Remove cryptoloop support
Subsystems (10)
cover Remove cryptoloop support
Hi,
after several "is cryptoloop supported/secure/maintained" discussions (which regularly repeats for years on various occasions) we should do something.
So let's remove cryptoloop support from kernel :-)
Current mainline userspace (util-linux) is going to remove encryption support in next losetup version (already removed in git tree), encryption support is already deprecated in the last release.
There are known problems with cryptoloop (like predictable IV or hardcoded sizes), and if you read even some very old notes, nothing changed for years. (e.g. this page http://mareichelt.com/pub/texts.cryptoloop.html)
Dm-crypt/cryptsetup provides replacement for long time already.
It allocates loop device automatically for file images and with proper parameters it can map existing images - even some old which are not supported by current cryptoloop. On the other side it requires device-mapper modules (dm_mod, dm_crypt).
Alternative (out of tree) loop-AES already replaces most of the kernel and userpsace code by own patches anyway.
I am not fan of removing old code this way but I do not see alternative here. Please comment if you see better solution...
Thanks,
Milan
Milan Broz (4):
Remove cryptoloop module.
Remove cryptoloop config option.
Deprecate loop crypto ioctl fields.
Remove transfer module support in loop.
arch/arm/configs/colibri_pxa270_defconfig | 1 - arch/arm/configs/ezx_defconfig | 1 - arch/arm/configs/imote2_defconfig | 1 - arch/arm/configs/lpc32xx_defconfig | 1 - arch/arm/configs/netx_defconfig | 1 - arch/arm/configs/nhk8815_defconfig | 1 - arch/arm/configs/trizeps4_defconfig | 1 - arch/ia64/configs/bigsur_defconfig | 1 - arch/ia64/configs/generic_defconfig | 1 - arch/ia64/configs/gensparse_defconfig | 1 - arch/ia64/configs/tiger_defconfig | 1 - arch/ia64/configs/xen_domu_defconfig | 1 - arch/m68k/configs/amiga_defconfig | 1 - arch/m68k/configs/apollo_defconfig | 1 - arch/m68k/configs/atari_defconfig | 1 - arch/m68k/configs/bvme6000_defconfig | 1 - arch/m68k/configs/hp300_defconfig | 1 - arch/m68k/configs/mac_defconfig | 1 - arch/m68k/configs/multi_defconfig | 1 - arch/m68k/configs/mvme147_defconfig | 1 - arch/m68k/configs/mvme16x_defconfig | 1 - arch/m68k/configs/q40_defconfig | 1 - arch/m68k/configs/sun3_defconfig | 1 - arch/m68k/configs/sun3x_defconfig | 1 - arch/mips/configs/bcm47xx_defconfig | 1 - arch/mips/configs/bigsur_defconfig | 1 - arch/mips/configs/fuloong2e_defconfig | 1 - arch/mips/configs/ip27_defconfig | 1 - arch/mips/configs/ip32_defconfig | 1 - arch/mips/configs/jazz_defconfig | 1 - arch/mips/configs/lemote2f_defconfig | 1 - arch/mips/configs/malta_defconfig | 1 - arch/mips/configs/markeins_defconfig | 1 - arch/mips/configs/nlm_xlp_defconfig | 1 - arch/mips/configs/nlm_xlr_defconfig | 1 - arch/mips/configs/rm200_defconfig | 1 - arch/mips/configs/sead3_defconfig | 1 - arch/parisc/configs/712_defconfig | 1 - arch/parisc/configs/b180_defconfig | 1 - arch/parisc/configs/c3000_defconfig | 1 - arch/parisc/configs/default_defconfig | 1 - arch/powerpc/configs/85xx/ge_imp3a_defconfig | 1 - arch/powerpc/configs/86xx/gef_ppc9a_defconfig | 1 - arch/powerpc/configs/86xx/gef_sbc310_defconfig | 1 - arch/powerpc/configs/86xx/gef_sbc610_defconfig | 1 - arch/powerpc/configs/86xx/sbc8641d_defconfig | 1 - arch/powerpc/configs/c2k_defconfig | 1 - arch/powerpc/configs/chroma_defconfig | 1 - arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/score/configs/spct6600_defconfig | 1 - arch/sh/configs/sdk7786_defconfig | 1 - arch/sh/configs/sh7785lcr_32bit_defconfig | 1 - arch/sh/configs/titan_defconfig | 1 - arch/sparc/configs/sparc32_defconfig | 1 - arch/sparc/configs/sparc64_defconfig | 1 - arch/tile/configs/tilegx_defconfig | 1 - arch/tile/configs/tilepro_defconfig | 1 - arch/um/defconfig | 1 - drivers/block/Kconfig | 23 -- drivers/block/Makefile | 1 - drivers/block/cryptoloop.c | 216 --------------- drivers/block/loop.c | 344 +++--------------------- include/linux/loop.h | 31 --- include/uapi/linux/loop.h | 18 +- 64 files changed, 44 insertions(+), 647 deletions(-) delete mode 100644 drivers/block/cryptoloop.c
Signature · 1 line
1.7.10.4
RFC PATCH 4/4 Remove transfer module support in loop.
Remove transfer function support from loop driver.
The only user for it is for years XOR "encryption" and cryptoloop.
If userspace request encryption, EINVAL is returned.
The userspace visible struct is unchanged (just marked deprecated), so old userspace will just see ioctl failure if encryption is requested.
