xref: /freebsd/sys/geom/eli/g_eli.c (revision 830940567b49bb0c08dfaed40418999e76616909)
1 /*-
2  * Copyright (c) 2005-2006 Pawel Jakub Dawidek <pjd@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/linker.h>
34 #include <sys/module.h>
35 #include <sys/lock.h>
36 #include <sys/mutex.h>
37 #include <sys/bio.h>
38 #include <sys/sysctl.h>
39 #include <sys/malloc.h>
40 #include <sys/eventhandler.h>
41 #include <sys/kthread.h>
42 #include <sys/proc.h>
43 #include <sys/sched.h>
44 #include <sys/smp.h>
45 #include <sys/uio.h>
46 #include <sys/vnode.h>
47 
48 #include <vm/uma.h>
49 
50 #include <geom/geom.h>
51 #include <geom/eli/g_eli.h>
52 #include <geom/eli/pkcs5v2.h>
53 
54 
55 MALLOC_DEFINE(M_ELI, "eli data", "GEOM_ELI Data");
56 
57 SYSCTL_DECL(_kern_geom);
58 SYSCTL_NODE(_kern_geom, OID_AUTO, eli, CTLFLAG_RW, 0, "GEOM_ELI stuff");
59 u_int g_eli_debug = 0;
60 TUNABLE_INT("kern.geom.eli.debug", &g_eli_debug);
61 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, debug, CTLFLAG_RW, &g_eli_debug, 0,
62     "Debug level");
63 static u_int g_eli_tries = 3;
64 TUNABLE_INT("kern.geom.eli.tries", &g_eli_tries);
65 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, tries, CTLFLAG_RW, &g_eli_tries, 0,
66     "Number of tries for entering the passphrase");
67 static u_int g_eli_visible_passphrase = 0;
68 TUNABLE_INT("kern.geom.eli.visible_passphrase", &g_eli_visible_passphrase);
69 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, visible_passphrase, CTLFLAG_RW,
70     &g_eli_visible_passphrase, 0,
71     "Turn on echo when entering the passphrase (for debug purposes only!!)");
72 u_int g_eli_overwrites = 5;
73 TUNABLE_INT("kern.geom.eli.overwrites", &g_eli_overwrites);
74 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, overwrites, CTLFLAG_RW, &g_eli_overwrites,
75     0, "Number of times on-disk keys should be overwritten when destroying them");
76 static u_int g_eli_threads = 0;
77 TUNABLE_INT("kern.geom.eli.threads", &g_eli_threads);
78 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, threads, CTLFLAG_RW, &g_eli_threads, 0,
79     "Number of threads doing crypto work");
80 u_int g_eli_batch = 0;
81 TUNABLE_INT("kern.geom.eli.batch", &g_eli_batch);
82 SYSCTL_UINT(_kern_geom_eli, OID_AUTO, batch, CTLFLAG_RW, &g_eli_batch, 0,
83     "Use crypto operations batching");
84 
85 static eventhandler_tag g_eli_pre_sync = NULL;
86 
87 static int g_eli_destroy_geom(struct gctl_req *req, struct g_class *mp,
88     struct g_geom *gp);
89 static void g_eli_init(struct g_class *mp);
90 static void g_eli_fini(struct g_class *mp);
91 
92 static g_taste_t g_eli_taste;
93 static g_dumpconf_t g_eli_dumpconf;
94 
95 struct g_class g_eli_class = {
96 	.name = G_ELI_CLASS_NAME,
97 	.version = G_VERSION,
98 	.ctlreq = g_eli_config,
99 	.taste = g_eli_taste,
100 	.destroy_geom = g_eli_destroy_geom,
101 	.init = g_eli_init,
102 	.fini = g_eli_fini
103 };
104 
105 
106 /*
107  * Code paths:
108  * BIO_READ:
109  *	g_eli_start -> g_io_request -> g_eli_read_done -> g_eli_crypto_run -> g_eli_crypto_read_done -> g_io_deliver
110  * BIO_WRITE:
111  *	g_eli_start -> g_eli_crypto_run -> g_eli_crypto_write_done -> g_io_request -> g_eli_write_done -> g_io_deliver
112  */
113 
114 
115 /*
116  * EAGAIN from crypto(9) means, that we were probably balanced to another crypto
117  * accelerator or something like this.
118  * The function updates the SID and rerun the operation.
119  */
120 int
121 g_eli_crypto_rerun(struct cryptop *crp)
122 {
123 	struct g_eli_softc *sc;
124 	struct g_eli_worker *wr;
125 	struct bio *bp;
126 	int error;
127 
128 	bp = (struct bio *)crp->crp_opaque;
129 	sc = bp->bio_to->geom->softc;
130 	LIST_FOREACH(wr, &sc->sc_workers, w_next) {
131 		if (wr->w_number == bp->bio_pflags)
132 			break;
133 	}
134 	KASSERT(wr != NULL, ("Invalid worker (%u).", bp->bio_pflags));
135 	G_ELI_DEBUG(1, "Rerunning crypto %s request (sid: %ju -> %ju).",
136 	    bp->bio_cmd == BIO_READ ? "READ" : "WRITE", (uintmax_t)wr->w_sid,
137 	    (uintmax_t)crp->crp_sid);
138 	wr->w_sid = crp->crp_sid;
139 	crp->crp_etype = 0;
140 	error = crypto_dispatch(crp);
141 	if (error == 0)
142 		return (0);
143 	G_ELI_DEBUG(1, "%s: crypto_dispatch() returned %d.", __func__, error);
144 	crp->crp_etype = error;
145 	return (error);
146 }
147 
148 /*
149  * The function is called afer reading encrypted data from the provider.
