Commit Graph

1524 Commits

Author SHA1 Message Date
Ed Schouten
eb4c31fd41 Add support for asterisk characters when filling in the GELI password
during boot.

Change the last argument of gets() to indicate a visibility flag and add
definitions for the numerical constants. Except for the value 2, gets()
will behave exactly the same, so existing consumers shouldn't break. We
only use it in two places, though.

Submitted by:	lme (older version)
2010-11-14 14:12:43 +00:00
Andrey V. Elsukov
55514bdfc0 Fix regression introduced in r215088: gpart(8) reports
"arg0 'provider': Invalid argument" after creating new partition
table.
Move code for search of existing geom into g_part_find_geom
function and use this function instead of g_part_parm_geom
in g_part_ctl_create.

Approved by:	kib (mentor)
2010-11-11 12:13:41 +00:00
Andrey V. Elsukov
7085c3bc98 In r212554 name of G_PART_PARM_GEOM and G_PART_PARM_PROVIDER
ctlreq parameters was changed to "arg0". Fix the last place where
it is used.

Approved by:	kib (mentor)
2010-11-10 14:38:51 +00:00
Jaakko Heinonen
9d142a6ee6 Extend the g_eventlock mutex coverage in one_event() to include setting
of the EV_DONE flag and use the mutex to protect against losing wakeups
in g_waitfor_event().

Reported by:	davidxu
Tested by:	davidxu
Discussed on:	freebsd-current
2010-11-03 16:19:35 +00:00
Andrey V. Elsukov
e7926a3703 Reimplemented "gpart destroy -F". Now it does all work in kernel.
This was needed for recover implementation.

Implement the recover command for GPT. Now GPT will marked as
corrupt when any of three types of corruption will be detected:
1. Damaged primary GPT header or table
2. Damaged secondary GPT header or table
3. Secondary header is not located in the last LBA
Marked GPT becomes read-only. Any changes with corrupt table
are prohibited. Only "destroy" and "recover" commands are allowed.

Discussed with:	geom@ (mostly silence)
Tested by:	Ilya A. Arhipov
Approved by:	mav (mentor)
MFC after:	2 weeks
2010-10-25 16:23:35 +00:00
Pawel Jakub Dawidek
0d2f5a4eaa - Improve error messages, so instead of 'Not fully done', the user will get
information that device is already suspended or that device is using
  one-time key and suspend is not supported.
- 'geli suspend -a' silently skips devices that use one-time key, this is fine,
  but because we log which device were suspended on the console, log also which
  devices were skipped.
2010-10-22 22:58:00 +00:00
Pawel Jakub Dawidek
2f2d7830b5 Close a race between checking if device is already suspended and suspending it. 2010-10-22 22:54:26 +00:00
Pawel Jakub Dawidek
d8d61ef8fc Add State tag, so 'geli status' will report active/suspended status, eg:
# geli status
	   Name     Status  Components
	da0.eli  SUSPENDED  da0
	da1.eli     ACTIVE  da1
2010-10-22 22:45:26 +00:00
Pawel Jakub Dawidek
4f294e1289 Encryption keys array might be NULL if device is suspended. Check for this, so
we don't panic when we detach suspended device.
2010-10-22 22:44:09 +00:00
Pawel Jakub Dawidek
1d0214411e Move sc_akeyctx and sc_ivctx initialization to the g_eli_mkey_propagate()
function which eliminates code duplication and will ensure proper order
of operation.
2010-10-22 22:13:11 +00:00
Pawel Jakub Dawidek
3ac01bc2ae Free opencrypto sessions on suspend, as they also might keep encryption keys. 2010-10-21 19:44:28 +00:00
Pawel Jakub Dawidek
738ffa9780 Fix a bug introduced in r213067 where we use authentication key before
initializing it.
2010-10-21 12:58:26 +00:00
Pawel Jakub Dawidek
5ad4a7c74a Bring in geli suspend/resume functionality (finally).
Before this change if you wanted to suspend your laptop and be sure that your
encryption keys are safe, you had to stop all processes that use file system
stored on encrypted device, unmount the file system and detach geli provider.

