On Wed, Feb 10, 2021 at 12:17:30PM -0800, Eric Biggers wrote: > On Mon, Feb 01, 2021 at 05:10:17AM +0000, Satya Tangirala wrote: > > Update the device-mapper core to support exposing the inline crypto > > support of the underlying device(s) through the device-mapper device. > > > > This works by creating a "passthrough keyslot manager" for the dm > > device, which declares support for encryption settings which all > > underlying devices support. When a supported setting is used, the bio > > cloning code handles cloning the crypto context to the bios for all the > > underlying devices. When an unsupported setting is used, the blk-crypto > > fallback is used as usual. > > > > Crypto support on each underlying device is ignored unless the > > corresponding dm target opts into exposing it. This is needed because > > for inline crypto to semantically operate on the original bio, the data > > must not be transformed by the dm target. Thus, targets like dm-linear > > can expose crypto support of the underlying device, but targets like > > dm-crypt can't. (dm-crypt could use inline crypto itself, though.) > > > > A DM device's table can only be changed if the "new" inline encryption > > capabilities are a (*not* necessarily strict) superset of the "old" inline > > encryption capabilities. Attempts to make changes to the table that result > > in some inline encryption capability becoming no longer supported will be > > rejected. > > > > For the sake of clarity, key eviction from underlying devices will be > > handled in a future patch. > > > > Co-developed-by: Eric Biggers <ebiggers@xxxxxxxxxx> > > Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> > > Signed-off-by: Satya Tangirala <satyat@xxxxxxxxxx> > > I don't see any obvious issues with this latest version. I assume you've tested > it on real hardware? > > If it's needed despite my Co-developed-by, feel free to add: > > Reviewed-by: Eric Biggers <ebiggers@xxxxxxxxxx> > > A few nits about comments, in case you resend: > Thanks! I addressed the nits, added acked/reviewed-bys and resent v5. -- dm-devel mailing list dm-devel@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/dm-devel