150  *
151  * g_eli_start -> g_io_request -> G_ELI_READ_DONE -> g_eli_crypto_run -> g_eli_crypto_read_done -> g_io_deliver
152  */
153 void
154 g_eli_read_done(struct bio *bp)
155 {
156 	struct g_eli_softc *sc;
157 	struct bio *pbp;
158 
159 	G_ELI_LOGREQ(2, bp, "Request done.");
160 	pbp = bp->bio_parent;
161 	if (pbp->bio_error == 0)
162 		pbp->bio_error = bp->bio_error;
163 	/*
164 	 * Do we have all sectors already?
165 	 */
166 	pbp->bio_inbed++;
167 	if (pbp->bio_inbed < pbp->bio_children)
168 		return;
169 	g_destroy_bio(bp);
170 	if (pbp->bio_error != 0) {
171 		G_ELI_LOGREQ(0, pbp, "%s() failed", __func__);
172 		pbp->bio_completed = 0;
173 		if (pbp->bio_driver2 != NULL) {
174 			free(pbp->bio_driver2, M_ELI);
175 			pbp->bio_driver2 = NULL;
176 		}
177 		g_io_deliver(pbp, pbp->bio_error);
178 		return;
179 	}
180 	sc = pbp->bio_to->geom->softc;
181 	mtx_lock(&sc->sc_queue_mtx);
182 	bioq_insert_tail(&sc->sc_queue, pbp);
183 	mtx_unlock(&sc->sc_queue_mtx);
184 	wakeup(sc);
185 }
186 
187 /*
188  * The function is called after we encrypt and write data.
189  *
190  * g_eli_start -> g_eli_crypto_run -> g_eli_crypto_write_done -> g_io_request -> G_ELI_WRITE_DONE -> g_io_deliver
191  */
192 void
193 g_eli_write_done(struct bio *bp)
194 {
195 	struct bio *pbp;
196 
197 	G_ELI_LOGREQ(2, bp, "Request done.");
198 	pbp = bp->bio_parent;
199 	if (pbp->bio_error == 0) {
200 		if (bp->bio_error != 0)
201 			pbp->bio_error = bp->bio_error;
202 	}
203 	/*
204 	 * Do we have all sectors already?
205 	 */
206 	pbp->bio_inbed++;
207 	if (pbp->bio_inbed < pbp->bio_children)
208 		return;
209 	free(pbp->bio_driver2, M_ELI);
210 	pbp->bio_driver2 = NULL;
211 	if (pbp->bio_error != 0) {
212 		G_ELI_LOGREQ(0, pbp, "Crypto WRITE request failed (error=%d).",
213 		    pbp->bio_error);
214 		pbp->bio_completed = 0;
215 	}
216 	g_destroy_bio(bp);
217 	/*
218 	 * Write is finished, send it up.
219 	 */
220 	pbp->bio_completed = pbp->bio_length;
221 	g_io_deliver(pbp, pbp->bio_error);
222 }
223 
224 /*
225  * This function should never be called, but GEOM made as it set ->orphan()
226  * method for every geom.
227  */
228 static void
229 g_eli_orphan_spoil_assert(struct g_consumer *cp)
230 {
231 
232 	panic("Function %s() called for %s.", __func__, cp->geom->name);
233 }
234 
235 static void
236 g_eli_orphan(struct g_consumer *cp)
237 {
238 	struct g_eli_softc *sc;
239 
240 	g_topology_assert();
241 	sc = cp->geom->softc;
242 	if (sc == NULL)
243 		return;
244 	g_eli_destroy(sc, 1);
245 }
246 
247 /*
248  * BIO_READ : G_ELI_START -> g_io_request -> g_eli_read_done -> g_eli_crypto_run -> g_eli_crypto_read_done -> g_io_deliver
249  * BIO_WRITE: G_ELI_START -> g_eli_crypto_run -> g_eli_crypto_write_done -> g_io_request -> g_eli_write_done -> g_io_deliver
250  */
251 static void
252 g_eli_start(struct bio *bp)
253 {
254 	struct g_eli_softc *sc;
255 	struct g_consumer *cp;
256 	struct bio *cbp;
257 
258 	sc = bp->bio_to->geom->softc;
259 	KASSERT(sc != NULL,
260 	    ("Provider's error should be set (error=%d)(device=%s).",
261 	    bp->bio_to->error, bp->bio_to->name));
262 	G_ELI_LOGREQ(2, bp, "Request received.");
263 
264 	switch (bp->bio_cmd) {
265 	case BIO_READ:
266 	case BIO_WRITE:
267 	case BIO_GETATTR:
268 	case BIO_FLUSH:
269 		break;
270 	case BIO_DELETE:
271 		/*
272 		 * We could eventually support BIO_DELETE request.
273 		 * It could be done by overwritting requested sector with
274 		 * random data g_eli_overwrites number of times.
275 		 */
276 	default:
277 		g_io_deliver(bp, EOPNOTSUPP);
278 		return;
279 	}
280 	cbp = g_clone_bio(bp);
281 	if (cbp == NULL) {
282 		g_io_deliver(bp, ENOMEM);
283 		return;
284 	}
285 	switch (bp->bio_cmd) {
286 	case BIO_READ:
287 		if (!(sc->sc_flags & G_ELI_FLAG_AUTH)) {
288 			bp->bio_driver2 = NULL;
289 			cbp->bio_done = g_eli_read_done;
290 			cp = LIST_FIRST(&sc->sc_geom->consumer);
291 			cbp->bio_to = cp->provider;
292 			G_ELI_LOGREQ(2, cbp, "Sending request.");
293 			/*
294 			 * Read encrypted data from provider.