--- drivers/block/loop.c | 344 +++++--------------------------------------------- include/linux/loop.h | 31 ----- 2 files changed, 35 insertions(+), 340 deletions(-)
drivers/block/loop.c +35 -309
@@ -85,81 +85,6 @@ static DEFINE_MUTEX(loop_index_mutex);static int max_part;static int part_shift; -/* -* Transfer functions -*/ -static int transfer_none (struct loop_device *lo,int cmd, -struct page *raw_page,unsigned raw_off, -struct page *loop_page,unsigned loop_off, -int size,sector_t real_block) -{ -char *raw_buf =kmap_atomic (raw_page) + raw_off; -char *loop_buf =kmap_atomic (loop_page) + loop_off; - -if (cmd ==READ ) -memcpy (loop_buf, raw_buf, size); -else -memcpy (raw_buf, loop_buf, size); - -kunmap_atomic (loop_buf); -kunmap_atomic (raw_buf); -cond_resched (); -return 0 ; -} - -static int transfer_xor (struct loop_device *lo,int cmd, -struct page *raw_page,unsigned raw_off, -struct page *loop_page,unsigned loop_off, -int size,sector_t real_block) -{ -char *raw_buf =kmap_atomic (raw_page) + raw_off; -char *loop_buf =kmap_atomic (loop_page) + loop_off; -char *in, *out, *key; -int i, keysize; - -if (cmd ==READ ) { - in = raw_buf; - out = loop_buf; - }else { - in = loop_buf; - out = raw_buf; - } - - key = lo->lo_encrypt_key; - keysize = lo->lo_encrypt_key_size; -for (i =0 ; i < size; i++) - *out++ = *in++ ^ key[(i &511 ) % keysize]; - -kunmap_atomic (loop_buf); -kunmap_atomic (raw_buf); -cond_resched (); -return 0 ; -} - -static int xor_init (struct loop_device *lo,const struct loop_info64 *info) -{ -if (unlikely (info->lo_encrypt_key_size <=0 )) -return -EINVAL ; -return 0 ; -} - -static struct loop_func_table none_funcs = { - .number =LO_CRYPT_NONE , - .transfer = transfer_none, -}; - -static struct loop_func_table xor_funcs = { - .number =LO_CRYPT_XOR , - .transfer = transfer_xor, - .init = xor_init -}; - -/* xfer_funcs[0] is special - its release function is never called */ -static struct loop_func_table *xfer_funcs[MAX_LO_CRYPT ] = { - &none_funcs, - &xor_funcs -}; -static loff_t get_size (loff_t offset,loff_t sizelimit,struct file *file) {loff_t size, loopsize;
@@ -205,12 +130,20 @@ static inline int lo_do_transfer(struct loop_device *lo, int cmd, struct page *rpage, unsigned roffs, struct page *lpage, unsigned loffs, - int size, sector_t rblock) + int size) { - if (unlikely(!lo->transfer)) - return 0; + char *raw_buf = kmap_atomic(rpage) + roffs; +char *loop_buf =kmap_atomic (lpage) + loffs; - return lo->transfer(lo, cmd, rpage, roffs, lpage, loffs, size, rblock); +if (cmd ==READ ) +memcpy (loop_buf, raw_buf, size); +else +memcpy (raw_buf, loop_buf, size); + +kunmap_atomic (loop_buf); +kunmap_atomic (raw_buf); +cond_resched (); +return 0 ; }/**
@@ -244,7 +177,7 @@ static int __do_lo_send_write(struct file *file,* buffering. */ static int do_lo_send_direct_write (struct loop_device *lo, -struct bio_vec *bvec,loff_t pos,struct page *page) +struct bio_vec *bvec,loff_t pos) { ssize_t bw = __do_lo_send_write(lo->lo_backing_file, kmap(bvec->bv_page) + bvec->bv_offset,
@@ -254,63 +187,19 @@ static int do_lo_send_direct_write(struct loop_device *lo,return bw; } -/** -* do_lo_send_write - helper for writing data to a loop device -* -* This is the slow, transforming version that needs to double buffer the -* data as it cannot do the transformations in place without having direct -* access to the destination pages of the backing file. -*/ -static int do_lo_send_write (struct loop_device *lo,struct bio_vec *bvec, -loff_t pos,struct page *page) -{ -int ret =lo_do_transfer (lo,WRITE , page,0 , bvec->bv_page, - bvec->bv_offset, bvec->bv_len, pos >>9 ); -if (likely (!ret)) -return __do_lo_send_write (lo->lo_backing_file, -page_address (page), bvec->bv_len, - pos); -printk (KERN_ERR "loop: Transfer error at byte offset %llu, " -"length %i.\n" , (unsigned long long )pos, bvec->bv_len); -if (ret >0 ) - ret = -EIO ; -return ret; -} -static int lo_send (struct loop_device *lo,struct bio *bio,loff_t pos) { -int (*do_lo_send)(struct loop_device *,struct bio_vec *,loff_t , -struct page *page);struct bio_vec *bvec; -struct page *page =NULL ;int i, ret =0 ; -if (lo->transfer != transfer_none) { - page =alloc_page (GFP_NOIO | __GFP_HIGHMEM); -if (unlikely (!page)) - goto fail; -kmap (page); - do_lo_send = do_lo_send_write; - }else { - do_lo_send = do_lo_send_direct_write; - } -bio_for_each_segment (bvec, bio, i) { - ret =do_lo_send (lo, bvec, pos, page); + ret =do_lo_send_direct_write (lo, bvec, pos);if (ret <0 )break ; pos += bvec->bv_len; } -if (page) { -kunmap (page); -__free_page (page); - } -out: +return ret; -fail: -printk (KERN_ERR "loop: Failed to allocate temporary page for write.\n" ); - ret = -ENOMEM ; - goto out; }struct lo_read_data {
@@ -327,16 +216,13 @@ lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,struct lo_read_data *p = sd->u.data;struct loop_device *lo = p->lo;struct page *page = buf->page; -sector_t IV ;int size; -IV = ((sector_t ) page->index << (PAGE_CACHE_SHIFT -9 )) + - (buf->offset >>9 ); size = sd->len;if (size > p->bsize) size = p->bsize; -if (lo_do_transfer (lo,READ , page, buf->offset, p->page, p->offset, size,IV )) { +if (lo_do_transfer (lo,READ , page, buf->offset, p->page, p->offset, size)) {printk (KERN_ERR "loop: transfer error block %ld\n" , page->index); size = -EINVAL ;
@@ -423,16 +309,13 @@ static int do_bio_filebacked(struct loop_device *lo, struct bio *bio)/* * We use punch hole to reclaim the free space used by the -* image a.k.a. discard. However we do not support discard if -* encryption is enabled, because it may give an attacker -* useful information. +* image a.k.a. discard. */ if (bio->bi_rw &REQ_DISCARD ) {struct file *file = lo->lo_backing_file;int mode =FALLOC_FL_PUNCH_HOLE |FALLOC_FL_KEEP_SIZE ; -if ((!file->f_op->fallocate) || - lo->lo_encrypt_key_size) { +if (!file->f_op->fallocate) { ret = -EOPNOTSUPP ; goto out; }
