_opaque_status = BIOC_SOINOUT_OK;
381*59c8e88eSDag-Erling Smørgrav	rv = 0;
382*59c8e88eSDag-Erling Smørgravout:
383*59c8e88eSDag-Erling Smørgrav	explicit_bzero(kdfinfo, bc->bc_opaque_size);
384*59c8e88eSDag-Erling Smørgrav	free(kdfinfo, M_DEVBUF);
385*59c8e88eSDag-Erling Smørgrav
386*59c8e88eSDag-Erling Smørgrav	return (rv);
387*59c8e88eSDag-Erling Smørgrav}
388*59c8e88eSDag-Erling Smørgrav
389*59c8e88eSDag-Erling Smørgravint
390*59c8e88eSDag-Erling Smørgravsr_crypto_encrypt(u_char *p, u_char *c, u_char *key, size_t size, int alg)
391*59c8e88eSDag-Erling Smørgrav{
392*59c8e88eSDag-Erling Smørgrav	rijndael_ctx		ctx;
393*59c8e88eSDag-Erling Smørgrav	int			i, rv = 1;
394*59c8e88eSDag-Erling Smørgrav
395*59c8e88eSDag-Erling Smørgrav	switch (alg) {
396*59c8e88eSDag-Erling Smørgrav	case SR_CRYPTOM_AES_ECB_256:
397*59c8e88eSDag-Erling Smørgrav		if (rijndael_set_key_enc_only(&ctx, key, 256) != 0)
398*59c8e88eSDag-Erling Smørgrav			goto out;
399*59c8e88eSDag-Erling Smørgrav		for (i = 0; i < size; i += RIJNDAEL128_BLOCK_LEN)
400*59c8e88eSDag-Erling Smørgrav			rijndael_encrypt(&ctx, &p[i], &c[i]);
401*59c8e88eSDag-Erling Smørgrav		rv = 0;
402*59c8e88eSDag-Erling Smørgrav		break;
403*59c8e88eSDag-Erling Smørgrav	default:
404*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_DIS, "%s: unsupported encryption algorithm %d\n",
405*59c8e88eSDag-Erling Smørgrav		    "softraid", alg);
406*59c8e88eSDag-Erling Smørgrav		rv = -1;
407*59c8e88eSDag-Erling Smørgrav		goto out;
408*59c8e88eSDag-Erling Smørgrav	}
409*59c8e88eSDag-Erling Smørgrav
410*59c8e88eSDag-Erling Smørgravout:
411*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&ctx, sizeof(ctx));
412*59c8e88eSDag-Erling Smørgrav	return (rv);
413*59c8e88eSDag-Erling Smørgrav}
414*59c8e88eSDag-Erling Smørgrav
415*59c8e88eSDag-Erling Smørgravint
416*59c8e88eSDag-Erling Smørgravsr_crypto_decrypt(u_char *c, u_char *p, u_char *key, size_t size, int alg)
417*59c8e88eSDag-Erling Smørgrav{
418*59c8e88eSDag-Erling Smørgrav	rijndael_ctx		ctx;
419*59c8e88eSDag-Erling Smørgrav	int			i, rv = 1;
420*59c8e88eSDag-Erling Smørgrav
421*59c8e88eSDag-Erling Smørgrav	switch (alg) {
422*59c8e88eSDag-Erling Smørgrav	case SR_CRYPTOM_AES_ECB_256:
423*59c8e88eSDag-Erling Smørgrav		if (rijndael_set_key(&ctx, key, 256) != 0)
424*59c8e88eSDag-Erling Smørgrav			goto out;
425*59c8e88eSDag-Erling Smørgrav		for (i = 0; i < size; i += RIJNDAEL128_BLOCK_LEN)
426*59c8e88eSDag-Erling Smørgrav			rijndael_decrypt(&ctx, &c[i], &p[i]);
427*59c8e88eSDag-Erling Smørgrav		rv = 0;
428*59c8e88eSDag-Erling Smørgrav		break;
429*59c8e88eSDag-Erling Smørgrav	default:
430*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_DIS, "%s: unsupported encryption algorithm %d\n",
431*59c8e88eSDag-Erling Smørgrav		    "softraid", alg);
432*59c8e88eSDag-Erling Smørgrav		rv = -1;
433*59c8e88eSDag-Erling Smørgrav		goto out;
434*59c8e88eSDag-Erling Smørgrav	}
435*59c8e88eSDag-Erling Smørgrav
436*59c8e88eSDag-Erling Smørgravout:
437*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&ctx, sizeof(ctx));
438*59c8e88eSDag-Erling Smørgrav	return (rv);
439*59c8e88eSDag-Erling Smørgrav}
440*59c8e88eSDag-Erling Smørgrav
441*59c8e88eSDag-Erling Smørgravvoid
442*59c8e88eSDag-Erling Smørgravsr_crypto_calculate_check_hmac_sha1(u_int8_t *maskkey, int maskkey_size,
443*59c8e88eSDag-Erling Smørgrav    u_int8_t *key, int key_size, u_char *check_digest)
444*59c8e88eSDag-Erling Smørgrav{
445*59c8e88eSDag-Erling Smørgrav	u_char			check_key[SHA1_DIGEST_LENGTH];
446*59c8e88eSDag-Erling Smørgrav	HMAC_SHA1_CTX		hmacctx;
447*59c8e88eSDag-Erling Smørgrav	SHA1_CTX		shactx;
448*59c8e88eSDag-Erling Smørgrav
449*59c8e88eSDag-Erling Smørgrav	bzero(check_key, sizeof(check_key));
450*59c8e88eSDag-Erling Smørgrav	bzero(&hmacctx, sizeof(hmacctx));
451*59c8e88eSDag-Erling Smørgrav	bzero(&shactx, sizeof(shactx));
452*59c8e88eSDag-Erling Smørgrav
453*59c8e88eSDag-Erling Smørgrav	/* k = SHA1(mask_key) */
454*59c8e88eSDag-Erling Smørgrav	SHA1Init(&shactx);
455*59c8e88eSDag-Erling Smørgrav	SHA1Update(&shactx, maskkey, maskkey_size);
456*59c8e88eSDag-Erling Smørgrav	SHA1Final(check_key, &shactx);
457*59c8e88eSDag-Erling Smørgrav
458*59c8e88eSDag-Erling Smørgrav	/* mac = HMAC_SHA1_k(unencrypted key) */
459*59c8e88eSDag-Erling Smørgrav	HMAC_SHA1_Init(&hmacctx, check_key, sizeof(check_key));
460*59c8e88eSDag-Erling Smørgrav	HMAC_SHA1_Update(&hmacctx, key, key_size);
461*59c8e88eSDag-Erling Smørgrav	HMAC_SHA1_Final(check_digest, &hmacctx);
462*59c8e88eSDag-Erling Smørgrav
463*59c8e88eSDag-Erling Smørgrav	explicit_bzero(check_key, sizeof(check_key));
464*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&hmacctx, sizeof(hmacctx));
465*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&shactx, sizeof(shactx));
466*59c8e88eSDag-Erling Smørgrav}
467*59c8e88eSDag-Erling Smørgrav
468*59c8e88eSDag-Erling Smørgravint
469*59c8e88eSDag-Erling Smørgravsr_crypto_decrypt_key(struct sr_discipline *sd)
470*59c8e88eSDag-Erling Smørgrav{
471*59c8e88eSDag-Erling Smørgrav	u_char			check_digest[SHA1_DIGEST_LENGTH];
472*59c8e88eSDag-Erling Smørgrav	int			rv = 1;
473*59c8e88eSDag-Erling Smørgrav
474*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_decrypt_key\n", DEVNAME(sd->sd_sc));
475*59c8e88eSDag-Erling Smørgrav
476*59c8e88eSDag-Erling Smørgrav	if (sd->mds.mdd_crypto.scr_meta->scm_check_alg != SR_CRYPTOC_HMAC_SHA1)
477*59c8e88eSDag-Erling Smørgrav		goto out;
478*59c8e88eSDag-Erling Smørgrav
479*59c8e88eSDag-Erling Smørgrav	if (sr_crypto_decrypt((u_char *)sd->mds.mdd_crypto.scr_meta->scm_key,
480*59c8e88eSDag-Erling Smørgrav	    (u_char *)sd->mds.mdd_crypto.scr_key,
481*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_maskkey, sizeof(sd->mds.mdd_crypto.scr_key),
482*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
483*59c8e88eSDag-Erling Smørgrav		goto out;
484*59c8e88eSDag-Erling Smørgrav
485*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG0
486*59c8e88eSDag-Erling Smørgrav	sr_crypto_dumpkeys(sd);
487*59c8e88eSDag-Erling Smørgrav#endif
488*59c8e88eSDag-Erling Smørgrav
489*59c8e88eSDag-Erling Smørgrav	/* Check that the key decrypted properly. */
490*59c8e88eSDag-Erling Smørgrav	sr_crypto_calculate_check_hmac_sha1(sd->mds.mdd_crypto.scr_maskkey,
491*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_maskkey),
492*59c8e88eSDag-Erling Smørgrav	    (u_int8_t *)sd->mds.mdd_crypto.scr_key,
493*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_key),
494*59c8e88eSDag-Erling Smørgrav	    check_digest);
495*59c8e88eSDag-Erling Smørgrav	if (memcmp(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac,
496*59c8e88eSDag-Erling Smørgrav	    check_digest, sizeof(check_digest)) != 0) {
497*59c8e88eSDag-Erling Smørgrav		explicit_bzero(sd->mds.mdd_crypto.scr_key,
498*59c8e88eSDag-Erling Smørgrav		    sizeof(sd->mds.mdd_crypto.scr_key));
499*59c8e88eSDag-Erling Smørgrav		goto out;
500*59c8e88eSDag-Erling Smørgrav	}
501*59c8e88eSDag-Erling Smørgrav
502*59c8e88eSDag-Erling Smørgrav	rv = 0; /* Success */
503*59c8e88eSDag-Erling Smørgravout:
504*59c8e88eSDag-Erling Smørgrav	/* we don't need the mask key anymore */
505*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&sd->mds.mdd_crypto.scr_maskkey,
506*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_maskkey));
507*59c8e88eSDag-Erling Smørgrav
508*59c8e88eSDag-Erling Smørgrav	explicit_bzero(check_digest, sizeof(check_digest));
509*59c8e88eSDag-Erling Smørgrav
510*59c8e88eSDag-Erling Smørgrav	return rv;
511*59c8e88eSDag-Erling Smørgrav}
512*59c8e88eSDag-Erling Smørgrav
513*59c8e88eSDag-Erling Smørgravint
514*59c8e88eSDag-Erling Smørgravsr_crypto_create_keys(struct sr_discipline *sd)
515*59c8e88eSDag-Erling Smørgrav{
516*59c8e88eSDag-Erling Smørgrav
517*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_create_keys\n",
518*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc));
