[PATCH 0/5] eCryptfs: Clean up usage of helper page for crypto ops

[PATCH 0/5] eCryptfs: Clean up usage of helper page for crypto ops

[Tyler Hicks]

This is a somewhat related set of patches that scratch some itches that I had
after working on the migration to the ablkcipher API. They all relate to how
eCryptfs is using the "helper page" during crypto operations. The helper page
is the intermediary page between the lower encrypted page and the decrypted
eCryptfs page.

When decrypting, eCryptfs reads from the lower filesystem into a helper page.
Then the helper page is decrypted and the result is stored in the eCryptfs
page.

When encrypting, eCryptfs encrypts its page and the result is stored in a
helper page. Then the contents of the helper page are written to the lower
filesystem.

It is slightly more complex, as crypto operations aren't done across the entire
page (that's where eCryptfs "extents" come into play). But the focus of these
patches is how we're utilizing the helper pages.

Tyler

[PATCH 1/5] eCryptfs: Use entire helper page during page crypto operations

[Tyler Hicks]

When encrypting eCryptfs pages and decrypting pages from the lower
filesystem, utilize the entire helper page rather than only the first
4096 bytes.

This only affects architectures where PAGE_CACHE_SIZE is larger than
4096 bytes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 fs/ecryptfs/crypto.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index f71ec12..e8976c0 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -450,10 +450,11 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
 			(unsigned long long)(extent_base + extent_offset), rc);
 		goto out;
 	}
-	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
-					  page, (extent_offset
-						 * crypt_stat->extent_size),
-					  crypt_stat->extent_size, extent_iv);
+	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page,
+					extent_offset * crypt_stat->extent_size,
+					page,
+					extent_offset * crypt_stat->extent_size,
+					crypt_stat->extent_size, extent_iv);
 	if (rc < 0) {
 		printk(KERN_ERR "%s: Error attempting to encrypt page with "
 		       "page->index = [%ld], extent_offset = [%ld]; "
@@ -520,8 +521,9 @@ int ecryptfs_encrypt_page(struct page *page)
 				   * (PAGE_CACHE_SIZE
 				      / crypt_stat->extent_size))
 				  + extent_offset), crypt_stat);
-		rc = ecryptfs_write_lower(ecryptfs_inode, enc_extent_virt,
-					  offset, crypt_stat->extent_size);
+		rc = ecryptfs_write_lower(ecryptfs_inode, (enc_extent_virt +
+				extent_offset * crypt_stat->extent_size),
+				offset, crypt_stat->extent_size);
 		if (rc < 0) {
 			ecryptfs_printk(KERN_ERR, "Error attempting "
 					"to write lower page; rc = [%d]"
@@ -558,10 +560,10 @@ static int ecryptfs_decrypt_extent(struct page *page,
 		goto out;
 	}
 	rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
-					  (extent_offset
-					   * crypt_stat->extent_size),
-					  enc_extent_page, 0,
-					  crypt_stat->extent_size, extent_iv);
+					extent_offset * crypt_stat->extent_size,
+					enc_extent_page,
+					extent_offset * crypt_stat->extent_size,
+					crypt_stat->extent_size, extent_iv);
 	if (rc < 0) {
 		printk(KERN_ERR "%s: Error attempting to decrypt to page with "
 		       "page->index = [%ld], extent_offset = [%ld]; "
@@ -620,9 +622,10 @@ int ecryptfs_decrypt_page(struct page *page)
 			&offset, ((page->index * (PAGE_CACHE_SIZE
 						  / crypt_stat->extent_size))
 				  + extent_offset), crypt_stat);
-		rc = ecryptfs_read_lower(enc_extent_virt, offset,
-					 crypt_stat->extent_size,
-					 ecryptfs_inode);
+		rc = ecryptfs_read_lower((enc_extent_virt +
+				extent_offset * crypt_stat->extent_size),
+				offset, crypt_stat->extent_size,
+				ecryptfs_inode);
 		if (rc < 0) {
 			ecryptfs_printk(KERN_ERR, "Error attempting "
 					"to read lower page; rc = [%d]"
-- 
1.8.1.2

[PATCH 2/5] eCryptfs: Read/write entire page during page IO

[Tyler Hicks]

When reading and writing encrypted pages, perform IO using the entire
page all at once rather than 4096 bytes at a time.