@@ -519,9 +402,7 @@ static inline void loop_handle_bio(struct loop_device *lo, struct bio *bio)/* * worker thread that handles reads/writes to file backed loop devices, -* to avoid blocking in our make_request_fn. it also does loop decrypting -* on reads for block backed loop, as that is too heavy to do from -* b_end_io context where irqs may be disabled. +* to avoid blocking in our make_request_fn. * * Loop explanation: loop_clr_fd() sets lo_state to Lo_rundown before * calling kthread_stop(). Therefore once kthread_should_stop() is
@@ -783,12 +664,9 @@ static void loop_config_discard(struct loop_device *lo)/* * We use punch hole to reclaim the free space used by the -* image a.k.a. discard. However we do support discard if -* encryption is enabled, because it may give an attacker -* useful information. +* image a.k.a. discard. */ -if ((!file->f_op->fallocate) || - lo->lo_encrypt_key_size) { +if (!file->f_op->fallocate) { q->limits.discard_granularity =0 ; q->limits.discard_alignment =0 ; q->limits.max_discard_sectors =0 ;
@@ -870,8 +748,6 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, lo->lo_device = bdev; lo->lo_flags = lo_flags; lo->lo_backing_file = file; - lo->transfer = transfer_none; - lo->ioctl =NULL ; lo->lo_sizelimit =0 ; lo->old_gfp_mask =mapping_gfp_mask (mapping);mapping_set_gfp_mask (mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
@@ -930,43 +806,6 @@ out_clr:return error; } -static int -loop_release_xfer (struct loop_device *lo) -{ -int err =0 ; -struct loop_func_table *xfer = lo->lo_encryption; - -if (xfer) { -if (xfer->release) - err = xfer->release (lo); - lo->transfer =NULL ; - lo->lo_encryption =NULL ; -module_put (xfer->owner); - } -return err; -} - -static int -loop_init_xfer (struct loop_device *lo,struct loop_func_table *xfer, -const struct loop_info64 *i) -{ -int err =0 ; - -if (xfer) { -struct module *owner = xfer->owner; - -if (!try_module_get (owner)) -return -EINVAL ; -if (xfer->init) - err = xfer->init (lo, i); -if (err) -module_put (owner); -else - lo->lo_encryption = xfer; - } -return err; -} -static int loop_clr_fd (struct loop_device *lo) {struct file *filp = lo->lo_backing_file;
@@ -1005,17 +844,10 @@ static int loop_clr_fd(struct loop_device *lo) lo->lo_backing_file =NULL ;spin_unlock_irq (&lo->lo_lock); -loop_release_xfer (lo); - lo->transfer =NULL ; - lo->ioctl =NULL ; lo->lo_device =NULL ; - lo->lo_encryption =NULL ; lo->lo_offset =0 ; lo->lo_sizelimit =0 ; - lo->lo_encrypt_key_size =0 ; lo->lo_thread =NULL ; -memset (lo->lo_encrypt_key,0 ,LO_KEY_SIZE ); -memset (lo->lo_crypt_name,0 ,LO_NAME_SIZE );memset (lo->lo_file_name,0 ,LO_NAME_SIZE );if (bdev)invalidate_bdev (bdev);
@@ -1049,38 +881,9 @@ static int loop_clr_fd(struct loop_device *lo)static int loop_set_status (struct loop_device *lo,const struct loop_info64 *info) { -int err; -struct loop_func_table *xfer; -kuid_t uid =current_uid (); - -if (lo->lo_encrypt_key_size && - !uid_eq (lo->lo_key_owner, uid) && - !capable (CAP_SYS_ADMIN )) -return -EPERM ; -if (lo->lo_state != Lo_bound) -return -ENXIO ; -if ((unsigned int ) info->lo_encrypt_key_size >LO_KEY_SIZE ) +if (info->lo_encrypt_key_size || info->lo_encrypt_type !=LO_CRYPT_NONE )return -EINVAL ; - err =loop_release_xfer (lo); -if (err) -return err; - -if (info->lo_encrypt_type) { -unsigned int type = info->lo_encrypt_type; - -if (type >=MAX_LO_CRYPT ) -return -EINVAL ; - xfer = xfer_funcs[type]; -if (xfer ==NULL ) -return -EINVAL ; - }else - xfer =NULL ; - - err =loop_init_xfer (lo, xfer, info); -if (err) -return err; -if (lo->lo_offset != info->lo_offset || lo->lo_sizelimit != info->lo_sizelimit) {if (figure_loop_size (lo, info->lo_offset, info->lo_sizelimit))
@@ -1089,14 +892,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)loop_config_discard (lo);memcpy (lo->lo_file_name, info->lo_file_name,LO_NAME_SIZE ); -memcpy (lo->lo_crypt_name, info->lo_crypt_name,LO_NAME_SIZE ); lo->lo_file_name[LO_NAME_SIZE -1 ] =0 ; - lo->lo_crypt_name[LO_NAME_SIZE -1 ] =0 ; - -if (!xfer) - xfer = &none_funcs; - lo->transfer = xfer->transfer; - lo->ioctl = xfer->ioctl;if ((lo->lo_flags &LO_FLAGS_AUTOCLEAR ) != (info->lo_flags &LO_FLAGS_AUTOCLEAR ))
@@ -1109,14 +905,8 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)ioctl_by_bdev (lo->lo_device,BLKRRPART ,0 ); } - lo->lo_encrypt_key_size = info->lo_encrypt_key_size; lo->lo_init[0 ] = info->lo_init[0 ]; lo->lo_init[1 ] = info->lo_init[1 ]; -if (info->lo_encrypt_key_size) { -memcpy (lo->lo_encrypt_key, info->lo_encrypt_key, - info->lo_encrypt_key_size); - lo->lo_key_owner = uid; - }return 0 ; }
@@ -1142,20 +932,15 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info) info->lo_sizelimit = lo->lo_sizelimit; info->lo_flags = lo->lo_flags;memcpy (info->lo_file_name, lo->lo_file_name,LO_NAME_SIZE ); -memcpy (info->lo_crypt_name, lo->lo_crypt_name,LO_NAME_SIZE ); - info->lo_encrypt_type = - lo->lo_encryption ? lo->lo_encryption->number :0 ; -if (lo->lo_encrypt_key_size &&capable (CAP_SYS_ADMIN )) { - info->lo_encrypt_key_size = lo->lo_encrypt_key_size; -memcpy (info->lo_encrypt_key, lo->lo_encrypt_key, - lo->lo_encrypt_key_size); - }return 0 ; } -static void +static int loop_info64_from_old (const struct loop_info *info,struct loop_info64 *info64) { +if (info->lo_encrypt_key_size || info->lo_encrypt_type !=LO_CRYPT_NONE ) +return -EINVAL ; +memset (info64,0 ,sizeof (*info64)); info64->lo_number = info->lo_number; info64->lo_device = info->lo_device;
@@ -1163,16 +948,10 @@ loop_info64_from_old(const struct loop_info *info, struct loop_info64 *info64) info64->lo_rdevice = info->lo_rdevice; info64->lo_offset = info->lo_offset; info64->lo_sizelimit =0 ; - info64->lo_encrypt_type = info->lo_encrypt_type; - info64->lo_encrypt_key_size = info->lo_encrypt_key_size; info64->lo_flags = info->lo_flags; info64->lo_init[0 ] = info->lo_init[0 ]; info64->lo_init[1 ] = info->lo_init[1 ]; -if (info->lo_encrypt_type ==LO_CRYPT_CRYPTOAPI ) -memcpy (info64->lo_crypt_name, info->lo_name,LO_NAME_SIZE ); -else -memcpy (info64->lo_file_name, info->lo_name,LO_NAME_SIZE ); -memcpy (info64->lo_encrypt_key, info->lo_encrypt_key,LO_KEY_SIZE ); +return 0 ; } static int