This isn't very handy. If you are a lucky user of a laptop where suspend/resume
actually works with FreeBSD (I'm not!) you most likely want to suspend your
laptop, because you don't want to start everything over again when you turn
your laptop back on.

And this is where geli suspend/resume steps in. When you execute:

	# geli suspend -a

geli will wait for all in-flight I/O requests, suspend new I/O requests, remove
all geli sensitive data from the kernel memory (like encryption keys) and will
wait for either 'geli resume' or 'geli detach'.

Now with no keys in memory you can suspend your laptop without stopping any
processes or unmounting any file systems.

When you resume your laptop you have to resume geli devices using 'geli resume'
command. You need to provide your passphrase, etc. again so the keys can be
restored and suspended I/O requests released.

Of course you need to remember that 'geli suspend' won't clear file system
cache and other places where data from your geli-encrypted file system might be
present. But to get rid of those stopping processes and unmounting file system
won't help either - you have to turn your laptop off. Be warned.

Also note, that suspending geli device which contains file system with geli
utility (or anything used by 'geli resume') is not very good idea, as you won't
be able to resume it - when you execute geli(8), the kernel will try to read it
and this read I/O request will be suspended.
2010-10-20 20:50:55 +00:00
Pawel Jakub Dawidek
056638c469 - Add missing comments.
- Make a comment consistent with others.
2010-10-20 20:01:45 +00:00
Jaakko Heinonen
bc2589f5b7 Use make_dev_p(9) with the MAKEDEV_CHECKNAME flag instead of make_dev(9)
and print a diagnostic if the call fails.

This avoids a panic when a device with an invalid name is attempted to
be registered. For example the label class gets device names from
untrusted input.

Reviewed by:	freebsd-geom
2010-10-19 16:48:49 +00:00
Rui Paulo
42a783c16a The canonical way to print __func__ when using KASSERT() is to write
("%s", __func__). This avoids clang's -Wformat-string warnings.
2010-10-13 11:35:59 +00:00
Andrey V. Elsukov
21bf062e7e Replace strlen(_PATH_DEV) with sizeof(_PATH_DEV) - 1.
Suggested by:	kib
Approved by:	kib (mentor)
MFC after:	5 days
2010-10-09 20:20:27 +00:00
Ulf Lilleengen
de02b15928 - Check flag with the bitwise operator, not the logical operator.
Submitted by:	arundel
MFC after:	1 week
2010-10-01 06:12:13 +00:00
Andrey V. Elsukov
b1da166ef1 Some schemes can allocate memory for internal purposes but when
GEOM does withering this memory doesn't freed. Add G_PART_DESTROY
call to g_part_wither. Also add missed g_free() call to G_PART_READ
method for MBR and PC98 schemes.

Submitted by:	jh (previous version)
Reviewed by:	pjd
Approved by:	kib (mentor)
2010-09-25 18:27:29 +00:00
Pawel Jakub Dawidek
f95168e08d Change g_eli_debug to int, so one can turn off any GELI output by setting
kern.geom.eli.debug sysctl to -1.

MFC after:	2 weeks
2010-09-25 10:32:04 +00:00
Pawel Jakub Dawidek
350e8df8de Ignore errors from BIO_FLUSH. It might confuse users that provider wasn't
really killed. What we really care about are write errors only.

MFC after:	2 weeks
2010-09-25 10:31:05 +00:00
Pawel Jakub Dawidek
cec283baf4 Allow to configure GPT attributes. It shouldn't be allowed to set bootfailed
attribute (it should be allowed only to unset it), but for test purposes it
might be useful, so the current code allows it.

Reviewed by:	arch@ (Message-ID: <20100917234542.GE1902@garage.freebsd.pl>)
MFC after:	2 weeks
2010-09-24 19:33:47 +00:00
Pawel Jakub Dawidek
9839c97b4d Update copyright years.
MFC after:	1 week
2010-09-23 12:02:08 +00:00
Pawel Jakub Dawidek
9a5a1d1e1e Add support for AES-XTS. This will be the default now.
MFC after:	1 week
2010-09-23 11:58:36 +00:00
Pawel Jakub Dawidek
c6a26d4c88 Implement switching of data encryption key every 2^20 blocks.
This ensures the same encryption key won't be used for more than
2^20 blocks (sectors). This will be the default now.

