[dm-crypt] Bypass encrypt and decrypt data in dm-crypt

[dm-crypt] Bypass encrypt and decrypt data in dm-crypt

[FAN ZHANG]

[-- Attachment #1: Type: text/plain, Size: 1594 bytes --]

All:
 
 
We are using dm-crypt for Android device encryption.  However, we need reserve some sectors in block device for status and integration check and do not want to encrypt/decrypt some sectors when using dm-crypt.
 
So in crypt_convert_block()
 
When
offset sector of ctx +  sector number of bio_in  is the range of bypass sector list.
 
 
instead call
if (bio_data_dir(ctx->bio_in) == WRITE)
 r = crypt_copy_write_data(bv_in, bv_out, offset, 1 << SECTOR_SHIFT); else  r = crypt_copy_read_data(bv_in, bv_out, offset, 1 << SECTOR_SHIFT);
 
I want to call another function to copy data of a sector from 
ctx->bio_in to
ctx->bio_out directly.
 
 
I tried the following implementation 
 
in ps_copy_write_data()
 
 
struct bio_vec *bv_in = bio_iovec_idx(ctx->bio_in, ctx->idx_in); 
struct bio_vec *bv_out = bio_iovec_idx(ctx->bio_out, ctx->idx_out); 
struct page * page_in = bv_in->bv_page; 
struct page * page_out = bv_out->bv_page;
 
void * addr1 = kmap_atomic(page_in, KM_USER0); 
void * addr2 = kmap_atomic(page_out, KM_USER1);
 
unsigned int offset = ctx->offset_in;
 
memcpy(addr2 + offset, addr1 + offset, 1 << SECTOR_SHIFT);
 
kunmap_atomic(addr2, KM_USER1);
kunmap_atomic(addr1, KM_USER0);
 
but above implementation works for read (since bv_in and bv_out are same for decryption) but does not work for write. 
 
It seems that 
memcpy(addr2 + offset, addr1 + offset, 1 << SECTOR_SHIFT);
 
fails to copy page associated with bv_in  to page associated with bv_out 
 
 
 
Could you give me a hint to reslove this issue?
 
Thanks
 
Fan

[-- Attachment #2: Type: text/html, Size: 8222 bytes --]

Re: [dm-crypt] Bypass encrypt and decrypt data in dm-crypt

[Arno Wagner]

Hi,

while I do not know what the issue you encounter is,
it would be better to have your status block before the
encrypted part and simply map with an offset, e.g.
"-p 1" to skip the first sector. Thsi would not break
layering, as your approach seems to do.

Is there a specific reason you want the non-encrypted 
block somewhere in the middle? (if I understand this correctly...)
I cannot see any security reason, as a non-encrypted block
will allways stick out and can be found automatically 
anyways.

Arno

On Wed, Jan 18, 2012 at 07:56:38AM -0800, FAN ZHANG wrote:
> All:
> ?
> ?
>
> We are using dm-crypt for Android device encryption.? However, we need
> reserve some sectors in block device for status and integration check and
> do not want to encrypt/decrypt some sectors when using dm-crypt.
>
> ?
> So in crypt_convert_block()
> ?
> When
> offset sector of ctx +? sector number of bio_in? is the range of bypass sector list.
> ?
> ?
> instead call
> if (bio_data_dir(ctx->bio_in) == WRITE)
> ?r = crypt_copy_write_data(bv_in, bv_out, offset, 1 << SECTOR_SHIFT); else? r = crypt_copy_read_data(bv_in, bv_out, offset, 1 << SECTOR_SHIFT);
> ?
> I want to call another function to copy data of a sector from 
> ctx->bio_in to
> ctx->bio_out directly.
> ?
> ?
> I tried the following implementation 
> ?
> in ps_copy_write_data()
> ?
> ?
> struct bio_vec *bv_in = bio_iovec_idx(ctx->bio_in, ctx->idx_in); 
> struct bio_vec *bv_out = bio_iovec_idx(ctx->bio_out, ctx->idx_out); 
> struct page * page_in = bv_in->bv_page; 
> struct page * page_out = bv_out->bv_page;
> ?
> void * addr1 = kmap_atomic(page_in, KM_USER0); 
> void * addr2 = kmap_atomic(page_out, KM_USER1);
> ?
> unsigned int offset = ctx->offset_in;
> ?
> memcpy(addr2 + offset, addr1 + offset, 1 << SECTOR_SHIFT);
> ?
> kunmap_atomic(addr2, KM_USER1);
> kunmap_atomic(addr1, KM_USER0);
> ?
> but above implementation works for read (since bv_in and bv_out are same for decryption) but does not work for write. 
> ?
> It seems that 
> memcpy(addr2 + offset, addr1 + offset, 1 << SECTOR_SHIFT);
> ?
> fails to copy page associated with bv_in? to page associated with bv_out 
> ?
> ?
> ?
> Could you give me a?hint to reslove this issue?
> ?
> Thanks
> ?
> Fan

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
One of the painful things about our time is that those who feel certainty 
are stupid, and those with any imagination and understanding are filled 
with doubt and indecision. -- Bertrand Russell 

Re: [dm-crypt] Bypass encrypt and decrypt data in dm-crypt

[Milan Broz]

On 01/18/2012 04:56 PM, FAN ZHANG wrote:
> All:
> We are using dm-crypt for Android device encryption.However, we need
> reserve some sectors in block device for status and integration check
> and do not want to encrypt/decrypt some sectors when using dm-crypt.

Please can you describe exactly what you need?

I will not accept any patch in dmcrypt which bypass encryption,
but I think the problem is solvable using combination
of dm targets, or  using some trick.

But I still have no idea what problem you are trying to solve...
(Please do not describe implementation, describe the problem.)

Thanks,
Milan