@@ -1184,16 +963,9 @@ loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info) info->lo_inode = info64->lo_inode; info->lo_rdevice = info64->lo_rdevice; info->lo_offset = info64->lo_offset; - info->lo_encrypt_type = info64->lo_encrypt_type; - info->lo_encrypt_key_size = info64->lo_encrypt_key_size; info->lo_flags = info64->lo_flags; info->lo_init[0 ] = info64->lo_init[0 ]; info->lo_init[1 ] = info64->lo_init[1 ]; -if (info->lo_encrypt_type ==LO_CRYPT_CRYPTOAPI ) -memcpy (info->lo_name, info64->lo_crypt_name,LO_NAME_SIZE ); -else -memcpy (info->lo_name, info64->lo_file_name,LO_NAME_SIZE ); -memcpy (info->lo_encrypt_key, info64->lo_encrypt_key,LO_KEY_SIZE );/* error in case values were truncated */ if (info->lo_device != info64->lo_device ||
@@ -1210,10 +982,13 @@ loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg) {struct loop_info info;struct loop_info64 info64; +int ret;if (copy_from_user (&info, arg,sizeof (struct loop_info )))return -EFAULT ; -loop_info64_from_old (&info, &info64); + ret =loop_info64_from_old (&info, &info64); +if (ret <0 ) +return ret;return loop_set_status (lo, &info64); }
@@ -1330,7 +1105,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, err =loop_set_capacity (lo, bdev);break ;default : - err = lo->ioctl ? lo->ioctl (lo, cmd, arg) : -EINVAL ; + err = -EINVAL ; }mutex_unlock (&lo->lo_ctl_mutex);
@@ -1367,6 +1142,9 @@ loop_info64_from_compat(const struct compat_loop_info __user *arg,if (copy_from_user (&info, arg,sizeof (info)))return -EFAULT ; +if (info.lo_encrypt_key_size || info.lo_encrypt_type !=LO_CRYPT_NONE ) +return -EINVAL ; +memset (info64,0 ,sizeof (*info64)); info64->lo_number = info.lo_number; info64->lo_device = info.lo_device;
@@ -1374,16 +1152,9 @@ loop_info64_from_compat(const struct compat_loop_info __user *arg, info64->lo_rdevice = info.lo_rdevice; info64->lo_offset = info.lo_offset; info64->lo_sizelimit =0 ; - info64->lo_encrypt_type = info.lo_encrypt_type; - info64->lo_encrypt_key_size = info.lo_encrypt_key_size; info64->lo_flags = info.lo_flags; info64->lo_init[0 ] = info.lo_init[0 ]; info64->lo_init[1 ] = info.lo_init[1 ]; -if (info.lo_encrypt_type ==LO_CRYPT_CRYPTOAPI ) -memcpy (info64->lo_crypt_name, info.lo_name,LO_NAME_SIZE ); -else -memcpy (info64->lo_file_name, info.lo_name,LO_NAME_SIZE ); -memcpy (info64->lo_encrypt_key, info.lo_encrypt_key,LO_KEY_SIZE );return 0 ; }
@@ -1403,16 +1174,9 @@ loop_info64_to_compat(const struct loop_info64 *info64, info.lo_inode = info64->lo_inode; info.lo_rdevice = info64->lo_rdevice; info.lo_offset = info64->lo_offset; - info.lo_encrypt_type = info64->lo_encrypt_type; - info.lo_encrypt_key_size = info64->lo_encrypt_key_size; info.lo_flags = info64->lo_flags; info.lo_init[0 ] = info64->lo_init[0 ]; info.lo_init[1 ] = info64->lo_init[1 ]; -if (info.lo_encrypt_type ==LO_CRYPT_CRYPTOAPI ) -memcpy (info.lo_name, info64->lo_crypt_name,LO_NAME_SIZE ); -else -memcpy (info.lo_name, info64->lo_file_name,LO_NAME_SIZE ); -memcpy (info.lo_encrypt_key, info64->lo_encrypt_key,LO_KEY_SIZE );/* error in case values were truncated */ if (info.lo_device != info64->lo_device ||
@@ -1566,44 +1330,6 @@ MODULE_PARM_DESC(max_part, "Maximum number of partitions per loop device");MODULE_LICENSE ("GPL" );MODULE_ALIAS_BLOCKDEV_MAJOR (LOOP_MAJOR ); -int loop_register_transfer (struct loop_func_table *funcs) -{ -unsigned int n = funcs->number; - -if (n >=MAX_LO_CRYPT || xfer_funcs[n]) -return -EINVAL ; - xfer_funcs[n] = funcs; -return 0 ; -} - -static int unregister_transfer_cb (int id,void *ptr,void *data) -{ -struct loop_device *lo = ptr; -struct loop_func_table *xfer = data; - -mutex_lock (&lo->lo_ctl_mutex); -if (lo->lo_encryption == xfer) -loop_release_xfer (lo); -mutex_unlock (&lo->lo_ctl_mutex); -return 0 ; -} - -int loop_unregister_transfer (int number) -{ -unsigned int n = number; -struct loop_func_table *xfer; - -if (n ==0 || n >=MAX_LO_CRYPT || (xfer = xfer_funcs[n]) ==NULL ) -return -EINVAL ; - - xfer_funcs[n] =NULL ; -idr_for_each (&loop_index_idr, &unregister_transfer_cb, xfer); -return 0 ; -} - -EXPORT_SYMBOL (loop_register_transfer); -EXPORT_SYMBOL (loop_unregister_transfer); -static int loop_add (struct loop_device **l,int i) {struct loop_device *lo;
include/linux/loop.h +0 -31
@@ -22,32 +22,18 @@ enum { Lo_rundown, }; -struct loop_func_table ; -struct loop_device {int lo_number;int lo_refcnt;loff_t lo_offset;loff_t lo_sizelimit;int lo_flags; -int (*transfer)(struct loop_device *,int cmd, -struct page *raw_page,unsigned raw_off, -struct page *loop_page,unsigned loop_off, -int size,sector_t real_block);char lo_file_name[LO_NAME_SIZE ]; -char lo_crypt_name[LO_NAME_SIZE ]; -char lo_encrypt_key[LO_KEY_SIZE ]; -int lo_encrypt_key_size; -struct loop_func_table *lo_encryption;__u32 lo_init[2 ]; -kuid_t lo_key_owner;/* Who set the key */ -int (*ioctl)(struct loop_device *,int cmd, -unsigned long arg);struct file * lo_backing_file;struct block_device *lo_device;unsigned lo_blocksize; -void *key_data;gfp_t old_gfp_mask;
@@ -62,21 +48,4 @@ struct loop_device { struct gendisk *lo_disk; }; -/* Support for loadable transfer modules */ -struct loop_func_table { -int number;/* filter type */ -int (*transfer)(struct loop_device *lo,int cmd, -struct page *raw_page,unsigned raw_off, -struct page *loop_page,unsigned loop_off, -int size,sector_t real_block); -int (*init)(struct loop_device *,const struct loop_info64 *); -/* release is called from loop_unregister_transfer or clr_fd */ -int (*release)(struct loop_device *); -int (*ioctl)(struct loop_device *,int cmd,unsigned long arg); -struct module *owner; -}; - -int loop_register_transfer (struct loop_func_table *funcs); -int loop_unregister_transfer (int number); -#endif
Signature · 1 line
1.7.10.4
RFC PATCH 2/4 Remove cryptoloop config option.