MFC after:	1 week
2010-09-23 11:49:47 +00:00
Pawel Jakub Dawidek
1f0fb66f30 Make the code similar to the code in g_eli_integrity.c.
MFC after:	1 week
2010-09-23 11:23:10 +00:00
Pawel Jakub Dawidek
b35bfe7e10 Define default overwrite count, so that userland can use it.
MFC after:	1 week
2010-09-23 11:19:48 +00:00
Pawel Jakub Dawidek
5e6dce4bf0 When trashing metadata, flush after each write.
MFC after:	1 week
2010-09-23 10:43:37 +00:00
Brian Somers
0f81f3046d Support attaching version 4 metadata
Reviewed by:	pjd
2010-09-19 10:45:53 +00:00
Alexander Motin
659f684ea0 Add support for dumping kernel to gconcat.
Dumping goes to the component, where dump partition begins.
2010-09-16 17:24:25 +00:00
Pawel Jakub Dawidek
2738b715ea Change message when setting or unsetting attribute less confusing.
Before:

	ada0 has <attrib> set

After:

	<attrib> set on ada0

MFC after:	2 weeks
2010-09-15 21:15:00 +00:00
Pawel Jakub Dawidek
2f4e9a099b Make the message that informs about bootcode being written to disk less
confusing.

Note there is still no information about 'partcode' being written to disk
(gpart bootcode -p <partcode> <disk>).

Maybe in the future all the messages printed by gpart(8) on success could be
hidden under -v?

PR:		bin/150239
Reported by:	Roddi <roddi@me.com>
Submitted by:	arundel
MFC after:	2 weeks
2010-09-15 20:59:13 +00:00
Pawel Jakub Dawidek
8107ecf892 - Change all places where G_TYPE_ASCNUM is used to G_TYPE_NUMBER.
It turns out the new type wasn't really needed.
- Reorganize code a little bit.
2010-09-14 16:21:13 +00:00
Pawel Jakub Dawidek
b312136354 Simplify the code a bit. 2010-09-14 11:42:07 +00:00
Pawel Jakub Dawidek
946e2f3595 - Remove gc_argname field. It was introduced for gpart(8), but if I
understand everything correctly, we don't really need it.
- Provide default numeric value as strings. This allows to simplify
  a lot of code.
- Bump version number.
2010-09-13 13:48:18 +00:00
Pawel Jakub Dawidek
a478ea7490 - Allow to specify value as const pointers.
- Make optional string values always an empty string.
2010-09-13 08:56:07 +00:00
Justin T. Gibbs
f03f7a0ca3 Correct bioq_disksort so that bioq_insert_tail() offers barrier semantic.
Add the BIO_ORDERED flag for struct bio and update bio clients to use it.

The barrier semantics of bioq_insert_tail() were broken in two ways:

 o In bioq_disksort(), an added bio could be inserted at the head of
   the queue, even when a barrier was present, if the sort key for
   the new entry was less than that of the last queued barrier bio.

 o The last_offset used to generate the sort key for newly queued bios
   did not stay at the position of the barrier until either the
   barrier was de-queued, or a new barrier (which updates last_offset)
   was queued.  When a barrier is in effect, we know that the disk
   will pass through the barrier position just before the
   "blocked bios" are released, so using the barrier's offset for
   last_offset is the optimal choice.

sys/geom/sched/subr_disk.c:
sys/kern/subr_disk.c:
	o Update last_offset in bioq_insert_tail().

	o Only update last_offset in bioq_remove() if the removed bio is
	  at the head of the queue (typically due to a call via
	  bioq_takefirst()) and no barrier is active.

	o In bioq_disksort(), if we have a barrier (insert_point is non-NULL),
	  set prev to the barrier and cur to it's next element.  Now that
	  last_offset is kept at the barrier position, this change isn't
	  strictly necessary, but since we have to take a decision branch
	  anyway, it does avoid one, no-op, loop iteration in the while
	  loop that immediately follows.

	o In bioq_disksort(), bypass the normal sort for bios with the
	  BIO_ORDERED attribute and instead insert them into the queue
	  with bioq_insert_tail().  bioq_insert_tail() not only gives
	  the desired command order during insertion, but also provides
	  barrier semantics so that commands disksorted in the future
	  cannot pass the just enqueued transaction.

sys/sys/bio.h:
	Add BIO_ORDERED as bit 4 of the bio_flags field in struct bio.

sys/cam/ata/ata_da.c:
sys/cam/scsi/scsi_da.c
	Use an ordered command for SCSI/ATA-NCQ commands issued in
	response to bios with the BIO_ORDERED flag set.

sys/cam/scsi/scsi_da.c
	Use an ordered tag when issuing a synchronize cache command.