295 			 */
296 			g_io_request(cbp, cp);
297 			break;
298 		}
299 		bp->bio_pflags = 255;
300 		/* FALLTHROUGH */
301 	case BIO_WRITE:
302 		bp->bio_driver1 = cbp;
303 		mtx_lock(&sc->sc_queue_mtx);
304 		bioq_insert_tail(&sc->sc_queue, bp);
305 		mtx_unlock(&sc->sc_queue_mtx);
306 		wakeup(sc);
307 		break;
308 	case BIO_GETATTR:
309 	case BIO_FLUSH:
310 		cbp->bio_done = g_std_done;
311 		cp = LIST_FIRST(&sc->sc_geom->consumer);
312 		cbp->bio_to = cp->provider;
313 		G_ELI_LOGREQ(2, cbp, "Sending request.");
314 		g_io_request(cbp, cp);
315 		break;
316 	}
317 }
318 
319 /*
320  * This is the main function for kernel worker thread when we don't have
321  * hardware acceleration and we have to do cryptography in software.
322  * Dedicated thread is needed, so we don't slow down g_up/g_down GEOM
323  * threads with crypto work.
324  */
325 static void
326 g_eli_worker(void *arg)
327 {
328 	struct g_eli_softc *sc;
329 	struct g_eli_worker *wr;
330 	struct bio *bp;
331 
332 	wr = arg;
333 	sc = wr->w_softc;
334 #ifdef SMP
335 	/* Before sched_bind() to a CPU, wait for all CPUs to go on-line. */
336 	if (mp_ncpus > 1 && sc->sc_crypto == G_ELI_CRYPTO_SW &&
337 	    g_eli_threads == 0) {
338 		while (!smp_started)
339 			tsleep(wr, 0, "geli:smp", hz / 4);
340 	}
341 #endif
342 	thread_lock(curthread);
343 	sched_prio(curthread, PRIBIO);
344 	if (sc->sc_crypto == G_ELI_CRYPTO_SW && g_eli_threads == 0)
345 		sched_bind(curthread, wr->w_number);
346 	thread_unlock(curthread);
347 
348 	G_ELI_DEBUG(1, "Thread %s started.", curthread->td_proc->p_comm);
349 
350 	for (;;) {
351 		mtx_lock(&sc->sc_queue_mtx);
352 		bp = bioq_takefirst(&sc->sc_queue);
353 		if (bp == NULL) {
354 			if (sc->sc_flags & G_ELI_FLAG_DESTROY) {
355 				LIST_REMOVE(wr, w_next);
356 				crypto_freesession(wr->w_sid);
357 				free(wr, M_ELI);
358 				G_ELI_DEBUG(1, "Thread %s exiting.",
359 				    curthread->td_proc->p_comm);
360 				wakeup(&sc->sc_workers);
361 				mtx_unlock(&sc->sc_queue_mtx);
362 				kproc_exit(0);
363 			}
364 			msleep(sc, &sc->sc_queue_mtx, PRIBIO | PDROP,
365 			    "geli:w", 0);
366 			continue;
367 		}
368 		mtx_unlock(&sc->sc_queue_mtx);
369 		if (bp->bio_cmd == BIO_READ && bp->bio_pflags == 255)
370 			g_eli_auth_read(sc, bp);
371 		else if (sc->sc_flags & G_ELI_FLAG_AUTH)
372 			g_eli_auth_run(wr, bp);
373 		else
374 			g_eli_crypto_run(wr, bp);
375 	}
376 }
377 
378 /*
379  * Here we generate IV. It is unique for every sector.
380  */
381 void
382 g_eli_crypto_ivgen(struct g_eli_softc *sc, off_t offset, u_char *iv,
383     size_t size)
384 {
385 	u_char off[8], hash[SHA256_DIGEST_LENGTH];
386 	SHA256_CTX ctx;
387 
388 	if (!(sc->sc_flags & G_ELI_FLAG_NATIVE_BYTE_ORDER))
389 		le64enc(off, (uint64_t)offset);
390 	/* Copy precalculated SHA256 context for IV-Key. */
391 	bcopy(&sc->sc_ivctx, &ctx, sizeof(ctx));
392 	SHA256_Update(&ctx, (uint8_t *)&offset, sizeof(offset));
393 	SHA256_Final(hash, &ctx);
394 	bcopy(hash, iv, size);
395 }
396 
397 int
398 g_eli_read_metadata(struct g_class *mp, struct g_provider *pp,
399     struct g_eli_metadata *md)
400 {
401 	struct g_geom *gp;
402 	struct g_consumer *cp;
403 	u_char *buf = NULL;
404 	int error;
405 
406 	g_topology_assert();
407 
408 	gp = g_new_geomf(mp, "eli:taste");
409 	gp->start = g_eli_start;
410 	gp->access = g_std_access;
411 	/*
412 	 * g_eli_read_metadata() is always called from the event thread.
413 	 * Our geom is created and destroyed in the same event, so there
414 	 * could be no orphan nor spoil event in the meantime.
415 	 */
416 	gp->orphan = g_eli_orphan_spoil_assert;
417 	gp->spoiled = g_eli_orphan_spoil_assert;
418 	cp = g_new_consumer(gp);
419 	error = g_attach(cp, pp);
420 	if (error != 0)
421 		goto end;
422 	error = g_access(cp, 1, 0, 0);
423 	if (error != 0)
424 		goto end;
425 	g_topology_unlock();
426 	buf = g_read_data(cp, pp->mediasize - pp->sectorsize, pp->sectorsize,
427 	    &error);
428 	g_topology_lock();
429 	if (buf == NULL)
430 		goto end;
431 	eli_metadata_decode(buf, md);
432 end:
433 	if (buf != NULL)
434 		g_free(buf);
435 	if (cp->provider != NULL) {
436 		if (cp->acr == 1)
437 			g_access(cp, -1, 0, 0);
438 		g_detach(cp);
439 	}
440 	g_destroy_consumer(cp);
441 	g_destroy_geom(gp);
442 	return (error);
443 }
444 
445 /*
446  * The function is called when we had last close on provider and user requested
447  * to close it when this situation occur.