519*59c8e88eSDag-Erling Smørgrav
520*59c8e88eSDag-Erling Smørgrav	if (AES_MAXKEYBYTES < sizeof(sd->mds.mdd_crypto.scr_maskkey))
521*59c8e88eSDag-Erling Smørgrav		return (1);
522*59c8e88eSDag-Erling Smørgrav
523*59c8e88eSDag-Erling Smørgrav	/* XXX allow user to specify */
524*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta->scm_alg = SR_CRYPTOA_AES_XTS_256;
525*59c8e88eSDag-Erling Smørgrav
526*59c8e88eSDag-Erling Smørgrav	/* generate crypto keys */
527*59c8e88eSDag-Erling Smørgrav	arc4random_buf(sd->mds.mdd_crypto.scr_key,
528*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_key));
529*59c8e88eSDag-Erling Smørgrav
530*59c8e88eSDag-Erling Smørgrav	/* Mask the disk keys. */
531*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta->scm_mask_alg = SR_CRYPTOM_AES_ECB_256;
532*59c8e88eSDag-Erling Smørgrav	sr_crypto_encrypt((u_char *)sd->mds.mdd_crypto.scr_key,
533*59c8e88eSDag-Erling Smørgrav	    (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key,
534*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_maskkey, sizeof(sd->mds.mdd_crypto.scr_key),
535*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_meta->scm_mask_alg);
536*59c8e88eSDag-Erling Smørgrav
537*59c8e88eSDag-Erling Smørgrav	/* Prepare key decryption check code. */
538*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta->scm_check_alg = SR_CRYPTOC_HMAC_SHA1;
539*59c8e88eSDag-Erling Smørgrav	sr_crypto_calculate_check_hmac_sha1(sd->mds.mdd_crypto.scr_maskkey,
540*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_maskkey),
541*59c8e88eSDag-Erling Smørgrav	    (u_int8_t *)sd->mds.mdd_crypto.scr_key,
542*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_key),
543*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac);
544*59c8e88eSDag-Erling Smørgrav
545*59c8e88eSDag-Erling Smørgrav	/* Erase the plaintext disk keys */
546*59c8e88eSDag-Erling Smørgrav	explicit_bzero(sd->mds.mdd_crypto.scr_key,
547*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_key));
548*59c8e88eSDag-Erling Smørgrav
549*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG0
550*59c8e88eSDag-Erling Smørgrav	sr_crypto_dumpkeys(sd);
551*59c8e88eSDag-Erling Smørgrav#endif
552*59c8e88eSDag-Erling Smørgrav
553*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta->scm_flags = SR_CRYPTOF_KEY |
554*59c8e88eSDag-Erling Smørgrav	    SR_CRYPTOF_KDFHINT;
555*59c8e88eSDag-Erling Smørgrav
556*59c8e88eSDag-Erling Smørgrav	return (0);
557*59c8e88eSDag-Erling Smørgrav}
558*59c8e88eSDag-Erling Smørgrav
559*59c8e88eSDag-Erling Smørgravint
560*59c8e88eSDag-Erling Smørgravsr_crypto_change_maskkey(struct sr_discipline *sd,
561*59c8e88eSDag-Erling Smørgrav  struct sr_crypto_kdfinfo *kdfinfo1, struct sr_crypto_kdfinfo *kdfinfo2)
562*59c8e88eSDag-Erling Smørgrav{
563*59c8e88eSDag-Erling Smørgrav	u_char			check_digest[SHA1_DIGEST_LENGTH];
564*59c8e88eSDag-Erling Smørgrav	u_char			*c, *p = NULL;
565*59c8e88eSDag-Erling Smørgrav	size_t			ksz;
566*59c8e88eSDag-Erling Smørgrav	int			rv = 1;
567*59c8e88eSDag-Erling Smørgrav
568*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_change_maskkey\n",
569*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc));
570*59c8e88eSDag-Erling Smørgrav
571*59c8e88eSDag-Erling Smørgrav	if (sd->mds.mdd_crypto.scr_meta->scm_check_alg != SR_CRYPTOC_HMAC_SHA1)
572*59c8e88eSDag-Erling Smørgrav		goto out;
573*59c8e88eSDag-Erling Smørgrav
574*59c8e88eSDag-Erling Smørgrav	c = (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key;
575*59c8e88eSDag-Erling Smørgrav	ksz = sizeof(sd->mds.mdd_crypto.scr_key);
576*59c8e88eSDag-Erling Smørgrav	p = malloc(ksz, M_DEVBUF, M_WAITOK | M_CANFAIL | M_ZERO);
577*59c8e88eSDag-Erling Smørgrav	if (p == NULL)
578*59c8e88eSDag-Erling Smørgrav		goto out;
579*59c8e88eSDag-Erling Smørgrav
580*59c8e88eSDag-Erling Smørgrav	if (sr_crypto_decrypt(c, p, kdfinfo1->maskkey, ksz,
581*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
582*59c8e88eSDag-Erling Smørgrav		goto out;
583*59c8e88eSDag-Erling Smørgrav
584*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG0
585*59c8e88eSDag-Erling Smørgrav	sr_crypto_dumpkeys(sd);
586*59c8e88eSDag-Erling Smørgrav#endif
587*59c8e88eSDag-Erling Smørgrav
588*59c8e88eSDag-Erling Smørgrav	sr_crypto_calculate_check_hmac_sha1(kdfinfo1->maskkey,
589*59c8e88eSDag-Erling Smørgrav	    sizeof(kdfinfo1->maskkey), p, ksz, check_digest);
590*59c8e88eSDag-Erling Smørgrav	if (memcmp(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac,
591*59c8e88eSDag-Erling Smørgrav	    check_digest, sizeof(check_digest)) != 0) {
592*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "incorrect key or passphrase");
593*59c8e88eSDag-Erling Smørgrav		rv = EPERM;
594*59c8e88eSDag-Erling Smørgrav		goto out;
595*59c8e88eSDag-Erling Smørgrav	}
596*59c8e88eSDag-Erling Smørgrav
597*59c8e88eSDag-Erling Smørgrav	/* Mask the disk keys. */
598*59c8e88eSDag-Erling Smørgrav	c = (u_char *)sd->mds.mdd_crypto.scr_meta->scm_key;
599*59c8e88eSDag-Erling Smørgrav	if (sr_crypto_encrypt(p, c, kdfinfo2->maskkey, ksz,
600*59c8e88eSDag-Erling Smørgrav	    sd->mds.mdd_crypto.scr_meta->scm_mask_alg) == -1)
601*59c8e88eSDag-Erling Smørgrav		goto out;
602*59c8e88eSDag-Erling Smørgrav
603*59c8e88eSDag-Erling Smørgrav	/* Prepare key decryption check code. */
604*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_meta->scm_check_alg = SR_CRYPTOC_HMAC_SHA1;
605*59c8e88eSDag-Erling Smørgrav	sr_crypto_calculate_check_hmac_sha1(kdfinfo2->maskkey,
606*59c8e88eSDag-Erling Smørgrav	    sizeof(kdfinfo2->maskkey), (u_int8_t *)sd->mds.mdd_crypto.scr_key,
607*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_key), check_digest);
608*59c8e88eSDag-Erling Smørgrav
609*59c8e88eSDag-Erling Smørgrav	/* Copy new encrypted key and HMAC to metadata. */
610*59c8e88eSDag-Erling Smørgrav	bcopy(check_digest, sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac,
611*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_meta->chk_hmac_sha1.sch_mac));
612*59c8e88eSDag-Erling Smørgrav
613*59c8e88eSDag-Erling Smørgrav	rv = 0; /* Success */
614*59c8e88eSDag-Erling Smørgrav
615*59c8e88eSDag-Erling Smørgravout:
616*59c8e88eSDag-Erling Smørgrav	if (p) {
617*59c8e88eSDag-Erling Smørgrav		explicit_bzero(p, ksz);
618*59c8e88eSDag-Erling Smørgrav		free(p, M_DEVBUF);
619*59c8e88eSDag-Erling Smørgrav	}
620*59c8e88eSDag-Erling Smørgrav
621*59c8e88eSDag-Erling Smørgrav	explicit_bzero(check_digest, sizeof(check_digest));
622*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&kdfinfo1->maskkey, sizeof(kdfinfo1->maskkey));
623*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&kdfinfo2->maskkey, sizeof(kdfinfo2->maskkey));
624*59c8e88eSDag-Erling Smørgrav
625*59c8e88eSDag-Erling Smørgrav	return (rv);
626*59c8e88eSDag-Erling Smørgrav}
627*59c8e88eSDag-Erling Smørgrav
628*59c8e88eSDag-Erling Smørgravstruct sr_chunk *
629*59c8e88eSDag-Erling Smørgravsr_crypto_create_key_disk(struct sr_discipline *sd, dev_t dev)
630*59c8e88eSDag-Erling Smørgrav{
631*59c8e88eSDag-Erling Smørgrav	struct sr_softc		*sc = sd->sd_sc;
632*59c8e88eSDag-Erling Smørgrav	struct sr_discipline	*fakesd = NULL;
633*59c8e88eSDag-Erling Smørgrav	struct sr_metadata	*sm = NULL;
634*59c8e88eSDag-Erling Smørgrav	struct sr_meta_chunk    *km;
635*59c8e88eSDag-Erling Smørgrav	struct sr_meta_opt_item *omi = NULL;
636*59c8e88eSDag-Erling Smørgrav	struct sr_meta_keydisk	*skm;
637*59c8e88eSDag-Erling Smørgrav	struct sr_chunk		*key_disk = NULL;
638*59c8e88eSDag-Erling Smørgrav	struct disklabel	label;
639*59c8e88eSDag-Erling Smørgrav	struct vnode		*vn;
640*59c8e88eSDag-Erling Smørgrav	char			devname[32];
641*59c8e88eSDag-Erling Smørgrav	int			c, part, open = 0;
642*59c8e88eSDag-Erling Smørgrav
643*59c8e88eSDag-Erling Smørgrav	/*
644*59c8e88eSDag-Erling Smørgrav	 * Create a metadata structure on the key disk and store
645*59c8e88eSDag-Erling Smørgrav	 * keying material in the optional metadata.