In reply to Milan BrozRemove use of CONFIG_BLK_DEV_CRYPTOLOOP across the tree.
--- arch/arm/configs/colibri_pxa270_defconfig | 1 - arch/arm/configs/ezx_defconfig | 1 - arch/arm/configs/imote2_defconfig | 1 - arch/arm/configs/lpc32xx_defconfig | 1 - arch/arm/configs/netx_defconfig | 1 - arch/arm/configs/nhk8815_defconfig | 1 - arch/arm/configs/trizeps4_defconfig | 1 - arch/ia64/configs/bigsur_defconfig | 1 - arch/ia64/configs/generic_defconfig | 1 - arch/ia64/configs/gensparse_defconfig | 1 - arch/ia64/configs/tiger_defconfig | 1 - arch/ia64/configs/xen_domu_defconfig | 1 - arch/m68k/configs/amiga_defconfig | 1 - arch/m68k/configs/apollo_defconfig | 1 - arch/m68k/configs/atari_defconfig | 1 - arch/m68k/configs/bvme6000_defconfig | 1 - arch/m68k/configs/hp300_defconfig | 1 - arch/m68k/configs/mac_defconfig | 1 - arch/m68k/configs/multi_defconfig | 1 - arch/m68k/configs/mvme147_defconfig | 1 - arch/m68k/configs/mvme16x_defconfig | 1 - arch/m68k/configs/q40_defconfig | 1 - arch/m68k/configs/sun3_defconfig | 1 - arch/m68k/configs/sun3x_defconfig | 1 - arch/mips/configs/bcm47xx_defconfig | 1 - arch/mips/configs/bigsur_defconfig | 1 - arch/mips/configs/fuloong2e_defconfig | 1 - arch/mips/configs/ip27_defconfig | 1 - arch/mips/configs/ip32_defconfig | 1 - arch/mips/configs/jazz_defconfig | 1 - arch/mips/configs/lemote2f_defconfig | 1 - arch/mips/configs/malta_defconfig | 1 - arch/mips/configs/markeins_defconfig | 1 - arch/mips/configs/nlm_xlp_defconfig | 1 - arch/mips/configs/nlm_xlr_defconfig | 1 - arch/mips/configs/rm200_defconfig | 1 - arch/mips/configs/sead3_defconfig | 1 - arch/parisc/configs/712_defconfig | 1 - arch/parisc/configs/b180_defconfig | 1 - arch/parisc/configs/c3000_defconfig | 1 - arch/parisc/configs/default_defconfig | 1 - arch/powerpc/configs/85xx/ge_imp3a_defconfig | 1 - arch/powerpc/configs/86xx/gef_ppc9a_defconfig | 1 - arch/powerpc/configs/86xx/gef_sbc310_defconfig | 1 - arch/powerpc/configs/86xx/gef_sbc610_defconfig | 1 - arch/powerpc/configs/86xx/sbc8641d_defconfig | 1 - arch/powerpc/configs/c2k_defconfig | 1 - arch/powerpc/configs/chroma_defconfig | 1 - arch/powerpc/configs/ppc6xx_defconfig | 1 - arch/score/configs/spct6600_defconfig | 1 - arch/sh/configs/sdk7786_defconfig | 1 - arch/sh/configs/sh7785lcr_32bit_defconfig | 1 - arch/sh/configs/titan_defconfig | 1 - arch/sparc/configs/sparc32_defconfig | 1 - arch/sparc/configs/sparc64_defconfig | 1 - arch/tile/configs/tilegx_defconfig | 1 - arch/tile/configs/tilepro_defconfig | 1 - arch/um/defconfig | 1 - drivers/block/Kconfig | 23 ----------------------- 59 files changed, 81 deletions(-)
arch/arm/configs/colibri_pxa270_defconfig +0 -1
@@ -79,7 +79,6 @@ CONFIG_MTD_NAND_DISKONCHIP_PROBE_HIGH=y CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE=y CONFIG_MTD_ONENAND=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=8
arch/arm/configs/ezx_defconfig +0 -1
@@ -187,7 +187,6 @@ CONFIG_MTD_OTP=y CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_PXA2XX=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y # CONFIG_MISC_DEVICES is not set
arch/arm/configs/imote2_defconfig +0 -1
@@ -167,7 +167,6 @@ CONFIG_MTD_OTP=y CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_PXA2XX=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y # CONFIG_MISC_DEVICES is not set
arch/arm/configs/lpc32xx_defconfig +0 -1
@@ -59,7 +59,6 @@ CONFIG_MTD_NAND_MUSEUM_IDS=y CONFIG_MTD_NAND_SLC_LPC32XX=y CONFIG_MTD_NAND_MLC_LPC32XX=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=1 CONFIG_BLK_DEV_RAM_SIZE=16384
arch/arm/configs/netx_defconfig +0 -1
@@ -45,7 +45,6 @@ CONFIG_MTD_CFI=y CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_PLATRAM=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_NETDEVICES=y CONFIG_NET_ETHERNET=y CONFIG_NET_NETX=y
arch/arm/configs/nhk8815_defconfig +0 -1
@@ -62,7 +62,6 @@ CONFIG_MTD_ONENAND=y CONFIG_MTD_ONENAND_VERIFY_WRITE=y CONFIG_MTD_ONENAND_GENERIC=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y CONFIG_SCSI=y CONFIG_BLK_DEV_SD=y
arch/arm/configs/trizeps4_defconfig +0 -1
@@ -90,7 +90,6 @@ CONFIG_MTD_NAND_DISKONCHIP_PROBE_HIGH=y CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE=y CONFIG_MTD_ONENAND=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=8
arch/ia64/configs/bigsur_defconfig +0 -1
@@ -24,7 +24,6 @@ CONFIG_UNIX=y CONFIG_INET=y # CONFIG_IPV6 is not set CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=m CONFIG_IDE=m
arch/ia64/configs/generic_defconfig +0 -1
@@ -44,7 +44,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_CONNECTOR=y # CONFIG_PNP_DEBUG_MESSAGES is not set CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_SGI_IOC4=y
arch/ia64/configs/gensparse_defconfig +0 -1
@@ -35,7 +35,6 @@ CONFIG_ARPD=y CONFIG_SYN_COOKIES=y # CONFIG_IPV6 is not set CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_SGI_IOC4=y
arch/ia64/configs/tiger_defconfig +0 -1
@@ -41,7 +41,6 @@ CONFIG_ARPD=y CONFIG_SYN_COOKIES=y # CONFIG_IPV6 is not set CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_IDE=y
arch/ia64/configs/xen_domu_defconfig +0 -1
@@ -44,7 +44,6 @@ CONFIG_SYN_COOKIES=y # CONFIG_IPV6 is not set CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_IDE=y
