From: linlzhan <[email protected]>
The virtio-blk driver currently does not preserve blk-crypto metadata when
dispatching encrypted bios to the virtio queue. As a result, inline
encryption cannot be used for virtio block devices.
This series enables inline encryption for guest VMs on platforms where the
Inline Crypto Engine (ICE) is owned by the host or another virtual machine.
It extends virtio-blk with a crypto control virtqueue and carries the
required encryption metadata with data requests.
The series consists of:
1. Add control virtqueue support.
This allows the guest to exchange key management requests with the
virtio-blk backend without mixing them with regular I/O requests.
2. Add inline encryption support.
The driver advertises the device encryption capabilities through a
struct blk_crypto_profile and carries encryption metadata, including
the virtual keyslot and data unit number (DUN), in virtio requests.
On the backend (blk-crypto-proxy, will be committed in another patch as
suggested.), the key table mapping virtual slot to the block crypto
key is maintained, so that the request metadata can be used to resolve
the guest keyslot to the corresponding block crypto key and to reconstruct
the blk-crypto context before submitting the bio to the underlying block
device.
This keeps the guest integrated with the existing blk-crypto and filesystem
encryption frameworks while preserving inline-encryption semantics across
the virtualization boundary.
This is compatible for the virtio SPEC update which is under review:
https://lore.kernel.org/all/[email protected]/
Known limitations:
- Virtio block inline encryption depends on the new control virtqueue
- Inline encryption is mutually exclusive with VIRTIO_BLK_F_ZONED.
Testing:
Compilation pass on Linux-next.
End-to-end FBE virtualization with wrapped key enabled was validated
on top of gunyah hypervisor. wrapped_key_test is a local utility to
get wrapped key and ephemeral wrapped key via storage ioctl interfaces.
- /data/wrapped_key_test /dev/block/userdata generate
- /data/wrapped_key_test /dev/block/userdata prepare /data/lt_key.bin
- /data/fscryptctl insert_wrapped_key < /data/eph_key.bin
- /data/fscryptctl set_policy --identifier=20f553802e64e36b43469211266a5f1c
/data/testing
- echo "data" > /data/testing/file.txt
- sync and reboot
- /data/wrapped_key_test /dev/block/userdata prepare /data/lt_key.bin
- /data/fscryptctl insert_wrapped_key < /data/eph_key_2.bin
- /data/fscryptctl set_policy --identifier=d8ca51d6d2094b73b2dae5ee7e3a10b6
/data/testing
- cat /data/testing/file.txt
---
Changes Changes v2 => v3:
- Fix issues reported by sashiko-bot
- Change to the pointer of struct completion in the control-queue
request to avoid DMA cacheline sharing
- Submit a control-queue request with a timeout monitor
- Freeze the data plane before marking the control queue as dead
- Transmit the kernel blk-crypto-mod-num and key_type to those
defined by virtio SPEC
- Replace GFP_KERNEL with GFP_NOIO when allocating the memory for
control-queue request in the key program/evict flow
- Move the check of inline encryption support to a independent
conditional branch.
v2:
https://lore.kernel.org/all/[email protected]/
Changes v1 => v2:
- Use control virtqueue to perform key management requests
- Extend virtio_blk_crypto_msg::dun from a single __virtio64 to a
four-element __virtio64 array to support larger DUN sizes.
- Remove data_unit_size_bit in virtio_blk_crypto_msg struct
v1:
https://lore.kernel.org/all/[email protected]/
linlzhan (2):
virtio_blk: Add control virtqueue support
virtio_blk: add inline encryption support
drivers/block/Kconfig | 12 +
drivers/block/virtio_blk.c | 907 +++++++++++++++++++++++++++++++-
include/linux/virtio_blk.h | 87 +++
include/uapi/linux/virtio_blk.h | 124 ++++-
4 files changed, 1111 insertions(+), 19 deletions(-)
create mode 100644 include/linux/virtio_blk.h
--
2.34.1