646*59c8e88eSDag-Erling Smørgrav	 */
647*59c8e88eSDag-Erling Smørgrav
648*59c8e88eSDag-Erling Smørgrav	sr_meta_getdevname(sc, dev, devname, sizeof(devname));
649*59c8e88eSDag-Erling Smørgrav
650*59c8e88eSDag-Erling Smørgrav	/* Make sure chunk is not already in use. */
651*59c8e88eSDag-Erling Smørgrav	c = sr_chunk_in_use(sc, dev);
652*59c8e88eSDag-Erling Smørgrav	if (c != BIOC_SDINVALID && c != BIOC_SDOFFLINE) {
653*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s is already in use", devname);
654*59c8e88eSDag-Erling Smørgrav		goto done;
655*59c8e88eSDag-Erling Smørgrav	}
656*59c8e88eSDag-Erling Smørgrav
657*59c8e88eSDag-Erling Smørgrav	/* Open device. */
658*59c8e88eSDag-Erling Smørgrav	if (bdevvp(dev, &vn)) {
659*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "cannot open key disk %s", devname);
660*59c8e88eSDag-Erling Smørgrav		goto done;
661*59c8e88eSDag-Erling Smørgrav	}
662*59c8e88eSDag-Erling Smørgrav	if (VOP_OPEN(vn, FREAD | FWRITE, NOCRED, curproc)) {
663*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_META,"%s: sr_crypto_create_key_disk cannot "
664*59c8e88eSDag-Erling Smørgrav		    "open %s\n", DEVNAME(sc), devname);
665*59c8e88eSDag-Erling Smørgrav		vput(vn);
666*59c8e88eSDag-Erling Smørgrav		goto fail;
667*59c8e88eSDag-Erling Smørgrav	}
668*59c8e88eSDag-Erling Smørgrav	open = 1; /* close dev on error */
669*59c8e88eSDag-Erling Smørgrav
670*59c8e88eSDag-Erling Smørgrav	/* Get partition details. */
671*59c8e88eSDag-Erling Smørgrav	part = DISKPART(dev);
672*59c8e88eSDag-Erling Smørgrav	if (VOP_IOCTL(vn, DIOCGDINFO, (caddr_t)&label,
673*59c8e88eSDag-Erling Smørgrav	    FREAD, NOCRED, curproc)) {
674*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_META, "%s: sr_crypto_create_key_disk ioctl "
675*59c8e88eSDag-Erling Smørgrav		    "failed\n", DEVNAME(sc));
676*59c8e88eSDag-Erling Smørgrav		VOP_CLOSE(vn, FREAD | FWRITE, NOCRED, curproc);
677*59c8e88eSDag-Erling Smørgrav		vput(vn);
678*59c8e88eSDag-Erling Smørgrav		goto fail;
679*59c8e88eSDag-Erling Smørgrav	}
680*59c8e88eSDag-Erling Smørgrav	if (label.d_secsize != DEV_BSIZE) {
681*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s has unsupported sector size (%d)",
682*59c8e88eSDag-Erling Smørgrav		    devname, label.d_secsize);
683*59c8e88eSDag-Erling Smørgrav		goto fail;
684*59c8e88eSDag-Erling Smørgrav	}
685*59c8e88eSDag-Erling Smørgrav	if (label.d_partitions[part].p_fstype != FS_RAID) {
686*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s partition not of type RAID (%d)\n",
687*59c8e88eSDag-Erling Smørgrav		    devname, label.d_partitions[part].p_fstype);
688*59c8e88eSDag-Erling Smørgrav		goto fail;
689*59c8e88eSDag-Erling Smørgrav	}
690*59c8e88eSDag-Erling Smørgrav
691*59c8e88eSDag-Erling Smørgrav	/*
692*59c8e88eSDag-Erling Smørgrav	 * Create and populate chunk metadata.
693*59c8e88eSDag-Erling Smørgrav	 */
694*59c8e88eSDag-Erling Smørgrav
695*59c8e88eSDag-Erling Smørgrav	key_disk = malloc(sizeof(struct sr_chunk), M_DEVBUF, M_WAITOK | M_ZERO);
696*59c8e88eSDag-Erling Smørgrav	km = &key_disk->src_meta;
697*59c8e88eSDag-Erling Smørgrav
698*59c8e88eSDag-Erling Smørgrav	key_disk->src_dev_mm = dev;
699*59c8e88eSDag-Erling Smørgrav	key_disk->src_vn = vn;
700*59c8e88eSDag-Erling Smørgrav	strlcpy(key_disk->src_devname, devname, sizeof(km->scmi.scm_devname));
701*59c8e88eSDag-Erling Smørgrav	key_disk->src_size = 0;
702*59c8e88eSDag-Erling Smørgrav
703*59c8e88eSDag-Erling Smørgrav	km->scmi.scm_volid = sd->sd_meta->ssdi.ssd_level;
704*59c8e88eSDag-Erling Smørgrav	km->scmi.scm_chunk_id = 0;
705*59c8e88eSDag-Erling Smørgrav	km->scmi.scm_size = 0;
706*59c8e88eSDag-Erling Smørgrav	km->scmi.scm_coerced_size = 0;
707*59c8e88eSDag-Erling Smørgrav	strlcpy(km->scmi.scm_devname, devname, sizeof(km->scmi.scm_devname));
708*59c8e88eSDag-Erling Smørgrav	bcopy(&sd->sd_meta->ssdi.ssd_uuid, &km->scmi.scm_uuid,
709*59c8e88eSDag-Erling Smørgrav	    sizeof(struct sr_uuid));
710*59c8e88eSDag-Erling Smørgrav
711*59c8e88eSDag-Erling Smørgrav	sr_checksum(sc, km, &km->scm_checksum,
712*59c8e88eSDag-Erling Smørgrav	    sizeof(struct sr_meta_chunk_invariant));
713*59c8e88eSDag-Erling Smørgrav
714*59c8e88eSDag-Erling Smørgrav	km->scm_status = BIOC_SDONLINE;
715*59c8e88eSDag-Erling Smørgrav
716*59c8e88eSDag-Erling Smørgrav	/*
717*59c8e88eSDag-Erling Smørgrav	 * Create and populate our own discipline and metadata.
718*59c8e88eSDag-Erling Smørgrav	 */
719*59c8e88eSDag-Erling Smørgrav
720*59c8e88eSDag-Erling Smørgrav	sm = malloc(sizeof(struct sr_metadata), M_DEVBUF, M_WAITOK | M_ZERO);
721*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_magic = SR_MAGIC;
722*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_version = SR_META_VERSION;
723*59c8e88eSDag-Erling Smørgrav	sm->ssd_ondisk = 0;
724*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_vol_flags = 0;
725*59c8e88eSDag-Erling Smørgrav	bcopy(&sd->sd_meta->ssdi.ssd_uuid, &sm->ssdi.ssd_uuid,
726*59c8e88eSDag-Erling Smørgrav	    sizeof(struct sr_uuid));
727*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_chunk_no = 1;
728*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_volid = SR_KEYDISK_VOLID;
729*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_level = SR_KEYDISK_LEVEL;
730*59c8e88eSDag-Erling Smørgrav	sm->ssdi.ssd_size = 0;
731*59c8e88eSDag-Erling Smørgrav	strlcpy(sm->ssdi.ssd_vendor, "OPENBSD", sizeof(sm->ssdi.ssd_vendor));
732*59c8e88eSDag-Erling Smørgrav	snprintf(sm->ssdi.ssd_product, sizeof(sm->ssdi.ssd_product),
733*59c8e88eSDag-Erling Smørgrav	    "SR %s", "KEYDISK");
734*59c8e88eSDag-Erling Smørgrav	snprintf(sm->ssdi.ssd_revision, sizeof(sm->ssdi.ssd_revision),
735*59c8e88eSDag-Erling Smørgrav	    "%03d", SR_META_VERSION);
736*59c8e88eSDag-Erling Smørgrav
737*59c8e88eSDag-Erling Smørgrav	fakesd = malloc(sizeof(struct sr_discipline), M_DEVBUF,
738*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
739*59c8e88eSDag-Erling Smørgrav	fakesd->sd_sc = sd->sd_sc;
740*59c8e88eSDag-Erling Smørgrav	fakesd->sd_meta = sm;
741*59c8e88eSDag-Erling Smørgrav	fakesd->sd_meta_type = SR_META_F_NATIVE;
742*59c8e88eSDag-Erling Smørgrav	fakesd->sd_vol_status = BIOC_SVONLINE;
743*59c8e88eSDag-Erling Smørgrav	strlcpy(fakesd->sd_name, "KEYDISK", sizeof(fakesd->sd_name));
744*59c8e88eSDag-Erling Smørgrav	SLIST_INIT(&fakesd->sd_meta_opt);
745*59c8e88eSDag-Erling Smørgrav
746*59c8e88eSDag-Erling Smørgrav	/* Add chunk to volume. */
747*59c8e88eSDag-Erling Smørgrav	fakesd->sd_vol.sv_chunks = malloc(sizeof(struct sr_chunk *), M_DEVBUF,
748*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
749*59c8e88eSDag-Erling Smørgrav	fakesd->sd_vol.sv_chunks[0] = key_disk;
750*59c8e88eSDag-Erling Smørgrav	SLIST_INIT(&fakesd->sd_vol.sv_chunk_list);