arch/m68k/configs/amiga_defconfig +0 -1
@@ -153,7 +153,6 @@ CONFIG_PARPORT_1284=y CONFIG_AMIGA_FLOPPY=y CONFIG_AMIGA_Z2RAM=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/apollo_defconfig +0 -1
@@ -147,7 +147,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/atari_defconfig +0 -1
@@ -149,7 +149,6 @@ CONFIG_PARPORT_ATARI=m CONFIG_PARPORT_1284=y CONFIG_ATARI_FLOPPY=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/bvme6000_defconfig +0 -1
@@ -145,7 +145,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/hp300_defconfig +0 -1
@@ -146,7 +146,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/mac_defconfig +0 -1
@@ -146,7 +146,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_CONNECTOR=m CONFIG_BLK_DEV_SWIM=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/multi_defconfig +0 -1
@@ -173,7 +173,6 @@ CONFIG_ATARI_FLOPPY=y CONFIG_BLK_DEV_SWIM=y CONFIG_AMIGA_Z2RAM=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/mvme147_defconfig +0 -1
@@ -144,7 +144,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/mvme16x_defconfig +0 -1
@@ -145,7 +145,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/q40_defconfig +0 -1
@@ -141,7 +141,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/sun3_defconfig +0 -1
@@ -142,7 +142,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/m68k/configs/sun3x_defconfig +0 -1
@@ -142,7 +142,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/mips/configs/bcm47xx_defconfig +0 -1
@@ -284,7 +284,6 @@ CONFIG_MTD_ROM=y CONFIG_MTD_ABSENT=y CONFIG_MTD_PHYSMAP=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384
arch/mips/configs/bigsur_defconfig +0 -1
@@ -114,7 +114,6 @@ CONFIG_YAM=m CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_FW_LOADER=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_SGI_IOC4=m CONFIG_EEPROM_LEGACY=y
arch/mips/configs/fuloong2e_defconfig +0 -1
@@ -110,7 +110,6 @@ CONFIG_MTD_CFI_AMDSTD=m CONFIG_MTD_CFI_STAA=m CONFIG_MTD_PHYSMAP=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_RAM=m CONFIG_CDROM_PKTCDVD=m CONFIG_ATA_OVER_ETH=m
arch/mips/configs/ip27_defconfig +0 -1
@@ -100,7 +100,6 @@ CONFIG_MAC80211_RC_PID=y CONFIG_RFKILL=m CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_OSD=m CONFIG_CDROM_PKTCDVD=m CONFIG_ATA_OVER_ETH=m
arch/mips/configs/ip32_defconfig +0 -1
@@ -49,7 +49,6 @@ CONFIG_NETWORK_SECMARK=y CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_CONNECTOR=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_SGI_IOC4=y CONFIG_RAID_ATTRS=y
arch/mips/configs/jazz_defconfig +0 -1
@@ -201,7 +201,6 @@ CONFIG_PARIDE_KTTI=m CONFIG_PARIDE_ON20=m CONFIG_PARIDE_ON26=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=m CONFIG_CDROM_PKTCDVD=m
arch/mips/configs/lemote2f_defconfig +0 -1
@@ -106,7 +106,6 @@ CONFIG_RFKILL=m CONFIG_RFKILL_INPUT=y CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=8192 # CONFIG_MISC_DEVICES is not set
arch/mips/configs/malta_defconfig +0 -1
@@ -266,7 +266,6 @@ CONFIG_MTD_UBI_GLUEBI=m CONFIG_BLK_DEV_FD=m CONFIG_BLK_DEV_UMEM=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_CDROM_PKTCDVD=m
arch/mips/configs/markeins_defconfig +0 -1
@@ -132,7 +132,6 @@ CONFIG_MTD_CFI=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_PHYSMAP=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_SGI_IOC4=m CONFIG_SCSI=m CONFIG_SCSI_TGT=m
arch/mips/configs/nlm_xlp_defconfig +0 -1
@@ -327,7 +327,6 @@ CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_PHYSMAP=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_OSD=m CONFIG_BLK_DEV_RAM=y
arch/mips/configs/nlm_xlr_defconfig +0 -1
@@ -302,7 +302,6 @@ CONFIG_DEVTMPFS_MOUNT=y # CONFIG_STANDALONE is not set CONFIG_CONNECTOR=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_OSD=m CONFIG_BLK_DEV_RAM=y
arch/mips/configs/rm200_defconfig +0 -1
@@ -211,7 +211,6 @@ CONFIG_PARIDE_KTTI=m CONFIG_PARIDE_ON20=m CONFIG_PARIDE_ON26=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_SX8=m CONFIG_BLK_DEV_UB=m
arch/mips/configs/sead3_defconfig +0 -1
@@ -41,7 +41,6 @@ CONFIG_MTD_PHYSMAP=y CONFIG_MTD_UBI=y CONFIG_MTD_UBI_GLUEBI=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_SCSI=y # CONFIG_SCSI_PROC_FS is not set CONFIG_BLK_DEV_SD=y
arch/parisc/configs/712_defconfig +0 -1
@@ -45,7 +45,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_PARPORT=y CONFIG_PARPORT_PC=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=6144 CONFIG_ATA_OVER_ETH=m
arch/parisc/configs/b180_defconfig +0 -1
@@ -31,7 +31,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_PARPORT=y CONFIG_PARPORT_PC=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_CDROM_PKTCDVD=m CONFIG_ATA_OVER_ETH=y CONFIG_SCSI=y
arch/parisc/configs/c3000_defconfig +0 -1
@@ -43,7 +43,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_PREVENT_FIRMWARE_BUILD is not set CONFIG_BLK_DEV_UMEM=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_IDE=y CONFIG_BLK_DEV_IDECD=y CONFIG_BLK_DEV_NS87415=y
arch/parisc/configs/default_defconfig +0 -1
@@ -56,7 +56,6 @@ CONFIG_PARPORT_PC=m CONFIG_PARPORT_PC_PCMCIA=m CONFIG_PARPORT_1284=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=6144 CONFIG_IDE=y
arch/powerpc/configs/85xx/ge_imp3a_defconfig +0 -1