448  */
449 static void
450 g_eli_last_close(struct g_eli_softc *sc)
451 {
452 	struct g_geom *gp;
453 	struct g_provider *pp;
454 	char ppname[64];
455 	int error;
456 
457 	g_topology_assert();
458 	gp = sc->sc_geom;
459 	pp = LIST_FIRST(&gp->provider);
460 	strlcpy(ppname, pp->name, sizeof(ppname));
461 	error = g_eli_destroy(sc, 1);
462 	KASSERT(error == 0, ("Cannot detach %s on last close (error=%d).",
463 	    ppname, error));
464 	G_ELI_DEBUG(0, "Detached %s on last close.", ppname);
465 }
466 
467 int
468 g_eli_access(struct g_provider *pp, int dr, int dw, int de)
469 {
470 	struct g_eli_softc *sc;
471 	struct g_geom *gp;
472 
473 	gp = pp->geom;
474 	sc = gp->softc;
475 
476 	if (dw > 0) {
477 		if (sc->sc_flags & G_ELI_FLAG_RO) {
478 			/* Deny write attempts. */
479 			return (EROFS);
480 		}
481 		/* Someone is opening us for write, we need to remember that. */
482 		sc->sc_flags |= G_ELI_FLAG_WOPEN;
483 		return (0);
484 	}
485 	/* Is this the last close? */
486 	if (pp->acr + dr > 0 || pp->acw + dw > 0 || pp->ace + de > 0)
487 		return (0);
488 
489 	/*
490 	 * Automatically detach on last close if requested.
491 	 */
492 	if ((sc->sc_flags & G_ELI_FLAG_RW_DETACH) ||
493 	    (sc->sc_flags & G_ELI_FLAG_WOPEN)) {
494 		g_eli_last_close(sc);
495 	}
496 	return (0);
497 }
498 
499 static int
500 g_eli_cpu_is_disabled(int cpu)
501 {
502 #ifdef SMP
503 	return ((hlt_cpus_mask & (1 << cpu)) != 0);
504 #else
505 	return (0);
506 #endif
507 }
508 
509 struct g_geom *
510 g_eli_create(struct gctl_req *req, struct g_class *mp, struct g_provider *bpp,
511     const struct g_eli_metadata *md, const u_char *mkey, int nkey)
512 {
513 	struct g_eli_softc *sc;
514 	struct g_eli_worker *wr;
515 	struct g_geom *gp;
516 	struct g_provider *pp;
517 	struct g_consumer *cp;
518 	struct cryptoini crie, cria;
519 	u_int i, threads;
520 	int error;
521 
522 	G_ELI_DEBUG(1, "Creating device %s%s.", bpp->name, G_ELI_SUFFIX);
523 
524 	gp = g_new_geomf(mp, "%s%s", bpp->name, G_ELI_SUFFIX);
525 	gp->softc = NULL;	/* for a moment */
526 
527 	sc = malloc(sizeof(*sc), M_ELI, M_WAITOK | M_ZERO);
528 	gp->start = g_eli_start;
529 	/*
530 	 * Spoiling cannot happen actually, because we keep provider open for
531 	 * writing all the time or provider is read-only.
532 	 */
533 	gp->spoiled = g_eli_orphan_spoil_assert;
534 	gp->orphan = g_eli_orphan;
535 	gp->dumpconf = g_eli_dumpconf;
536 	/*
537 	 * If detach-on-last-close feature is not enabled and we don't operate
538 	 * on read-only provider, we can simply use g_std_access().
539 	 */
540 	if (md->md_flags & (G_ELI_FLAG_WO_DETACH | G_ELI_FLAG_RO))
541 		gp->access = g_eli_access;
542 	else
543 		gp->access = g_std_access;
544 
545 	sc->sc_crypto = G_ELI_CRYPTO_SW;
546 	sc->sc_flags = md->md_flags;
547 	/* Backward compatibility. */
548 	if (md->md_version < 2)
549 		sc->sc_flags |= G_ELI_FLAG_NATIVE_BYTE_ORDER;
550 	sc->sc_ealgo = md->md_ealgo;
551 	sc->sc_nkey = nkey;
552 	/*
553 	 * Remember the keys in our softc structure.
554 	 */
555 	g_eli_mkey_propagate(sc, mkey);
556 	sc->sc_ekeylen = md->md_keylen;
557 
558 	if (sc->sc_flags & G_ELI_FLAG_AUTH) {
559 		sc->sc_akeylen = sizeof(sc->sc_akey) * 8;
560 		sc->sc_aalgo = md->md_aalgo;
561 		sc->sc_alen = g_eli_hashlen(sc->sc_aalgo);
562 
563 		sc->sc_data_per_sector = bpp->sectorsize - sc->sc_alen;
564 		/*
565 		 * Some hash functions (like SHA1 and RIPEMD160) generates hash
566 		 * which length is not multiple of 128 bits, but we want data
567 		 * length to be multiple of 128, so we can encrypt without
568 		 * padding. The line below rounds down data length to multiple
569 		 * of 128 bits.
570 		 */
571 		sc->sc_data_per_sector -= sc->sc_data_per_sector % 16;
572 
573 		sc->sc_bytes_per_sector =
574 		    (md->md_sectorsize - 1) / sc->sc_data_per_sector + 1;
575 		sc->sc_bytes_per_sector *= bpp->sectorsize;
576 		/*
577 		 * Precalculate SHA256 for HMAC key generation.
578 		 * This is expensive operation and we can do it only once now or
579 		 * for every access to sector, so now will be much better.
580 		 */
581 		SHA256_Init(&sc->sc_akeyctx);
582 		SHA256_Update(&sc->sc_akeyctx, sc->sc_akey,
583 		    sizeof(sc->sc_akey));
584 	}
585 
586 	/*
587 	 * Precalculate SHA256 for IV generation.