751*59c8e88eSDag-Erling Smørgrav	SLIST_INSERT_HEAD(&fakesd->sd_vol.sv_chunk_list, key_disk, src_link);
752*59c8e88eSDag-Erling Smørgrav
753*59c8e88eSDag-Erling Smørgrav	/* Generate mask key. */
754*59c8e88eSDag-Erling Smørgrav	arc4random_buf(sd->mds.mdd_crypto.scr_maskkey,
755*59c8e88eSDag-Erling Smørgrav	    sizeof(sd->mds.mdd_crypto.scr_maskkey));
756*59c8e88eSDag-Erling Smørgrav
757*59c8e88eSDag-Erling Smørgrav	/* Copy mask key to optional metadata area. */
758*59c8e88eSDag-Erling Smørgrav	omi = malloc(sizeof(struct sr_meta_opt_item), M_DEVBUF,
759*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
760*59c8e88eSDag-Erling Smørgrav	omi->omi_som = malloc(sizeof(struct sr_meta_keydisk), M_DEVBUF,
761*59c8e88eSDag-Erling Smørgrav	    M_WAITOK | M_ZERO);
762*59c8e88eSDag-Erling Smørgrav	omi->omi_som->som_type = SR_OPT_KEYDISK;
763*59c8e88eSDag-Erling Smørgrav	omi->omi_som->som_length = sizeof(struct sr_meta_keydisk);
764*59c8e88eSDag-Erling Smørgrav	skm = (struct sr_meta_keydisk *)omi->omi_som;
765*59c8e88eSDag-Erling Smørgrav	bcopy(sd->mds.mdd_crypto.scr_maskkey, &skm->skm_maskkey,
766*59c8e88eSDag-Erling Smørgrav	    sizeof(skm->skm_maskkey));
767*59c8e88eSDag-Erling Smørgrav	SLIST_INSERT_HEAD(&fakesd->sd_meta_opt, omi, omi_link);
768*59c8e88eSDag-Erling Smørgrav	fakesd->sd_meta->ssdi.ssd_opt_no++;
769*59c8e88eSDag-Erling Smørgrav
770*59c8e88eSDag-Erling Smørgrav	/* Save metadata. */
771*59c8e88eSDag-Erling Smørgrav	if (sr_meta_save(fakesd, SR_META_DIRTY)) {
772*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "could not save metadata to %s", devname);
773*59c8e88eSDag-Erling Smørgrav		goto fail;
774*59c8e88eSDag-Erling Smørgrav	}
775*59c8e88eSDag-Erling Smørgrav
776*59c8e88eSDag-Erling Smørgrav	goto done;
777*59c8e88eSDag-Erling Smørgrav
778*59c8e88eSDag-Erling Smørgravfail:
779*59c8e88eSDag-Erling Smørgrav	if (key_disk)
780*59c8e88eSDag-Erling Smørgrav		free(key_disk, M_DEVBUF);
781*59c8e88eSDag-Erling Smørgrav	key_disk = NULL;
782*59c8e88eSDag-Erling Smørgrav
783*59c8e88eSDag-Erling Smørgravdone:
784*59c8e88eSDag-Erling Smørgrav	if (omi)
785*59c8e88eSDag-Erling Smørgrav		free(omi, M_DEVBUF);
786*59c8e88eSDag-Erling Smørgrav	if (fakesd && fakesd->sd_vol.sv_chunks)
787*59c8e88eSDag-Erling Smørgrav		free(fakesd->sd_vol.sv_chunks, M_DEVBUF);
788*59c8e88eSDag-Erling Smørgrav	if (fakesd)
789*59c8e88eSDag-Erling Smørgrav		free(fakesd, M_DEVBUF);
790*59c8e88eSDag-Erling Smørgrav	if (sm)
791*59c8e88eSDag-Erling Smørgrav		free(sm, M_DEVBUF);
792*59c8e88eSDag-Erling Smørgrav	if (open) {
793*59c8e88eSDag-Erling Smørgrav		VOP_CLOSE(vn, FREAD | FWRITE, NOCRED, curproc);
794*59c8e88eSDag-Erling Smørgrav		vput(vn);
795*59c8e88eSDag-Erling Smørgrav	}
796*59c8e88eSDag-Erling Smørgrav
797*59c8e88eSDag-Erling Smørgrav	return key_disk;
798*59c8e88eSDag-Erling Smørgrav}
799*59c8e88eSDag-Erling Smørgrav
800*59c8e88eSDag-Erling Smørgravstruct sr_chunk *
801*59c8e88eSDag-Erling Smørgravsr_crypto_read_key_disk(struct sr_discipline *sd, dev_t dev)
802*59c8e88eSDag-Erling Smørgrav{
803*59c8e88eSDag-Erling Smørgrav	struct sr_softc		*sc = sd->sd_sc;
804*59c8e88eSDag-Erling Smørgrav	struct sr_metadata	*sm = NULL;
805*59c8e88eSDag-Erling Smørgrav	struct sr_meta_opt_item *omi, *omi_next;
806*59c8e88eSDag-Erling Smørgrav	struct sr_meta_opt_hdr	*omh;
807*59c8e88eSDag-Erling Smørgrav	struct sr_meta_keydisk	*skm;
808*59c8e88eSDag-Erling Smørgrav	struct sr_meta_opt_head som;
809*59c8e88eSDag-Erling Smørgrav	struct sr_chunk		*key_disk = NULL;
810*59c8e88eSDag-Erling Smørgrav	struct disklabel	label;
811*59c8e88eSDag-Erling Smørgrav	struct vnode		*vn = NULL;
812*59c8e88eSDag-Erling Smørgrav	char			devname[32];
813*59c8e88eSDag-Erling Smørgrav	int			c, part, open = 0;
814*59c8e88eSDag-Erling Smørgrav
815*59c8e88eSDag-Erling Smørgrav	/*
816*59c8e88eSDag-Erling Smørgrav	 * Load a key disk and load keying material into memory.
817*59c8e88eSDag-Erling Smørgrav	 */
818*59c8e88eSDag-Erling Smørgrav
819*59c8e88eSDag-Erling Smørgrav	SLIST_INIT(&som);
820*59c8e88eSDag-Erling Smørgrav
821*59c8e88eSDag-Erling Smørgrav	sr_meta_getdevname(sc, dev, devname, sizeof(devname));
822*59c8e88eSDag-Erling Smørgrav
823*59c8e88eSDag-Erling Smørgrav	/* Make sure chunk is not already in use. */
824*59c8e88eSDag-Erling Smørgrav	c = sr_chunk_in_use(sc, dev);
825*59c8e88eSDag-Erling Smørgrav	if (c != BIOC_SDINVALID && c != BIOC_SDOFFLINE) {
826*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s is already in use", devname);
827*59c8e88eSDag-Erling Smørgrav		goto done;
828*59c8e88eSDag-Erling Smørgrav	}
829*59c8e88eSDag-Erling Smørgrav
830*59c8e88eSDag-Erling Smørgrav	/* Open device. */
831*59c8e88eSDag-Erling Smørgrav	if (bdevvp(dev, &vn)) {
832*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "cannot open key disk %s", devname);
833*59c8e88eSDag-Erling Smørgrav		goto done;
834*59c8e88eSDag-Erling Smørgrav	}
835*59c8e88eSDag-Erling Smørgrav	if (VOP_OPEN(vn, FREAD | FWRITE, NOCRED, curproc)) {
836*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_META,"%s: sr_crypto_read_key_disk cannot "
837*59c8e88eSDag-Erling Smørgrav		    "open %s\n", DEVNAME(sc), devname);
838*59c8e88eSDag-Erling Smørgrav		vput(vn);
839*59c8e88eSDag-Erling Smørgrav		goto done;
840*59c8e88eSDag-Erling Smørgrav	}
841*59c8e88eSDag-Erling Smørgrav	open = 1; /* close dev on error */
842*59c8e88eSDag-Erling Smørgrav
843*59c8e88eSDag-Erling Smørgrav	/* Get partition details. */
844*59c8e88eSDag-Erling Smørgrav	part = DISKPART(dev);
845*59c8e88eSDag-Erling Smørgrav	if (VOP_IOCTL(vn, DIOCGDINFO, (caddr_t)&label, FREAD,
846*59c8e88eSDag-Erling Smørgrav	    NOCRED, curproc)) {
847*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_META, "%s: sr_crypto_read_key_disk ioctl "
848*59c8e88eSDag-Erling Smørgrav		    "failed\n", DEVNAME(sc));
849*59c8e88eSDag-Erling Smørgrav		VOP_CLOSE(vn, FREAD | FWRITE, NOCRED, curproc);
850*59c8e88eSDag-Erling Smørgrav		vput(vn);
851*59c8e88eSDag-Erling Smørgrav		goto done;
852*59c8e88eSDag-Erling Smørgrav	}
853*59c8e88eSDag-Erling Smørgrav	if (label.d_secsize != DEV_BSIZE) {
854*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s has unsupported sector size (%d)",
855*59c8e88eSDag-Erling Smørgrav		    devname, label.d_secsize);
856*59c8e88eSDag-Erling Smørgrav		goto done;
857*59c8e88eSDag-Erling Smørgrav	}
858*59c8e88eSDag-Erling Smørgrav	if (label.d_partitions[part].p_fstype != FS_RAID) {
859*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s partition not of type RAID (%d)\n",
860*59c8e88eSDag-Erling Smørgrav		    devname, label.d_partitions[part].p_fstype);
861*59c8e88eSDag-Erling Smørgrav		goto done;
862*59c8e88eSDag-Erling Smørgrav	}
863*59c8e88eSDag-Erling Smørgrav
864*59c8e88eSDag-Erling Smørgrav	/*
865*59c8e88eSDag-Erling Smørgrav	 * Read and validate key disk metadata.