@@ -84,7 +84,6 @@ CONFIG_MTD_NAND=y CONFIG_MTD_NAND_FSL_ELBC=y CONFIG_PROC_DEVICETREE=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=131072
arch/powerpc/configs/86xx/gef_ppc9a_defconfig +0 -1
@@ -81,7 +81,6 @@ CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=131072
arch/powerpc/configs/86xx/gef_sbc310_defconfig +0 -1
@@ -81,7 +81,6 @@ CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=131072
arch/powerpc/configs/86xx/gef_sbc610_defconfig +0 -1
@@ -134,7 +134,6 @@ CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=131072
arch/powerpc/configs/86xx/sbc8641d_defconfig +0 -1
@@ -130,7 +130,6 @@ CONFIG_MTD_CFI_LE_BYTE_SWAP=y CONFIG_MTD_CFI_INTELEXT=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_MD=y
arch/powerpc/configs/c2k_defconfig +0 -1
@@ -158,7 +158,6 @@ CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_COMPLEX_MAPPINGS=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384
arch/powerpc/configs/chroma_defconfig +0 -1
@@ -174,7 +174,6 @@ CONFIG_MTD_CFI_STAA=y CONFIG_MTD_PHYSMAP_OF=y CONFIG_PROC_DEVICETREE=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=65536
arch/powerpc/configs/ppc6xx_defconfig +0 -1
@@ -389,7 +389,6 @@ CONFIG_PNP=y CONFIG_ISAPNP=y CONFIG_MAC_FLOPPY=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384
arch/score/configs/spct6600_defconfig +0 -1
@@ -30,7 +30,6 @@ CONFIG_ARPD=y # CONFIG_STANDALONE is not set # CONFIG_PREVENT_FIRMWARE_BUILD is not set CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=1 # CONFIG_MISC_DEVICES is not set
arch/sh/configs/sdk7786_defconfig +0 -1
@@ -118,7 +118,6 @@ CONFIG_MTD_NAND_SH_FLCTL=m CONFIG_MTD_UBI=y CONFIG_MTD_UBI_GLUEBI=m CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=y CONFIG_BLK_DEV_RAM=y # CONFIG_MISC_DEVICES is not set CONFIG_IDE=y
arch/sh/configs/sh7785lcr_32bit_defconfig +0 -1
@@ -56,7 +56,6 @@ CONFIG_MTD_CFI=y CONFIG_MTD_CFI_AMDSTD=y CONFIG_MTD_PHYSMAP=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_RAM=y # CONFIG_MISC_DEVICES is not set # CONFIG_SCSI_PROC_FS is not set
arch/sh/configs/titan_defconfig +0 -1
@@ -164,7 +164,6 @@ CONFIG_MTD_CFI=m CONFIG_MTD_JEDECPROBE=m CONFIG_MTD_NAND=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_RAM=y CONFIG_ATA_OVER_ETH=m CONFIG_SCSI=y
arch/sparc/configs/sparc32_defconfig +0 -1
@@ -32,7 +32,6 @@ CONFIG_IPV6_TUNNEL=m CONFIG_NET_PKTGEN=m CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_RAM=y CONFIG_SCSI=y CONFIG_BLK_DEV_SD=y
arch/sparc/configs/sparc64_defconfig +0 -1
@@ -62,7 +62,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" # CONFIG_PREVENT_FIRMWARE_BUILD is not set CONFIG_CONNECTOR=m CONFIG_BLK_DEV_LOOP=m -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_NBD=m CONFIG_CDROM_PKTCDVD=m CONFIG_CDROM_PKTCDVD_WCACHE=y
arch/tile/configs/tilegx_defconfig +0 -1
@@ -306,7 +306,6 @@ CONFIG_DEVTMPFS_MOUNT=y # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_SX8=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384
arch/tile/configs/tilepro_defconfig +0 -1
@@ -304,7 +304,6 @@ CONFIG_DEVTMPFS_MOUNT=y # CONFIG_FIRMWARE_IN_KERNEL is not set CONFIG_CONNECTOR=y CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_CRYPTOLOOP=m CONFIG_BLK_DEV_SX8=m CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_SIZE=16384
arch/um/defconfig +0 -1
@@ -324,7 +324,6 @@ CONFIG_BLK_DEV_UBD=y CONFIG_BLK_DEV_COW_COMMON=y CONFIG_BLK_DEV_LOOP=m CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 -# CONFIG_BLK_DEV_CRYPTOLOOP is not set # # DRBD disabled because PROC_FS, INET or CONNECTOR not selected
drivers/block/Kconfig +0 -23
@@ -243,14 +243,6 @@ config BLK_DEV_LOOP bits of, say, a sound file). This is also safe if the file resides on a remote file server. - There are several ways of encrypting disks. Some of these require - kernel patches. The vanilla kernel offers the cryptoloop option - and a Device Mapper target (which is superior, as it supports all - file systems). If you want to use the cryptoloop, say Y to both - LOOP and CRYPTOLOOP, and make sure you have a recent (version 2.12 - or later) version of util-linux. Additionally, be aware that - the cryptoloop is not safe for storing journaled filesystems. - Note that this loop device has nothing to do with the loopback device used for network connections from the machine to itself.
@@ -274,21 +266,6 @@ config BLK_DEV_LOOP_MIN_COUNT is used, it can be set to 0, since needed loop devices can be dynamically allocated with the /dev/loop-control interface. -config BLK_DEV_CRYPTOLOOP - tristate "Cryptoloop Support" - select CRYPTO - select CRYPTO_CBC - depends on BLK_DEV_LOOP - ---help--- - Say Y here if you want to be able to use the ciphers that are - provided by the CryptoAPI as loop transformation. This might be - used as hard disk encryption. - - WARNING: This device is not safe for journaled file systems like - ext3 or Reiserfs. Please use the Device Mapper crypto module - instead, which can be configured to be on-disk compatible with the - cryptoloop device. - source "drivers/block/drbd/Kconfig" config BLK_DEV_NBD
Signature · 1 line
1.7.10.4
RFC PATCH 3/4 Deprecate loop crypto ioctl fields.
In reply to Milan BrozMark encryption loop fields in userspace API deprecated.