	Wrap some lines to 80 columns.

sys/cddl/contrib/opensolaris/uts/common/fs/zfs/vdev_geom.c
sys/geom/geom_io.c
	Mark bios with the BIO_FLUSH command as BIO_ORDERED.

Sponsored by:	Spectra Logic Corporation
MFC after:	1 month
2010-09-02 19:40:28 +00:00
Pawel Jakub Dawidek
efb46508ce Correct offset conversion to little endian. It was implemented in version 2,
but because of a bug it was a no-op, so we were still using offsets in native
byte order for the host. Do it properly this time, bump version to 4 and set
the G_ELI_FLAG_NATIVE_BYTE_ORDER flag when version is under 4.

MFC after:	2 weeks
2010-08-28 08:30:20 +00:00
Alexander Motin
3d7cfb15f5 Remove bintime_cmp() function, unused since r200086.
MFC after:	1 week
2010-08-18 15:38:10 +00:00
Andrey V. Elsukov
d02dc4cd41 Check that gsp is not NULL before access. It can be NULL
for some cases.

Approved by:	kib (mentor)
MFC after:	1 week
2010-08-03 11:21:17 +00:00
Andrey V. Elsukov
a45f4c6e2c Check that table is not NULL before access, it can be NULL
for some cases.

Approved by:	mav (mentor)
MFC after:	2 weeks
2010-08-03 09:10:48 +00:00
Andrey V. Elsukov
a80f05bb73 Forward ioctl requests to original geom.
PR:		148540
Silence from:	luigi
Reviewed by:	pjd
Approved by:	mav (mentor)
MFC after:	2 weeks
2010-08-02 10:30:49 +00:00
Andrey V. Elsukov
b6d4028166 Release access for consumers that are opened, but will be destroyed
indirectly by orphan method.

PR:		148688
Silence from:	marcel
Approved by:	mav (mentor)
MFC after: 	2 weeks
2010-08-02 10:26:15 +00:00
Alexander Motin
8edcf69406 Export PCI IDs of ATA/SATA controllers through CAM and ata(4) layers to
GEOM. This information needed for proper soft-RAID's on-disk metadata
reading and writing.
2010-07-25 15:43:52 +00:00
Andrey V. Elsukov
733a9e2783 Prevent access after free to table entry in case when
user deletes partition that not yet created (changes doesn't
committed to disk).

PR:		148687
Approved by:	mav (mentor)
MFC after:	7 days
2010-07-23 06:30:01 +00:00
Ruslan Ermilov
cf1457e4fd Fixed cache size decoding read from a label.
PR:		kern/144732
Submitted by:	Eugene Grosbein
MFC after:	3 days
2010-07-14 08:22:00 +00:00
Rui Paulo
c6b2b6fce6 Add NTFS partition type to GEOM_MBR. 2010-06-26 13:20:40 +00:00
Pawel Jakub Dawidek
2aa15ffdab 'unit' can be negative, so use signed type for it.
Found by:	Coverity Prevent
CID:		3731
MFC after:	3 days
2010-06-14 21:58:55 +00:00
Pawel Jakub Dawidek
15725379d0 BIO_DELETE contains range we want to delete and doesn't provide any useful
data, so there is no need to copy it to userland.

MFC after:	3 days
2010-06-14 21:56:24 +00:00
Andriy Gapon
1bdfff2252 fix a few cases where a string is passed via format argument instead of
via %s

Most of the cases looked harmless, but this is done for the sake of
correctness.  In one case it even allowed to drop an intermediate buffer.

Found by:	clang
MFC after:	2 week
2010-06-11 19:27:21 +00:00