866*59c8e88eSDag-Erling Smørgrav	 */
867*59c8e88eSDag-Erling Smørgrav	sm = malloc(SR_META_SIZE * 512, M_DEVBUF, M_WAITOK | M_ZERO);
868*59c8e88eSDag-Erling Smørgrav	if (sr_meta_native_read(sd, dev, sm, NULL)) {
869*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "native bootprobe could not read native metadata");
870*59c8e88eSDag-Erling Smørgrav		goto done;
871*59c8e88eSDag-Erling Smørgrav	}
872*59c8e88eSDag-Erling Smørgrav
873*59c8e88eSDag-Erling Smørgrav	if (sr_meta_validate(sd, dev, sm, NULL)) {
874*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_META, "%s: invalid metadata\n",
875*59c8e88eSDag-Erling Smørgrav		    DEVNAME(sc));
876*59c8e88eSDag-Erling Smørgrav		goto done;
877*59c8e88eSDag-Erling Smørgrav	}
878*59c8e88eSDag-Erling Smørgrav
879*59c8e88eSDag-Erling Smørgrav	/* Make sure this is a key disk. */
880*59c8e88eSDag-Erling Smørgrav	if (sm->ssdi.ssd_level != SR_KEYDISK_LEVEL) {
881*59c8e88eSDag-Erling Smørgrav		sr_error(sc, "%s is not a key disk", devname);
882*59c8e88eSDag-Erling Smørgrav		goto done;
883*59c8e88eSDag-Erling Smørgrav	}
884*59c8e88eSDag-Erling Smørgrav
885*59c8e88eSDag-Erling Smørgrav	/* Construct key disk chunk. */
886*59c8e88eSDag-Erling Smørgrav	key_disk = malloc(sizeof(struct sr_chunk), M_DEVBUF, M_WAITOK | M_ZERO);
887*59c8e88eSDag-Erling Smørgrav	key_disk->src_dev_mm = dev;
888*59c8e88eSDag-Erling Smørgrav	key_disk->src_vn = vn;
889*59c8e88eSDag-Erling Smørgrav	key_disk->src_size = 0;
890*59c8e88eSDag-Erling Smørgrav
891*59c8e88eSDag-Erling Smørgrav	bcopy((struct sr_meta_chunk *)(sm + 1), &key_disk->src_meta,
892*59c8e88eSDag-Erling Smørgrav	    sizeof(key_disk->src_meta));
893*59c8e88eSDag-Erling Smørgrav
894*59c8e88eSDag-Erling Smørgrav	/* Read mask key from optional metadata. */
895*59c8e88eSDag-Erling Smørgrav	sr_meta_opt_load(sc, sm, &som);
896*59c8e88eSDag-Erling Smørgrav	SLIST_FOREACH(omi, &som, omi_link) {
897*59c8e88eSDag-Erling Smørgrav		omh = omi->omi_som;
898*59c8e88eSDag-Erling Smørgrav		if (omh->som_type == SR_OPT_KEYDISK) {
899*59c8e88eSDag-Erling Smørgrav			skm = (struct sr_meta_keydisk *)omh;
900*59c8e88eSDag-Erling Smørgrav			bcopy(&skm->skm_maskkey,
901*59c8e88eSDag-Erling Smørgrav			    sd->mds.mdd_crypto.scr_maskkey,
902*59c8e88eSDag-Erling Smørgrav			    sizeof(sd->mds.mdd_crypto.scr_maskkey));
903*59c8e88eSDag-Erling Smørgrav		} else if (omh->som_type == SR_OPT_CRYPTO) {
904*59c8e88eSDag-Erling Smørgrav			/* Original keydisk format with key in crypto area. */
905*59c8e88eSDag-Erling Smørgrav			bcopy(omh + sizeof(struct sr_meta_opt_hdr),
906*59c8e88eSDag-Erling Smørgrav			    sd->mds.mdd_crypto.scr_maskkey,
907*59c8e88eSDag-Erling Smørgrav			    sizeof(sd->mds.mdd_crypto.scr_maskkey));
908*59c8e88eSDag-Erling Smørgrav		}
909*59c8e88eSDag-Erling Smørgrav	}
910*59c8e88eSDag-Erling Smørgrav
911*59c8e88eSDag-Erling Smørgrav	open = 0;
912*59c8e88eSDag-Erling Smørgrav
913*59c8e88eSDag-Erling Smørgravdone:
914*59c8e88eSDag-Erling Smørgrav	for (omi = SLIST_FIRST(&som); omi != SLIST_END(&som); omi = omi_next) {
915*59c8e88eSDag-Erling Smørgrav		omi_next = SLIST_NEXT(omi, omi_link);
916*59c8e88eSDag-Erling Smørgrav		if (omi->omi_som)
917*59c8e88eSDag-Erling Smørgrav			free(omi->omi_som, M_DEVBUF);
918*59c8e88eSDag-Erling Smørgrav		free(omi, M_DEVBUF);
919*59c8e88eSDag-Erling Smørgrav	}
920*59c8e88eSDag-Erling Smørgrav
921*59c8e88eSDag-Erling Smørgrav	if (sm)
922*59c8e88eSDag-Erling Smørgrav		free(sm, M_DEVBUF);
923*59c8e88eSDag-Erling Smørgrav
924*59c8e88eSDag-Erling Smørgrav	if (vn && open) {
925*59c8e88eSDag-Erling Smørgrav		VOP_CLOSE(vn, FREAD, NOCRED, curproc);
926*59c8e88eSDag-Erling Smørgrav		vput(vn);
927*59c8e88eSDag-Erling Smørgrav	}
928*59c8e88eSDag-Erling Smørgrav
929*59c8e88eSDag-Erling Smørgrav	return key_disk;
930*59c8e88eSDag-Erling Smørgrav}
931*59c8e88eSDag-Erling Smørgrav
932*59c8e88eSDag-Erling Smørgravint
933*59c8e88eSDag-Erling Smørgravsr_crypto_alloc_resources(struct sr_discipline *sd)
934*59c8e88eSDag-Erling Smørgrav{
935*59c8e88eSDag-Erling Smørgrav	struct cryptoini	cri;
936*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu;
937*59c8e88eSDag-Erling Smørgrav	u_int			num_keys, i;
938*59c8e88eSDag-Erling Smørgrav
939*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_alloc_resources\n",
940*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc));
941*59c8e88eSDag-Erling Smørgrav
942*59c8e88eSDag-Erling Smørgrav	sd->mds.mdd_crypto.scr_alg = CRYPTO_AES_XTS;
943*59c8e88eSDag-Erling Smørgrav	switch (sd->mds.mdd_crypto.scr_meta->scm_alg) {
944*59c8e88eSDag-Erling Smørgrav	case SR_CRYPTOA_AES_XTS_128:
945*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_klen = 256;
946*59c8e88eSDag-Erling Smørgrav		break;
947*59c8e88eSDag-Erling Smørgrav	case SR_CRYPTOA_AES_XTS_256:
948*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_klen = 512;
949*59c8e88eSDag-Erling Smørgrav		break;
950*59c8e88eSDag-Erling Smørgrav	default:
951*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "unknown crypto algorithm");
952*59c8e88eSDag-Erling Smørgrav		return (EINVAL);
953*59c8e88eSDag-Erling Smørgrav	}
954*59c8e88eSDag-Erling Smørgrav
955*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < SR_CRYPTO_MAXKEYS; i++)
956*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
957*59c8e88eSDag-Erling Smørgrav
958*59c8e88eSDag-Erling Smørgrav	if (sr_wu_alloc(sd, sizeof(struct sr_workunit))) {
959*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "unable to allocate work units");
960*59c8e88eSDag-Erling Smørgrav		return (ENOMEM);
961*59c8e88eSDag-Erling Smørgrav	}
962*59c8e88eSDag-Erling Smørgrav	if (sr_ccb_alloc(sd)) {
963*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "unable to allocate CCBs");
964*59c8e88eSDag-Erling Smørgrav		return (ENOMEM);
965*59c8e88eSDag-Erling Smørgrav	}
966*59c8e88eSDag-Erling Smørgrav	if (sr_crypto_decrypt_key(sd)) {
967*59c8e88eSDag-Erling Smørgrav		sr_error(sd->sd_sc, "incorrect key or passphrase");
968*59c8e88eSDag-Erling Smørgrav		return (EPERM);
969*59c8e88eSDag-Erling Smørgrav	}
970*59c8e88eSDag-Erling Smørgrav
971*59c8e88eSDag-Erling Smørgrav	/*
972*59c8e88eSDag-Erling Smørgrav	 * For each wu allocate the uio, iovec and crypto structures.
973*59c8e88eSDag-Erling Smørgrav	 * these have to be allocated now because during runtime we can't
974*59c8e88eSDag-Erling Smørgrav	 * fail an allocation without failing the io (which can cause real
975*59c8e88eSDag-Erling Smørgrav	 * problems).