588 	 * This is expensive operation and we can do it only once now or for
589 	 * every access to sector, so now will be much better.
590 	 */
591 	SHA256_Init(&sc->sc_ivctx);
592 	SHA256_Update(&sc->sc_ivctx, sc->sc_ivkey, sizeof(sc->sc_ivkey));
593 
594 	gp->softc = sc;
595 	sc->sc_geom = gp;
596 
597 	bioq_init(&sc->sc_queue);
598 	mtx_init(&sc->sc_queue_mtx, "geli:queue", NULL, MTX_DEF);
599 
600 	pp = NULL;
601 	cp = g_new_consumer(gp);
602 	error = g_attach(cp, bpp);
603 	if (error != 0) {
604 		if (req != NULL) {
605 			gctl_error(req, "Cannot attach to %s (error=%d).",
606 			    bpp->name, error);
607 		} else {
608 			G_ELI_DEBUG(1, "Cannot attach to %s (error=%d).",
609 			    bpp->name, error);
610 		}
611 		goto failed;
612 	}
613 	/*
614 	 * Keep provider open all the time, so we can run critical tasks,
615 	 * like Master Keys deletion, without wondering if we can open
616 	 * provider or not.
617 	 * We don't open provider for writing only when user requested read-only
618 	 * access.
619 	 */
620 	if (sc->sc_flags & G_ELI_FLAG_RO)
621 		error = g_access(cp, 1, 0, 1);
622 	else
623 		error = g_access(cp, 1, 1, 1);
624 	if (error != 0) {
625 		if (req != NULL) {
626 			gctl_error(req, "Cannot access %s (error=%d).",
627 			    bpp->name, error);
628 		} else {
629 			G_ELI_DEBUG(1, "Cannot access %s (error=%d).",
630 			    bpp->name, error);
631 		}
632 		goto failed;
633 	}
634 
635 	LIST_INIT(&sc->sc_workers);
636 
637 	bzero(&crie, sizeof(crie));
638 	crie.cri_alg = sc->sc_ealgo;
639 	crie.cri_klen = sc->sc_ekeylen;
640 	crie.cri_key = sc->sc_ekey;
641 	if (sc->sc_flags & G_ELI_FLAG_AUTH) {
642 		bzero(&cria, sizeof(cria));
643 		cria.cri_alg = sc->sc_aalgo;
644 		cria.cri_klen = sc->sc_akeylen;
645 		cria.cri_key = sc->sc_akey;
646 		crie.cri_next = &cria;
647 	}
648 
649 	threads = g_eli_threads;
650 	if (threads == 0)
651 		threads = mp_ncpus;
652 	else if (threads > mp_ncpus) {
653 		/* There is really no need for too many worker threads. */
654 		threads = mp_ncpus;
655 		G_ELI_DEBUG(0, "Reducing number of threads to %u.", threads);
656 	}
657 	for (i = 0; i < threads; i++) {
658 		if (g_eli_cpu_is_disabled(i)) {
659 			G_ELI_DEBUG(1, "%s: CPU %u disabled, skipping.",
660 			    bpp->name, i);
661 			continue;
662 		}
663 		wr = malloc(sizeof(*wr), M_ELI, M_WAITOK | M_ZERO);
664 		wr->w_softc = sc;
665 		wr->w_number = i;
666 
667 		/*
668 		 * If this is the first pass, try to get hardware support.
669 		 * Use software cryptography, if we cannot get it.
670 		 */
671 		if (LIST_EMPTY(&sc->sc_workers)) {
672 			error = crypto_newsession(&wr->w_sid, &crie,
673 			    CRYPTOCAP_F_HARDWARE);
674 			if (error == 0)
675 				sc->sc_crypto = G_ELI_CRYPTO_HW;
676 		}
677 		if (sc->sc_crypto == G_ELI_CRYPTO_SW) {
678 			error = crypto_newsession(&wr->w_sid, &crie,
679 			    CRYPTOCAP_F_SOFTWARE);
680 		}
681 		if (error != 0) {
682 			free(wr, M_ELI);
683 			if (req != NULL) {
684 				gctl_error(req, "Cannot set up crypto session "
685 				    "for %s (error=%d).", bpp->name, error);
686 			} else {
687 				G_ELI_DEBUG(1, "Cannot set up crypto session "
688 				    "for %s (error=%d).", bpp->name, error);
689 			}
690 			goto failed;
691 		}
692 
693 		error = kproc_create(g_eli_worker, wr, &wr->w_proc, 0, 0,
694 		    "g_eli[%u] %s", i, bpp->name);
695 		if (error != 0) {
696 			crypto_freesession(wr->w_sid);
697 			free(wr, M_ELI);
698 			if (req != NULL) {
699 				gctl_error(req, "Cannot create kernel thread "
700 				    "for %s (error=%d).", bpp->name, error);
701 			} else {
702 				G_ELI_DEBUG(1, "Cannot create kernel thread "
703 				    "for %s (error=%d).", bpp->name, error);
704 			}
705 			goto failed;
706 		}
707 		LIST_INSERT_HEAD(&sc->sc_workers, wr, w_next);
708 		/* If we have hardware support, one thread is enough. */
709 		if (sc->sc_crypto == G_ELI_CRYPTO_HW)
710 			break;
711 	}
712 
713 	/*
714 	 * Create decrypted provider.
