Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e02a4e21 authored by Dinesh K Garg's avatar Dinesh K Garg
Browse files

ext4: Add HW File Based Encryption on ext4 file system 



HW File Based Encryption (FBE) uses Crypto Engine to
encrypt the user data with unique key for each file.
File name and data both are encrypted with this feature.
  1. security/pfk: New module to support per file
     encryption using CE.
  2. fs/ext4: changes made to support using crypto engine
     to encyrpt the data.
Other changes made to provide support framework for per
file encryption.

Change-Id: Idea3f6f8bf954c60c3c6caa3d9b048d87fcacbe4
Signed-off-by: default avatarDinesh K Garg <dineshg@codeaurora.org>
parent f24738ce

block/bio.c

+1 −1
Original line number Diff line number Diff line
@@ -605,7 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src) 
	bio->bi_write_hint = bio_src->bi_write_hint;

	bio->bi_iter = bio_src->bi_iter;

	bio->bi_io_vec = bio_src->bi_io_vec;



	bio->bi_dio_inode = bio_src->bi_dio_inode;

	bio_clone_blkcg_association(bio, bio_src);

}

EXPORT_SYMBOL(__bio_clone_fast);

block/blk-merge.c

+11 −1
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
#include <linux/bio.h>

#include <linux/blkdev.h>

#include <linux/scatterlist.h>



#include <linux/pfk.h>

#include <trace/events/block.h>



#include "blk.h"
@@ -660,6 +660,11 @@ static void blk_account_io_merge(struct request *req) 
	}

}



static bool crypto_not_mergeable(const struct bio *bio, const struct bio *nxt)

{

	return (!pfk_allow_merge_bio(bio, nxt));

}



/*

 * For non-mq, this has to be called with the request spinlock acquired.

 * For mq with scheduling, the appropriate queue wide lock should be held.
@@ -698,6 +703,8 @@ static struct request *attempt_merge(struct request_queue *q, 
	if (req->write_hint != next->write_hint)

		return NULL;



	if (crypto_not_mergeable(req->bio, next->bio))

		return 0;

	/*

	 * If we are allowed to merge, then append bio list

	 * from next to rq and release next. merge_requests_fn
@@ -829,6 +836,9 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio) 
	if (rq->write_hint != bio->bi_write_hint)

		return false;



	if (crypto_not_mergeable(rq->bio, bio))

		return false;



	return true;

}

drivers/crypto/Kconfig

+3 −0
Original line number Diff line number Diff line
@@ -770,4 +770,7 @@ config CRYPTO_DEV_ARTPEC6 


	  To compile this driver as a module, choose M here.



if ARCH_QCOM

source drivers/crypto/msm/Kconfig

endif

endif # CRYPTO_HW

drivers/crypto/msm/ice.c

+2 −29
Original line number Diff line number Diff line
@@ -1397,8 +1397,8 @@ static void qcom_ice_debug(struct platform_device *pdev) 
	qcom_ice_dump_test_bus(ice_dev);

	pr_err("%s: ICE reset start time: %llu ICE reset done time: %llu\n",

			ice_dev->ice_instance_type,

		(unsigned long long)ice_dev->ice_reset_start_time.tv64,

		(unsigned long long)ice_dev->ice_reset_complete_time.tv64);

		(unsigned long long)ice_dev->ice_reset_start_time,

		(unsigned long long)ice_dev->ice_reset_complete_time);



	if (ktime_to_us(ktime_sub(ice_dev->ice_reset_complete_time,

				  ice_dev->ice_reset_start_time)) > 0)
@@ -1430,9 +1430,7 @@ static int qcom_ice_config_start(struct platform_device *pdev, 
		struct request *req,

		struct ice_data_setting *setting, bool async)

{

	struct ice_crypto_setting *crypto_data;

	struct ice_crypto_setting pfk_crypto_data = {0};

	union map_info *info;

	int ret = 0;

	bool is_pfe = false;
@@ -1455,7 +1453,6 @@ static int qcom_ice_config_start(struct platform_device *pdev, 
		/* It is not an error to have a request with no  bio */

		return 0;

	}

    //pr_err("%s bio is %pK\n", __func__, req->bio);



	ret = pfk_load_key_start(req->bio, &pfk_crypto_data, &is_pfe, async);

	if (is_pfe) {
@@ -1470,30 +1467,6 @@ static int qcom_ice_config_start(struct platform_device *pdev, 
				&pfk_crypto_data, setting);

	}



	/*

	 * info field in req->end_io_data could be used by mulitple dm or

	 * non-dm entities. To ensure that we are running operation on dm

	 * based request, check BIO_DONT_FREE flag

	 */

	if (bio_flagged(req->bio, BIO_INLINECRYPT)) {

		info = dm_get_rq_mapinfo(req);

		if (!info) {

			pr_debug("%s info not available in request\n",

				 __func__);

			return 0;

		}



		crypto_data = (struct ice_crypto_setting *)info->ptr;

		if (!crypto_data) {

			pr_err("%s crypto_data not available in request\n",

				 __func__);

			return -EINVAL;

		}



		return qti_ice_setting_config(req, pdev,

				crypto_data, setting);

	}



	/*

	 * It is not an error. If target is not req-crypt based, all request

	 * from storage driver would come here to check if there is any ICE

fs/crypto/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -2,3 +2,5 @@ obj-$(CONFIG_FS_ENCRYPTION) += fscrypto.o 


fscrypto-y := crypto.o fname.o hooks.o keyinfo.o policy.o

fscrypto-$(CONFIG_BLOCK) += bio.o

ccflags-y += -Ifs/ext4

fscrypto-$(CONFIG_EXT4_FS_ICE_ENCRYPTION) += ext4_ice.o