976*59c8e88eSDag-Erling Smørgrav	 */
977*59c8e88eSDag-Erling Smørgrav	mtx_init(&sd->mds.mdd_crypto.scr_mutex, IPL_BIO);
978*59c8e88eSDag-Erling Smørgrav	TAILQ_INIT(&sd->mds.mdd_crypto.scr_wus);
979*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < sd->sd_max_wu; i++) {
980*59c8e88eSDag-Erling Smørgrav		crwu = malloc(sizeof(*crwu), M_DEVBUF,
981*59c8e88eSDag-Erling Smørgrav		    M_WAITOK | M_ZERO | M_CANFAIL);
982*59c8e88eSDag-Erling Smørgrav		if (crwu == NULL)
983*59c8e88eSDag-Erling Smørgrav		    return (ENOMEM);
984*59c8e88eSDag-Erling Smørgrav		/* put it on the list now so if we fail it'll be freed */
985*59c8e88eSDag-Erling Smørgrav		mtx_enter(&sd->mds.mdd_crypto.scr_mutex);
986*59c8e88eSDag-Erling Smørgrav		TAILQ_INSERT_TAIL(&sd->mds.mdd_crypto.scr_wus, crwu, cr_link);
987*59c8e88eSDag-Erling Smørgrav		mtx_leave(&sd->mds.mdd_crypto.scr_mutex);
988*59c8e88eSDag-Erling Smørgrav
989*59c8e88eSDag-Erling Smørgrav		crwu->cr_uio.uio_iov = &crwu->cr_iov;
990*59c8e88eSDag-Erling Smørgrav		crwu->cr_dmabuf = dma_alloc(MAXPHYS, PR_WAITOK);
991*59c8e88eSDag-Erling Smørgrav		crwu->cr_crp = crypto_getreq(MAXPHYS >> DEV_BSHIFT);
992*59c8e88eSDag-Erling Smørgrav		if (crwu->cr_crp == NULL)
993*59c8e88eSDag-Erling Smørgrav			return (ENOMEM);
994*59c8e88eSDag-Erling Smørgrav		crwu->cr_descs = crwu->cr_crp->crp_desc;
995*59c8e88eSDag-Erling Smørgrav	}
996*59c8e88eSDag-Erling Smørgrav
997*59c8e88eSDag-Erling Smørgrav	memset(&cri, 0, sizeof(cri));
998*59c8e88eSDag-Erling Smørgrav	cri.cri_alg = sd->mds.mdd_crypto.scr_alg;
999*59c8e88eSDag-Erling Smørgrav	cri.cri_klen = sd->mds.mdd_crypto.scr_klen;
1000*59c8e88eSDag-Erling Smørgrav
1001*59c8e88eSDag-Erling Smørgrav	/* Allocate a session for every 2^SR_CRYPTO_KEY_BLKSHIFT blocks */
1002*59c8e88eSDag-Erling Smørgrav	num_keys = sd->sd_meta->ssdi.ssd_size >> SR_CRYPTO_KEY_BLKSHIFT;
1003*59c8e88eSDag-Erling Smørgrav	if (num_keys >= SR_CRYPTO_MAXKEYS)
1004*59c8e88eSDag-Erling Smørgrav		return (EFBIG);
1005*59c8e88eSDag-Erling Smørgrav	for (i = 0; i <= num_keys; i++) {
1006*59c8e88eSDag-Erling Smørgrav		cri.cri_key = sd->mds.mdd_crypto.scr_key[i];
1007*59c8e88eSDag-Erling Smørgrav		if (crypto_newsession(&sd->mds.mdd_crypto.scr_sid[i],
1008*59c8e88eSDag-Erling Smørgrav		    &cri, 0) != 0) {
1009*59c8e88eSDag-Erling Smørgrav			for (i = 0;
1010*59c8e88eSDag-Erling Smørgrav			     sd->mds.mdd_crypto.scr_sid[i] != (u_int64_t)-1;
1011*59c8e88eSDag-Erling Smørgrav			     i++) {
1012*59c8e88eSDag-Erling Smørgrav				crypto_freesession(
1013*59c8e88eSDag-Erling Smørgrav				    sd->mds.mdd_crypto.scr_sid[i]);
1014*59c8e88eSDag-Erling Smørgrav				sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
1015*59c8e88eSDag-Erling Smørgrav			}
1016*59c8e88eSDag-Erling Smørgrav			return (EINVAL);
1017*59c8e88eSDag-Erling Smørgrav		}
1018*59c8e88eSDag-Erling Smørgrav	}
1019*59c8e88eSDag-Erling Smørgrav
1020*59c8e88eSDag-Erling Smørgrav	sr_hotplug_register(sd, sr_crypto_hotplug);
1021*59c8e88eSDag-Erling Smørgrav
1022*59c8e88eSDag-Erling Smørgrav	return (0);
1023*59c8e88eSDag-Erling Smørgrav}
1024*59c8e88eSDag-Erling Smørgrav
1025*59c8e88eSDag-Erling Smørgravvoid
1026*59c8e88eSDag-Erling Smørgravsr_crypto_free_resources(struct sr_discipline *sd)
1027*59c8e88eSDag-Erling Smørgrav{
1028*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu;
1029*59c8e88eSDag-Erling Smørgrav	u_int			i;
1030*59c8e88eSDag-Erling Smørgrav
1031*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_free_resources\n",
1032*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc));
1033*59c8e88eSDag-Erling Smørgrav
1034*59c8e88eSDag-Erling Smørgrav	if (sd->mds.mdd_crypto.key_disk != NULL) {
1035*59c8e88eSDag-Erling Smørgrav		explicit_bzero(sd->mds.mdd_crypto.key_disk, sizeof
1036*59c8e88eSDag-Erling Smørgrav		    sd->mds.mdd_crypto.key_disk);
1037*59c8e88eSDag-Erling Smørgrav		free(sd->mds.mdd_crypto.key_disk, M_DEVBUF);
1038*59c8e88eSDag-Erling Smørgrav	}
1039*59c8e88eSDag-Erling Smørgrav
1040*59c8e88eSDag-Erling Smørgrav	sr_hotplug_unregister(sd, sr_crypto_hotplug);
1041*59c8e88eSDag-Erling Smørgrav
1042*59c8e88eSDag-Erling Smørgrav	for (i = 0; sd->mds.mdd_crypto.scr_sid[i] != (u_int64_t)-1; i++) {
1043*59c8e88eSDag-Erling Smørgrav		crypto_freesession(sd->mds.mdd_crypto.scr_sid[i]);
1044*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_sid[i] = (u_int64_t)-1;
1045*59c8e88eSDag-Erling Smørgrav	}
1046*59c8e88eSDag-Erling Smørgrav
1047*59c8e88eSDag-Erling Smørgrav	mtx_enter(&sd->mds.mdd_crypto.scr_mutex);
1048*59c8e88eSDag-Erling Smørgrav	while ((crwu = TAILQ_FIRST(&sd->mds.mdd_crypto.scr_wus)) != NULL) {
1049*59c8e88eSDag-Erling Smørgrav		TAILQ_REMOVE(&sd->mds.mdd_crypto.scr_wus, crwu, cr_link);
1050*59c8e88eSDag-Erling Smørgrav
1051*59c8e88eSDag-Erling Smørgrav		if (crwu->cr_dmabuf != NULL)
1052*59c8e88eSDag-Erling Smørgrav			dma_free(crwu->cr_dmabuf, MAXPHYS);
1053*59c8e88eSDag-Erling Smørgrav		if (crwu->cr_crp) {
1054*59c8e88eSDag-Erling Smørgrav			crwu->cr_crp->crp_desc = crwu->cr_descs;
1055*59c8e88eSDag-Erling Smørgrav			crypto_freereq(crwu->cr_crp);
1056*59c8e88eSDag-Erling Smørgrav		}
1057*59c8e88eSDag-Erling Smørgrav		free(crwu, M_DEVBUF);
1058*59c8e88eSDag-Erling Smørgrav	}
1059*59c8e88eSDag-Erling Smørgrav	mtx_leave(&sd->mds.mdd_crypto.scr_mutex);
1060*59c8e88eSDag-Erling Smørgrav
1061*59c8e88eSDag-Erling Smørgrav	sr_wu_free(sd);
1062*59c8e88eSDag-Erling Smørgrav	sr_ccb_free(sd);
1063*59c8e88eSDag-Erling Smørgrav}
1064*59c8e88eSDag-Erling Smørgrav
1065*59c8e88eSDag-Erling Smørgravint
1066*59c8e88eSDag-Erling Smørgravsr_crypto_ioctl(struct sr_discipline *sd, struct bioc_discipline *bd)
1067*59c8e88eSDag-Erling Smørgrav{
1068*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_kdfpair kdfpair;
1069*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_kdfinfo kdfinfo1, kdfinfo2;
1070*59c8e88eSDag-Erling Smørgrav	int			size, rv = 1;
1071*59c8e88eSDag-Erling Smørgrav
1072*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_IOCTL, "%s: sr_crypto_ioctl %u\n",
1073*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc), bd->bd_cmd);
1074*59c8e88eSDag-Erling Smørgrav
1075*59c8e88eSDag-Erling Smørgrav	switch (bd->bd_cmd) {
1076*59c8e88eSDag-Erling Smørgrav	case SR_IOCTL_GET_KDFHINT:
1077*59c8e88eSDag-Erling Smørgrav
1078*59c8e88eSDag-Erling Smørgrav		/* Get KDF hint for userland. */
1079*59c8e88eSDag-Erling Smørgrav		size = sizeof(sd->mds.mdd_crypto.scr_meta->scm_kdfhint);
1080*59c8e88eSDag-Erling Smørgrav		if (bd->bd_data == NULL || bd->bd_size > size)
1081*59c8e88eSDag-Erling Smørgrav			goto bad;
1082*59c8e88eSDag-Erling Smørgrav		if (copyout(sd->mds.mdd_crypto.scr_meta->scm_kdfhint,
1083*59c8e88eSDag-Erling Smørgrav		    bd->bd_data, bd->bd_size))
1084*59c8e88eSDag-Erling Smørgrav			goto bad;
1085*59c8e88eSDag-Erling Smørgrav
1086*59c8e88eSDag-Erling Smørgrav		rv = 0;
1087*59c8e88eSDag-Erling Smørgrav
1088*59c8e88eSDag-Erling Smørgrav		break;
1089*59c8e88eSDag-Erling Smørgrav