715 	 */
716 	pp = g_new_providerf(gp, "%s%s", bpp->name, G_ELI_SUFFIX);
717 	pp->sectorsize = md->md_sectorsize;
718 	pp->mediasize = bpp->mediasize;
719 	if (!(sc->sc_flags & G_ELI_FLAG_ONETIME))
720 		pp->mediasize -= bpp->sectorsize;
721 	if (!(sc->sc_flags & G_ELI_FLAG_AUTH))
722 		pp->mediasize -= (pp->mediasize % pp->sectorsize);
723 	else {
724 		pp->mediasize /= sc->sc_bytes_per_sector;
725 		pp->mediasize *= pp->sectorsize;
726 	}
727 
728 	g_error_provider(pp, 0);
729 
730 	G_ELI_DEBUG(0, "Device %s created.", pp->name);
731 	G_ELI_DEBUG(0, "Encryption: %s %u", g_eli_algo2str(sc->sc_ealgo),
732 	    sc->sc_ekeylen);
733 	if (sc->sc_flags & G_ELI_FLAG_AUTH)
734 		G_ELI_DEBUG(0, " Integrity: %s", g_eli_algo2str(sc->sc_aalgo));
735 	G_ELI_DEBUG(0, "    Crypto: %s",
736 	    sc->sc_crypto == G_ELI_CRYPTO_SW ? "software" : "hardware");
737 	return (gp);
738 failed:
739 	mtx_lock(&sc->sc_queue_mtx);
740 	sc->sc_flags |= G_ELI_FLAG_DESTROY;
741 	wakeup(sc);
742 	/*
743 	 * Wait for kernel threads self destruction.
744 	 */
745 	while (!LIST_EMPTY(&sc->sc_workers)) {
746 		msleep(&sc->sc_workers, &sc->sc_queue_mtx, PRIBIO,
747 		    "geli:destroy", 0);
748 	}
749 	mtx_destroy(&sc->sc_queue_mtx);
750 	if (cp->provider != NULL) {
751 		if (cp->acr == 1)
752 			g_access(cp, -1, -1, -1);
753 		g_detach(cp);
754 	}
755 	g_destroy_consumer(cp);
756 	g_destroy_geom(gp);
757 	bzero(sc, sizeof(*sc));
758 	free(sc, M_ELI);
759 	return (NULL);
760 }
761 
762 int
763 g_eli_destroy(struct g_eli_softc *sc, boolean_t force)
764 {
765 	struct g_geom *gp;
766 	struct g_provider *pp;
767 
768 	g_topology_assert();
769 
770 	if (sc == NULL)
771 		return (ENXIO);
772 
773 	gp = sc->sc_geom;
774 	pp = LIST_FIRST(&gp->provider);
775 	if (pp != NULL && (pp->acr != 0 || pp->acw != 0 || pp->ace != 0)) {
776 		if (force) {
777 			G_ELI_DEBUG(1, "Device %s is still open, so it "
778 			    "cannot be definitely removed.", pp->name);
779 		} else {
780 			G_ELI_DEBUG(1,
781 			    "Device %s is still open (r%dw%de%d).", pp->name,
782 			    pp->acr, pp->acw, pp->ace);
783 			return (EBUSY);
784 		}
785 	}
786 
787 	mtx_lock(&sc->sc_queue_mtx);
788 	sc->sc_flags |= G_ELI_FLAG_DESTROY;
789 	wakeup(sc);
790 	while (!LIST_EMPTY(&sc->sc_workers)) {
791 		msleep(&sc->sc_workers, &sc->sc_queue_mtx, PRIBIO,
792 		    "geli:destroy", 0);
793 	}
794 	mtx_destroy(&sc->sc_queue_mtx);
795 	gp->softc = NULL;
796 	bzero(sc, sizeof(*sc));
797 	free(sc, M_ELI);
798 
799 	if (pp == NULL || (pp->acr == 0 && pp->acw == 0 && pp->ace == 0))
800 		G_ELI_DEBUG(0, "Device %s destroyed.", gp->name);
801 	g_wither_geom_close(gp, ENXIO);
802 
803 	return (0);
804 }
805 
806 static int
807 g_eli_destroy_geom(struct gctl_req *req __unused,
808     struct g_class *mp __unused, struct g_geom *gp)
809 {
810 	struct g_eli_softc *sc;
811 
812 	sc = gp->softc;
813 	return (g_eli_destroy(sc, 0));
814 }
815 
816 static int
817 g_eli_keyfiles_load(struct hmac_ctx *ctx, const char *provider)
818 {
819 	u_char *keyfile, *data, *size;
820 	char *file, name[64];
821 	int i;
822 
823 	for (i = 0; ; i++) {
824 		snprintf(name, sizeof(name), "%s:geli_keyfile%d", provider, i);
825 		keyfile = preload_search_by_type(name);
826 		if (keyfile == NULL)
827 			return (i);	/* Return number of loaded keyfiles. */
828 		data = preload_search_info(keyfile, MODINFO_ADDR);
829 		if (data == NULL) {
830 			G_ELI_DEBUG(0, "Cannot find key file data for %s.",
831 			    name);
832 			return (0);
833 		}
834 		data = *(void **)data;
835 		size = preload_search_info(keyfile, MODINFO_SIZE);
836 		if (size == NULL) {
837 			G_ELI_DEBUG(0, "Cannot find key file size for %s.",
838 			    name);
839 			return (0);
840 		}
841 		file = preload_search_info(keyfile, MODINFO_NAME);
842 		if (file == NULL) {
843 			G_ELI_DEBUG(0, "Cannot find key file name for %s.",
844 			    name);
845 			return (0);
846 		}
847 		G_ELI_DEBUG(1, "Loaded keyfile %s for %s (type: %s).", file,
848 		    provider, name);
849 		g_eli_crypto_hmac_update(ctx, data, *(size_t *)size);
850 	}
851 }
852 
853 static void
854 g_eli_keyfiles_clear(const char *provider)
855 {
856 	u_char *keyfile, *data, *size;
857 	char name[64];
858 	int i;
859 
860 	for (i = 0; ; i++) {
861 		snprintf(name, sizeof(name), "%s:geli_keyfile%d", provider, i);
862 		keyfile = preload_search_by_type(name);
863 		if (keyfile == NULL)
864 			return;
865 		data = preload_search_info(keyfile, MODINFO_ADDR);
866 		size = preload_search_info(keyfile, MODINFO_SIZE);
867 		if (data == NULL || size == NULL)
868 			continue;
869 		data = *(void **)data;
870 		bzero(data, *(size_t *)size);
871 	}
872 }
873 
874 /*
875  * Tasting is only made on boot.