--- include/uapi/linux/loop.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
include/uapi/linux/loop.h +9 -9
@@ -11,7 +11,7 @@#define LO_NAME_SIZE 64 -#define LO_KEY_SIZE 32 +#define LO_KEY_SIZE 32/* deprecated */ /*
@@ -33,11 +33,11 @@ struct loop_info {unsigned long lo_inode;/* ioctl r/o */ __kernel_old_dev_t lo_rdevice;/* ioctl r/o */ int lo_offset; -int lo_encrypt_type; -int lo_encrypt_key_size;/* ioctl w/o */ +int lo_encrypt_type;/* deprecated */ +int lo_encrypt_key_size;/* deprecated */ int lo_flags;/* ioctl r/o */ char lo_name[LO_NAME_SIZE ]; -unsigned char lo_encrypt_key[LO_KEY_SIZE ];/* ioctl w/o */ +unsigned char lo_encrypt_key[LO_KEY_SIZE ];/* deprecated */ unsigned long lo_init[2 ];char reserved[4 ]; };
@@ -49,17 +49,17 @@ struct loop_info64 {__u64 lo_offset;__u64 lo_sizelimit;/* bytes, 0 == max available */ __u32 lo_number;/* ioctl r/o */ -__u32 lo_encrypt_type; -__u32 lo_encrypt_key_size;/* ioctl w/o */ +__u32 lo_encrypt_type;/* deprecated */ +__u32 lo_encrypt_key_size;/* deprecated */ __u32 lo_flags;/* ioctl r/o */ __u8 lo_file_name[LO_NAME_SIZE ]; -__u8 lo_crypt_name[LO_NAME_SIZE ]; -__u8 lo_encrypt_key[LO_KEY_SIZE ];/* ioctl w/o */ +__u8 lo_crypt_name[LO_NAME_SIZE ];/* deprecated */ +__u8 lo_encrypt_key[LO_KEY_SIZE ];/* deprecated */ __u64 lo_init[2 ]; };/* -* Loop filter types +* Loop filter types (deprecated) */ #define LO_CRYPT_NONE 0
Signature · 1 line
1.7.10.4
RFC PATCH 1/4 Remove cryptoloop module.
In reply to Milan BrozMainline cryptoloop extension to block device loop driver is for years in limbo.
There are known problems (like predictable IV). This code is already superseded by using dmcrypt/cryptsetup.
(Cryptsetup automatically allocates free loop device if run over file image.)
Other implementation, out of mainline tree loop-AES is already heavily patching loop driver.
Current mainline userspace (util-linux) is going to remove encryption support in next version (already removed in git tree), encryption support is already deprecated in last release.
Let's stop pretend this code is supported and remove it completely.
--- drivers/block/Makefile | 1 - drivers/block/cryptoloop.c | 216 -------------------------------------------- 2 files changed, 217 deletions(-) delete mode 100644 drivers/block/cryptoloop.c
drivers/block/Makefile +0 -1
@@ -28,7 +28,6 @@ obj-$(CONFIG_BLK_DEV_OSD) += osdblk.o obj-$(CONFIG_BLK_DEV_UMEM) += umem.o obj-$(CONFIG_BLK_DEV_NBD) += nbd.o -obj-$(CONFIG_BLK_DEV_CRYPTOLOOP) += cryptoloop.o obj-$(CONFIG_VIRTIO_BLK) += virtio_blk.o obj-$(CONFIG_VIODASD) += viodasd.o
drivers/block/cryptoloop.c deleted +0 -216
216 lines not on this page · raw message
Signature · 1 line
1.7.10.4
Re: [RFC PATCH 0/4] Remove cryptoloop support (cryptsetup replacement)
In reply to Milan BrozQuoted 1 line · Milan Broz
Dm-crypt/cryptsetup provides replacement for long time already.
Just one addition, here are notes how to replace cryptoloop with cryptsetup.
Because there are several incompatible lostup implementations, it cannot be automated. But you can easily find proper options using few switches below.
Note, that some configurations are insecure and often the insecure variant is mostly the default.
One such example is a passphrase used directly as key (not hashed) (option -N which is sometimes default) an key is padded. So with 8 char password and 256bit key 192bits of key is zeroed.
Another problem is with using predictable IV (initial vector, which is basically just sector number in losetup) and CBC mode. For CBC mode this is not secure, because it open system to watermarking attacks.
(Cryptsetup uses ESSIV by default or XTS mode.)
Cryptsetup will not stop you to use such configurations though, it is designed to allow everything possible if user wants.
LOSETUP -> CRYPTSETUP replacement
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(N.B. for new images you should you use cryptsetup defaults and get rid of most compat options.)
Short example for compatible mapping:
"losetup -e twofish -N /dev/loop0 /image.img"
can be used by cryptsetup
"cryptsetup create image_plain /image.img -c twofish-cbc-plain -H plain"
(Plaintext device will be /dev/mapper/image_plain instead of /dev/loop0.)
Details
~~~~~~~
In Debian and some other distros is hashing default, hash is "ripemd160", default key size is mostly 256bits. In some distros hashing is not used.
For cryptsetup (plain mode, no LUKS) you will need these options:
[-c|--cipher] - cipher specification
[-s|--key-size] - key size in bits
[-h|--hash] - password hashing function ("plain" is no hashing)
[-o|--offset] - offset (in 512 sectors!)
[-p|--skip] - IV offset (in 512 sectors!) (usually the same as -o)Here are some common combinations and cryptsetup replacements:
losetup parameters | cryptsetup paramaters
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-e twofish [-N] | -c twofish-cbc-plain -H plain [-s 256]
-e twofish | -c twofish-cbc-plain -H ripemd160 [-s 256]
Ditto for most other ciphers:
-e aes [-N] | -c aes-cbc-plain -H plain [-s 256]
-e aes | -c aes-cbc-plain -H ripemd160 [-s 256]
...
Key size (Debian option -k, not upstream)
-k 128 | -s 128
Specifying offset, note losetup takes bytes, cryptsetup sectors. Offset must be multiple of sectors (even in losetup). SKip (-p) means offset for IV, you need specify both here.
-o 2560 | -o 5 -p 5 # 2560/512 = 5
Even some esoteric configurations possible
(This example was default for some very old SuSe distro.)
Loop using twofish with only 160 bit key (zero padded to 192 bits) with no IV.
cryptsetup -c twofish-cbc-null -s 192 -h ripemd160:20
Cryptsetup doesn't provide direct replacement for --pass-fd option (pass file descriptor to read key) but you can use directly keyfile option and keyfile size (see cryptsetup man page).
Also note, that cryptsetup allows mapping of loop-aes (multi-key) devices (see loopaesOpen command in man page).
But this was never part of mainline kernel, so it is not important for mainline cryptoloop replacement.
Thanks,
Milan