1090*59c8e88eSDag-Erling Smørgrav	case SR_IOCTL_CHANGE_PASSPHRASE:
1091*59c8e88eSDag-Erling Smørgrav
1092*59c8e88eSDag-Erling Smørgrav		/* Attempt to change passphrase. */
1093*59c8e88eSDag-Erling Smørgrav
1094*59c8e88eSDag-Erling Smørgrav		size = sizeof(kdfpair);
1095*59c8e88eSDag-Erling Smørgrav		if (bd->bd_data == NULL || bd->bd_size > size)
1096*59c8e88eSDag-Erling Smørgrav			goto bad;
1097*59c8e88eSDag-Erling Smørgrav		if (copyin(bd->bd_data, &kdfpair, size))
1098*59c8e88eSDag-Erling Smørgrav			goto bad;
1099*59c8e88eSDag-Erling Smørgrav
1100*59c8e88eSDag-Erling Smørgrav		size = sizeof(kdfinfo1);
1101*59c8e88eSDag-Erling Smørgrav		if (kdfpair.kdfinfo1 == NULL || kdfpair.kdfsize1 > size)
1102*59c8e88eSDag-Erling Smørgrav			goto bad;
1103*59c8e88eSDag-Erling Smørgrav		if (copyin(kdfpair.kdfinfo1, &kdfinfo1, size))
1104*59c8e88eSDag-Erling Smørgrav			goto bad;
1105*59c8e88eSDag-Erling Smørgrav
1106*59c8e88eSDag-Erling Smørgrav		size = sizeof(kdfinfo2);
1107*59c8e88eSDag-Erling Smørgrav		if (kdfpair.kdfinfo2 == NULL || kdfpair.kdfsize2 > size)
1108*59c8e88eSDag-Erling Smørgrav			goto bad;
1109*59c8e88eSDag-Erling Smørgrav		if (copyin(kdfpair.kdfinfo2, &kdfinfo2, size))
1110*59c8e88eSDag-Erling Smørgrav			goto bad;
1111*59c8e88eSDag-Erling Smørgrav
1112*59c8e88eSDag-Erling Smørgrav		if (sr_crypto_change_maskkey(sd, &kdfinfo1, &kdfinfo2))
1113*59c8e88eSDag-Erling Smørgrav			goto bad;
1114*59c8e88eSDag-Erling Smørgrav
1115*59c8e88eSDag-Erling Smørgrav		/* Save metadata to disk. */
1116*59c8e88eSDag-Erling Smørgrav		rv = sr_meta_save(sd, SR_META_DIRTY);
1117*59c8e88eSDag-Erling Smørgrav
1118*59c8e88eSDag-Erling Smørgrav		break;
1119*59c8e88eSDag-Erling Smørgrav	}
1120*59c8e88eSDag-Erling Smørgrav
1121*59c8e88eSDag-Erling Smørgravbad:
1122*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&kdfpair, sizeof(kdfpair));
1123*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&kdfinfo1, sizeof(kdfinfo1));
1124*59c8e88eSDag-Erling Smørgrav	explicit_bzero(&kdfinfo2, sizeof(kdfinfo2));
1125*59c8e88eSDag-Erling Smørgrav
1126*59c8e88eSDag-Erling Smørgrav	return (rv);
1127*59c8e88eSDag-Erling Smørgrav}
1128*59c8e88eSDag-Erling Smørgrav
1129*59c8e88eSDag-Erling Smørgravint
1130*59c8e88eSDag-Erling Smørgravsr_crypto_meta_opt_handler(struct sr_discipline *sd, struct sr_meta_opt_hdr *om)
1131*59c8e88eSDag-Erling Smørgrav{
1132*59c8e88eSDag-Erling Smørgrav	int rv = EINVAL;
1133*59c8e88eSDag-Erling Smørgrav
1134*59c8e88eSDag-Erling Smørgrav	if (om->som_type == SR_OPT_CRYPTO) {
1135*59c8e88eSDag-Erling Smørgrav		sd->mds.mdd_crypto.scr_meta = (struct sr_meta_crypto *)om;
1136*59c8e88eSDag-Erling Smørgrav		rv = 0;
1137*59c8e88eSDag-Erling Smørgrav	}
1138*59c8e88eSDag-Erling Smørgrav
1139*59c8e88eSDag-Erling Smørgrav	return (rv);
1140*59c8e88eSDag-Erling Smørgrav}
1141*59c8e88eSDag-Erling Smørgrav
1142*59c8e88eSDag-Erling Smørgravint
1143*59c8e88eSDag-Erling Smørgravsr_crypto_rw(struct sr_workunit *wu)
1144*59c8e88eSDag-Erling Smørgrav{
1145*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu;
1146*59c8e88eSDag-Erling Smørgrav	daddr_t			blk;
1147*59c8e88eSDag-Erling Smørgrav	int			s, rv = 0;
1148*59c8e88eSDag-Erling Smørgrav
1149*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_DIS, "%s: sr_crypto_rw wu %p\n",
1150*59c8e88eSDag-Erling Smørgrav	    DEVNAME(wu->swu_dis->sd_sc), wu);
1151*59c8e88eSDag-Erling Smørgrav
1152*59c8e88eSDag-Erling Smørgrav	if (sr_validate_io(wu, &blk, "sr_crypto_rw"))
1153*59c8e88eSDag-Erling Smørgrav		return (1);
1154*59c8e88eSDag-Erling Smørgrav
1155*59c8e88eSDag-Erling Smørgrav	if (wu->swu_xs->flags & SCSI_DATA_OUT) {
1156*59c8e88eSDag-Erling Smørgrav		crwu = sr_crypto_wu_get(wu, 1);
1157*59c8e88eSDag-Erling Smørgrav		if (crwu == NULL)
1158*59c8e88eSDag-Erling Smørgrav			return (1);
1159*59c8e88eSDag-Erling Smørgrav		crwu->cr_crp->crp_callback = sr_crypto_write;
1160*59c8e88eSDag-Erling Smørgrav		s = splvm();
1161*59c8e88eSDag-Erling Smørgrav		rv = crypto_invoke(crwu->cr_crp);
1162*59c8e88eSDag-Erling Smørgrav		if (rv == 0)
1163*59c8e88eSDag-Erling Smørgrav			rv = crwu->cr_crp->crp_etype;
1164*59c8e88eSDag-Erling Smørgrav		splx(s);
1165*59c8e88eSDag-Erling Smørgrav	} else
1166*59c8e88eSDag-Erling Smørgrav		rv = sr_crypto_dev_rw(wu, NULL);
1167*59c8e88eSDag-Erling Smørgrav
1168*59c8e88eSDag-Erling Smørgrav	return (rv);
1169*59c8e88eSDag-Erling Smørgrav}
1170*59c8e88eSDag-Erling Smørgrav
1171*59c8e88eSDag-Erling Smørgravint
1172*59c8e88eSDag-Erling Smørgravsr_crypto_write(struct cryptop *crp)
1173*59c8e88eSDag-Erling Smørgrav{
1174*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu = crp->crp_opaque;
1175*59c8e88eSDag-Erling Smørgrav	struct sr_workunit	*wu = crwu->cr_wu;
1176*59c8e88eSDag-Erling Smørgrav	int			s;
1177*59c8e88eSDag-Erling Smørgrav
1178*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_INTR, "%s: sr_crypto_write: wu %x xs: %x\n",
1179*59c8e88eSDag-Erling Smørgrav	    DEVNAME(wu->swu_dis->sd_sc), wu, wu->swu_xs);
1180*59c8e88eSDag-Erling Smørgrav
1181*59c8e88eSDag-Erling Smørgrav	if (crp->crp_etype) {
1182*59c8e88eSDag-Erling Smørgrav		/* fail io */
1183*59c8e88eSDag-Erling Smørgrav		wu->swu_xs->error = XS_DRIVER_STUFFUP;
1184*59c8e88eSDag-Erling Smørgrav		s = splbio();
1185*59c8e88eSDag-Erling Smørgrav		sr_crypto_finish_io(wu);
1186*59c8e88eSDag-Erling Smørgrav		splx(s);
1187*59c8e88eSDag-Erling Smørgrav	}
1188*59c8e88eSDag-Erling Smørgrav
1189*59c8e88eSDag-Erling Smørgrav	return (sr_crypto_dev_rw(wu, crwu));
1190*59c8e88eSDag-Erling Smørgrav}
1191*59c8e88eSDag-Erling Smørgrav
1192*59c8e88eSDag-Erling Smørgravint
1193*59c8e88eSDag-Erling Smørgravsr_crypto_dev_rw(struct sr_workunit *wu, struct sr_crypto_wu *crwu)
1194*59c8e88eSDag-Erling Smørgrav{
1195*59c8e88eSDag-Erling Smørgrav	struct sr_discipline	*sd = wu->swu_dis;
1196*59c8e88eSDag-Erling Smørgrav	struct scsi_xfer	*xs = wu->swu_xs;
1197*59c8e88eSDag-Erling Smørgrav	struct sr_ccb		*ccb;
1198*59c8e88eSDag-Erling Smørgrav	struct uio		*uio;
1199*59c8e88eSDag-Erling Smørgrav	daddr_t			blk;
1200*59c8e88eSDag-Erling Smørgrav
1201*59c8e88eSDag-Erling Smørgrav	blk = wu->swu_blk_start;
1202*59c8e88eSDag-Erling Smørgrav	blk += sd->sd_meta->ssd_data_offset;
1203*59c8e88eSDag-Erling Smørgrav
1204*59c8e88eSDag-Erling Smørgrav	ccb = sr_ccb_rw(sd, 0, blk, xs->datalen, xs->data, xs->flags, 0);
1205*59c8e88eSDag-Erling Smørgrav	if (!ccb) {
1206*59c8e88eSDag-Erling Smørgrav		/* should never happen but handle more gracefully */
1207*59c8e88eSDag-Erling Smørgrav		printf("%s: %s: too many ccbs queued\n",
1208*59c8e88eSDag-Erling Smørgrav		    DEVNAME(sd->sd_sc), sd->sd_meta->ssd_devname);
1209*59c8e88eSDag-Erling Smørgrav		goto bad;
1210*59c8e88eSDag-Erling Smørgrav	}
1211*59c8e88eSDag-Erling Smørgrav	if (!ISSET(xs->flags, SCSI_DATA_IN)) {
1212*59c8e88eSDag-Erling Smørgrav		uio = crwu->cr_crp->crp_buf;
1213*59c8e88eSDag-Erling Smørgrav		ccb->ccb_buf.b_data = uio->uio_iov->iov_base;
1214*59c8e88eSDag-Erling Smørgrav		ccb->ccb_opaque = crwu;