876  * We detect providers which should be attached before root is mounted.
877  */
878 static struct g_geom *
879 g_eli_taste(struct g_class *mp, struct g_provider *pp, int flags __unused)
880 {
881 	struct g_eli_metadata md;
882 	struct g_geom *gp;
883 	struct hmac_ctx ctx;
884 	char passphrase[256];
885 	u_char key[G_ELI_USERKEYLEN], mkey[G_ELI_DATAIVKEYLEN];
886 	u_int i, nkey, nkeyfiles, tries;
887 	int error;
888 
889 	g_trace(G_T_TOPOLOGY, "%s(%s, %s)", __func__, mp->name, pp->name);
890 	g_topology_assert();
891 
892 	if (root_mounted() || g_eli_tries == 0)
893 		return (NULL);
894 
895 	G_ELI_DEBUG(3, "Tasting %s.", pp->name);
896 
897 	error = g_eli_read_metadata(mp, pp, &md);
898 	if (error != 0)
899 		return (NULL);
900 	gp = NULL;
901 
902 	if (strcmp(md.md_magic, G_ELI_MAGIC) != 0)
903 		return (NULL);
904 	if (md.md_version > G_ELI_VERSION) {
905 		printf("geom_eli.ko module is too old to handle %s.\n",
906 		    pp->name);
907 		return (NULL);
908 	}
909 	if (md.md_provsize != pp->mediasize)
910 		return (NULL);
911 	/* Should we attach it on boot? */
912 	if (!(md.md_flags & G_ELI_FLAG_BOOT))
913 		return (NULL);
914 	if (md.md_keys == 0x00) {
915 		G_ELI_DEBUG(0, "No valid keys on %s.", pp->name);
916 		return (NULL);
917 	}
918 	if (md.md_iterations == -1) {
919 		/* If there is no passphrase, we try only once. */
920 		tries = 1;
921 	} else {
922 		/* Ask for the passphrase no more than g_eli_tries times. */
923 		tries = g_eli_tries;
924 	}
925 
926 	for (i = 0; i < tries; i++) {
927 		g_eli_crypto_hmac_init(&ctx, NULL, 0);
928 
929 		/*
930 		 * Load all key files.
931 		 */
932 		nkeyfiles = g_eli_keyfiles_load(&ctx, pp->name);
933 
934 		if (nkeyfiles == 0 && md.md_iterations == -1) {
935 			/*
936 			 * No key files and no passphrase, something is
937 			 * definitely wrong here.
938 			 * geli(8) doesn't allow for such situation, so assume
939 			 * that there was really no passphrase and in that case
940 			 * key files are no properly defined in loader.conf.
941 			 */
942 			G_ELI_DEBUG(0,
943 			    "Found no key files in loader.conf for %s.",
944 			    pp->name);
945 			return (NULL);
946 		}
947 
948 		/* Ask for the passphrase if defined. */
949 		if (md.md_iterations >= 0) {
950 			printf("Enter passphrase for %s: ", pp->name);
951 			gets(passphrase, sizeof(passphrase),
952 			    g_eli_visible_passphrase);
953 		}
954 
955 		/*
956 		 * Prepare Derived-Key from the user passphrase.
957 		 */
958 		if (md.md_iterations == 0) {
959 			g_eli_crypto_hmac_update(&ctx, md.md_salt,
960 			    sizeof(md.md_salt));
961 			g_eli_crypto_hmac_update(&ctx, passphrase,
962 			    strlen(passphrase));
963 			bzero(passphrase, sizeof(passphrase));
964 		} else if (md.md_iterations > 0) {
965 			u_char dkey[G_ELI_USERKEYLEN];
966 
967 			pkcs5v2_genkey(dkey, sizeof(dkey), md.md_salt,
968 			    sizeof(md.md_salt), passphrase, md.md_iterations);
969 			bzero(passphrase, sizeof(passphrase));
970 			g_eli_crypto_hmac_update(&ctx, dkey, sizeof(dkey));
971 			bzero(dkey, sizeof(dkey));
972 		}
973 
974 		g_eli_crypto_hmac_final(&ctx, key, 0);
975 
976 		/*
977 		 * Decrypt Master-Key.
978 		 */
979 		error = g_eli_mkey_decrypt(&md, key, mkey, &nkey);
980 		bzero(key, sizeof(key));
981 		if (error == -1) {
982 			if (i == tries - 1) {
983 				G_ELI_DEBUG(0,
984 				    "Wrong key for %s. No tries left.",
985 				    pp->name);
986 				g_eli_keyfiles_clear(pp->name);
987 				return (NULL);
988 			}
989 			G_ELI_DEBUG(0, "Wrong key for %s. Tries left: %u.",
990 			    pp->name, tries - i - 1);
991 			/* Try again. */
992 			continue;
993 		} else if (error > 0) {
994 			G_ELI_DEBUG(0, "Cannot decrypt Master Key for %s (error=%d).",
995 			    pp->name, error);
996 			g_eli_keyfiles_clear(pp->name);
997 			return (NULL);
998 		}
999 		G_ELI_DEBUG(1, "Using Master Key %u for %s.", nkey, pp->name);
1000 		break;
1001 	}
1002 
1003 	/*
1004 	 * We have correct key, let's attach provider.