1215*59c8e88eSDag-Erling Smørgrav	}
1216*59c8e88eSDag-Erling Smørgrav	sr_wu_enqueue_ccb(wu, ccb);
1217*59c8e88eSDag-Erling Smørgrav	sr_schedule_wu(wu);
1218*59c8e88eSDag-Erling Smørgrav
1219*59c8e88eSDag-Erling Smørgrav	return (0);
1220*59c8e88eSDag-Erling Smørgrav
1221*59c8e88eSDag-Erling Smørgravbad:
1222*59c8e88eSDag-Erling Smørgrav	/* wu is unwound by sr_wu_put */
1223*59c8e88eSDag-Erling Smørgrav	if (crwu)
1224*59c8e88eSDag-Erling Smørgrav		crwu->cr_crp->crp_etype = EINVAL;
1225*59c8e88eSDag-Erling Smørgrav	return (1);
1226*59c8e88eSDag-Erling Smørgrav}
1227*59c8e88eSDag-Erling Smørgrav
1228*59c8e88eSDag-Erling Smørgravvoid
1229*59c8e88eSDag-Erling Smørgravsr_crypto_done(struct sr_workunit *wu)
1230*59c8e88eSDag-Erling Smørgrav{
1231*59c8e88eSDag-Erling Smørgrav	struct scsi_xfer	*xs = wu->swu_xs;
1232*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu;
1233*59c8e88eSDag-Erling Smørgrav	struct sr_ccb		*ccb;
1234*59c8e88eSDag-Erling Smørgrav	int			s;
1235*59c8e88eSDag-Erling Smørgrav
1236*59c8e88eSDag-Erling Smørgrav	/* If this was a successful read, initiate decryption of the data. */
1237*59c8e88eSDag-Erling Smørgrav	if (ISSET(xs->flags, SCSI_DATA_IN) && xs->error == XS_NOERROR) {
1238*59c8e88eSDag-Erling Smørgrav		/* only fails on implementation error */
1239*59c8e88eSDag-Erling Smørgrav		crwu = sr_crypto_wu_get(wu, 0);
1240*59c8e88eSDag-Erling Smørgrav		if (crwu == NULL)
1241*59c8e88eSDag-Erling Smørgrav			panic("sr_crypto_intr: no wu");
1242*59c8e88eSDag-Erling Smørgrav		crwu->cr_crp->crp_callback = sr_crypto_read;
1243*59c8e88eSDag-Erling Smørgrav		ccb = TAILQ_FIRST(&wu->swu_ccb);
1244*59c8e88eSDag-Erling Smørgrav		if (ccb == NULL)
1245*59c8e88eSDag-Erling Smørgrav			panic("sr_crypto_done: no ccbs on workunit");
1246*59c8e88eSDag-Erling Smørgrav		ccb->ccb_opaque = crwu;
1247*59c8e88eSDag-Erling Smørgrav		DNPRINTF(SR_D_INTR, "%s: sr_crypto_intr: crypto_invoke %p\n",
1248*59c8e88eSDag-Erling Smørgrav		    DEVNAME(wu->swu_dis->sd_sc), crwu->cr_crp);
1249*59c8e88eSDag-Erling Smørgrav		s = splvm();
1250*59c8e88eSDag-Erling Smørgrav		crypto_invoke(crwu->cr_crp);
1251*59c8e88eSDag-Erling Smørgrav		splx(s);
1252*59c8e88eSDag-Erling Smørgrav		return;
1253*59c8e88eSDag-Erling Smørgrav	}
1254*59c8e88eSDag-Erling Smørgrav
1255*59c8e88eSDag-Erling Smørgrav	s = splbio();
1256*59c8e88eSDag-Erling Smørgrav	sr_crypto_finish_io(wu);
1257*59c8e88eSDag-Erling Smørgrav	splx(s);
1258*59c8e88eSDag-Erling Smørgrav}
1259*59c8e88eSDag-Erling Smørgrav
1260*59c8e88eSDag-Erling Smørgravvoid
1261*59c8e88eSDag-Erling Smørgravsr_crypto_finish_io(struct sr_workunit *wu)
1262*59c8e88eSDag-Erling Smørgrav{
1263*59c8e88eSDag-Erling Smørgrav	struct sr_discipline	*sd = wu->swu_dis;
1264*59c8e88eSDag-Erling Smørgrav	struct scsi_xfer	*xs = wu->swu_xs;
1265*59c8e88eSDag-Erling Smørgrav	struct sr_ccb		*ccb;
1266*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG
1267*59c8e88eSDag-Erling Smørgrav	struct sr_softc		*sc = sd->sd_sc;
1268*59c8e88eSDag-Erling Smørgrav#endif /* SR_DEBUG */
1269*59c8e88eSDag-Erling Smørgrav
1270*59c8e88eSDag-Erling Smørgrav	splassert(IPL_BIO);
1271*59c8e88eSDag-Erling Smørgrav
1272*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_INTR, "%s: sr_crypto_finish_io: wu %x xs: %x\n",
1273*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sc), wu, xs);
1274*59c8e88eSDag-Erling Smørgrav
1275*59c8e88eSDag-Erling Smørgrav	if (wu->swu_cb_active == 1)
1276*59c8e88eSDag-Erling Smørgrav		panic("%s: sr_crypto_finish_io", DEVNAME(sd->sd_sc));
1277*59c8e88eSDag-Erling Smørgrav	TAILQ_FOREACH(ccb, &wu->swu_ccb, ccb_link) {
1278*59c8e88eSDag-Erling Smørgrav		if (ccb->ccb_opaque == NULL)
1279*59c8e88eSDag-Erling Smørgrav			continue;
1280*59c8e88eSDag-Erling Smørgrav		sr_crypto_wu_put(ccb->ccb_opaque);
1281*59c8e88eSDag-Erling Smørgrav	}
1282*59c8e88eSDag-Erling Smørgrav
1283*59c8e88eSDag-Erling Smørgrav	sr_scsi_done(sd, xs);
1284*59c8e88eSDag-Erling Smørgrav}
1285*59c8e88eSDag-Erling Smørgrav
1286*59c8e88eSDag-Erling Smørgravint
1287*59c8e88eSDag-Erling Smørgravsr_crypto_read(struct cryptop *crp)
1288*59c8e88eSDag-Erling Smørgrav{
1289*59c8e88eSDag-Erling Smørgrav	struct sr_crypto_wu	*crwu = crp->crp_opaque;
1290*59c8e88eSDag-Erling Smørgrav	struct sr_workunit	*wu = crwu->cr_wu;
1291*59c8e88eSDag-Erling Smørgrav	int			s;
1292*59c8e88eSDag-Erling Smørgrav
1293*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_INTR, "%s: sr_crypto_read: wu %x xs: %x\n",
1294*59c8e88eSDag-Erling Smørgrav	    DEVNAME(wu->swu_dis->sd_sc), wu, wu->swu_xs);
1295*59c8e88eSDag-Erling Smørgrav
1296*59c8e88eSDag-Erling Smørgrav	if (crp->crp_etype)
1297*59c8e88eSDag-Erling Smørgrav		wu->swu_xs->error = XS_DRIVER_STUFFUP;
1298*59c8e88eSDag-Erling Smørgrav
1299*59c8e88eSDag-Erling Smørgrav	s = splbio();
1300*59c8e88eSDag-Erling Smørgrav	sr_crypto_finish_io(wu);
1301*59c8e88eSDag-Erling Smørgrav	splx(s);
1302*59c8e88eSDag-Erling Smørgrav
1303*59c8e88eSDag-Erling Smørgrav	return (0);
1304*59c8e88eSDag-Erling Smørgrav}
1305*59c8e88eSDag-Erling Smørgrav
1306*59c8e88eSDag-Erling Smørgravvoid
1307*59c8e88eSDag-Erling Smørgravsr_crypto_hotplug(struct sr_discipline *sd, struct disk *diskp, int action)
1308*59c8e88eSDag-Erling Smørgrav{
1309*59c8e88eSDag-Erling Smørgrav	DNPRINTF(SR_D_MISC, "%s: sr_crypto_hotplug: %s %d\n",
1310*59c8e88eSDag-Erling Smørgrav	    DEVNAME(sd->sd_sc), diskp->dk_name, action);
1311*59c8e88eSDag-Erling Smørgrav}
1312*59c8e88eSDag-Erling Smørgrav
1313*59c8e88eSDag-Erling Smørgrav#ifdef SR_DEBUG0
1314*59c8e88eSDag-Erling Smørgravvoid
1315*59c8e88eSDag-Erling Smørgravsr_crypto_dumpkeys(struct sr_discipline *sd)
1316*59c8e88eSDag-Erling Smørgrav{
1317*59c8e88eSDag-Erling Smørgrav	int			i, j;
1318*59c8e88eSDag-Erling Smørgrav
1319*59c8e88eSDag-Erling Smørgrav	printf("sr_crypto_dumpkeys:\n");
1320*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < SR_CRYPTO_MAXKEYS; i++) {
1321*59c8e88eSDag-Erling Smørgrav		printf("\tscm_key[%d]: 0x", i);
1322*59c8e88eSDag-Erling Smørgrav		for (j = 0; j < SR_CRYPTO_KEYBYTES; j++) {
1323*59c8e88eSDag-Erling Smørgrav			printf("%02x",
1324*59c8e88eSDag-Erling Smørgrav			    sd->mds.mdd_crypto.scr_meta->scm_key[i][j]);
1325*59c8e88eSDag-Erling Smørgrav		}
1326*59c8e88eSDag-Erling Smørgrav		printf("\n");
1327*59c8e88eSDag-Erling Smørgrav	}
1328*59c8e88eSDag-Erling Smørgrav	printf("sr_crypto_dumpkeys: runtime data keys:\n");
1329*59c8e88eSDag-Erling Smørgrav	for (i = 0; i < SR_CRYPTO_MAXKEYS; i++) {
1330*59c8e88eSDag-Erling Smørgrav		printf("\tscr_key[%d]: 0x", i);
1331*59c8e88eSDag-Erling Smørgrav		for (j = 0; j < SR_CRYPTO_KEYBYTES; j++) {
1332*59c8e88eSDag-Erling Smørgrav			printf("%02x",
1333*59c8e88eSDag-Erling Smørgrav			    sd->mds.mdd_crypto.scr_key[i][j]);
1334*59c8e88eSDag-Erling Smørgrav		}
1335*59c8e88eSDag-Erling Smørgrav		printf("\n");
1336*59c8e88eSDag-Erling Smørgrav	}
1337*59c8e88eSDag-Erling Smørgrav}
1338*59c8e88eSDag-Erling Smørgrav#endif	/* SR_DEBUG */
1339