1005 	 */
1006 	gp = g_eli_create(NULL, mp, pp, &md, mkey, nkey);
1007 	bzero(mkey, sizeof(mkey));
1008 	bzero(&md, sizeof(md));
1009 	if (gp == NULL) {
1010 		G_ELI_DEBUG(0, "Cannot create device %s%s.", pp->name,
1011 		    G_ELI_SUFFIX);
1012 		return (NULL);
1013 	}
1014 	return (gp);
1015 }
1016 
1017 static void
1018 g_eli_dumpconf(struct sbuf *sb, const char *indent, struct g_geom *gp,
1019     struct g_consumer *cp, struct g_provider *pp)
1020 {
1021 	struct g_eli_softc *sc;
1022 
1023 	g_topology_assert();
1024 	sc = gp->softc;
1025 	if (sc == NULL)
1026 		return;
1027 	if (pp != NULL || cp != NULL)
1028 		return;	/* Nothing here. */
1029 	sbuf_printf(sb, "%s<Flags>", indent);
1030 	if (sc->sc_flags == 0)
1031 		sbuf_printf(sb, "NONE");
1032 	else {
1033 		int first = 1;
1034 
1035 #define ADD_FLAG(flag, name)	do {					\
1036 	if (sc->sc_flags & (flag)) {					\
1037 		if (!first)						\
1038 			sbuf_printf(sb, ", ");				\
1039 		else							\
1040 			first = 0;					\
1041 		sbuf_printf(sb, name);					\
1042 	}								\
1043 } while (0)
1044 		ADD_FLAG(G_ELI_FLAG_NATIVE_BYTE_ORDER, "NATIVE-BYTE-ORDER");
1045 		ADD_FLAG(G_ELI_FLAG_ONETIME, "ONETIME");
1046 		ADD_FLAG(G_ELI_FLAG_BOOT, "BOOT");
1047 		ADD_FLAG(G_ELI_FLAG_WO_DETACH, "W-DETACH");
1048 		ADD_FLAG(G_ELI_FLAG_RW_DETACH, "RW-DETACH");
1049 		ADD_FLAG(G_ELI_FLAG_AUTH, "AUTH");
1050 		ADD_FLAG(G_ELI_FLAG_WOPEN, "W-OPEN");
1051 		ADD_FLAG(G_ELI_FLAG_DESTROY, "DESTROY");
1052 		ADD_FLAG(G_ELI_FLAG_RO, "READ-ONLY");
1053 #undef  ADD_FLAG
1054 	}
1055 	sbuf_printf(sb, "</Flags>\n");
1056 
1057 	if (!(sc->sc_flags & G_ELI_FLAG_ONETIME)) {
1058 		sbuf_printf(sb, "%s<UsedKey>%u</UsedKey>\n", indent,
1059 		    sc->sc_nkey);
1060 	}
1061 	sbuf_printf(sb, "%s<Crypto>", indent);
1062 	switch (sc->sc_crypto) {
1063 	case G_ELI_CRYPTO_HW:
1064 		sbuf_printf(sb, "hardware");
1065 		break;
1066 	case G_ELI_CRYPTO_SW:
1067 		sbuf_printf(sb, "software");
1068 		break;
1069 	default:
1070 		sbuf_printf(sb, "UNKNOWN");
1071 		break;
1072 	}
1073 	sbuf_printf(sb, "</Crypto>\n");
1074 	if (sc->sc_flags & G_ELI_FLAG_AUTH) {
1075 		sbuf_printf(sb,
1076 		    "%s<AuthenticationAlgorithm>%s</AuthenticationAlgorithm>\n",
1077 		    indent, g_eli_algo2str(sc->sc_aalgo));
1078 	}
1079 	sbuf_printf(sb, "%s<KeyLength>%u</KeyLength>\n", indent,
1080 	    sc->sc_ekeylen);
1081 	sbuf_printf(sb, "%s<EncryptionAlgorithm>%s</EncryptionAlgorithm>\n", indent,
1082 	    g_eli_algo2str(sc->sc_ealgo));
1083 }
1084 
1085 static void
1086 g_eli_shutdown_pre_sync(void *arg, int howto)
1087 {
1088 	struct g_class *mp;
1089 	struct g_geom *gp, *gp2;
1090 	struct g_provider *pp;
1091 	struct g_eli_softc *sc;
1092 	int error;
1093 
1094 	mp = arg;
1095 	DROP_GIANT();
1096 	g_topology_lock();
1097 	LIST_FOREACH_SAFE(gp, &mp->geom, geom, gp2) {
1098 		sc = gp->softc;
1099 		if (sc == NULL)
1100 			continue;
1101 		pp = LIST_FIRST(&gp->provider);
1102 		KASSERT(pp != NULL, ("No provider? gp=%p (%s)", gp, gp->name));
1103 		if (pp->acr + pp->acw + pp->ace == 0)
1104 			error = g_eli_destroy(sc, 1);
1105 		else {
1106 			sc->sc_flags |= G_ELI_FLAG_RW_DETACH;
1107 			gp->access = g_eli_access;
1108 		}
1109 	}
1110 	g_topology_unlock();
1111 	PICKUP_GIANT();
1112 }
1113 
1114 static void
1115 g_eli_init(struct g_class *mp)
1116 {
1117 
1118 	g_eli_pre_sync = EVENTHANDLER_REGISTER(shutdown_pre_sync,
1119 	    g_eli_shutdown_pre_sync, mp, SHUTDOWN_PRI_FIRST);
1120 	if (g_eli_pre_sync == NULL)
1121 		G_ELI_DEBUG(0, "Warning! Cannot register shutdown event.");
1122 }
1123 
1124 static void
1125 g_eli_fini(struct g_class *mp)
1126 {
1127 
1128 	if (g_eli_pre_sync != NULL)
1129 		EVENTHANDLER_DEREGISTER(shutdown_pre_sync, g_eli_pre_sync);
1130 }
1131 
1132 DECLARE_GEOM_CLASS(g_eli_class, g_eli);
1133 MODULE_DEPEND(g_eli, crypto, 1, 1, 1);
1134