This only affects architectures where PAGE_CACHE_SIZE is larger than
4096 bytes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 fs/ecryptfs/crypto.c | 66 ++++++++++++++++++++++++----------------------------
 1 file changed, 31 insertions(+), 35 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index e8976c0..4185584 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -490,6 +490,7 @@ int ecryptfs_encrypt_page(struct page *page)
 	char *enc_extent_virt;
 	struct page *enc_extent_page = NULL;
 	loff_t extent_offset;
+	loff_t lower_offset;
 	int rc = 0;
 
 	ecryptfs_inode = page->mapping->host;
@@ -503,12 +504,10 @@ int ecryptfs_encrypt_page(struct page *page)
 				"encrypted extent\n");
 		goto out;
 	}
-	enc_extent_virt = kmap(enc_extent_page);
+
 	for (extent_offset = 0;
 	     extent_offset < (PAGE_CACHE_SIZE / crypt_stat->extent_size);
 	     extent_offset++) {
-		loff_t offset;
-
 		rc = ecryptfs_encrypt_extent(enc_extent_page, crypt_stat, page,
 					     extent_offset);
 		if (rc) {
@@ -516,25 +515,24 @@ int ecryptfs_encrypt_page(struct page *page)
 			       "rc = [%d]\n", __func__, rc);
 			goto out;
 		}
-		ecryptfs_lower_offset_for_extent(
-			&offset, ((((loff_t)page->index)
-				   * (PAGE_CACHE_SIZE
-				      / crypt_stat->extent_size))
-				  + extent_offset), crypt_stat);
-		rc = ecryptfs_write_lower(ecryptfs_inode, (enc_extent_virt +
-				extent_offset * crypt_stat->extent_size),
-				offset, crypt_stat->extent_size);
-		if (rc < 0) {
-			ecryptfs_printk(KERN_ERR, "Error attempting "
-					"to write lower page; rc = [%d]"
-					"\n", rc);
-			goto out;
-		}
+	}
+
+	ecryptfs_lower_offset_for_extent(&lower_offset,
+		page->index * (PAGE_CACHE_SIZE / crypt_stat->extent_size),
+		crypt_stat);
+	enc_extent_virt = kmap(enc_extent_page);
+	rc = ecryptfs_write_lower(ecryptfs_inode, enc_extent_virt, lower_offset,
+				  PAGE_CACHE_SIZE);
+	kunmap(enc_extent_page);
+	if (rc < 0) {
+		ecryptfs_printk(KERN_ERR,
+			"Error attempting to write lower page; rc = [%d]\n",
+			rc);
+		goto out;
 	}
 	rc = 0;
 out:
 	if (enc_extent_page) {
-		kunmap(enc_extent_page);
 		__free_page(enc_extent_page);
 	}
 	return rc;
@@ -599,6 +597,7 @@ int ecryptfs_decrypt_page(struct page *page)
 	char *enc_extent_virt;
 	struct page *enc_extent_page = NULL;
 	unsigned long extent_offset;
+	loff_t lower_offset;
 	int rc = 0;
 
 	ecryptfs_inode = page->mapping->host;
@@ -612,26 +611,24 @@ int ecryptfs_decrypt_page(struct page *page)
 				"encrypted extent\n");
 		goto out;
 	}
+
+	ecryptfs_lower_offset_for_extent(&lower_offset,
+		page->index * (PAGE_CACHE_SIZE / crypt_stat->extent_size),
+		crypt_stat);
 	enc_extent_virt = kmap(enc_extent_page);
+	rc = ecryptfs_read_lower(enc_extent_virt, lower_offset, PAGE_CACHE_SIZE,
+				 ecryptfs_inode);
+	kunmap(enc_extent_page);
+	if (rc < 0) {
+		ecryptfs_printk(KERN_ERR,
+			"Error attempting to read lower page; rc = [%d]\n",
+			rc);
+		goto out;
+	}
+
 	for (extent_offset = 0;
 	     extent_offset < (PAGE_CACHE_SIZE / crypt_stat->extent_size);
 	     extent_offset++) {
-		loff_t offset;
-
-		ecryptfs_lower_offset_for_extent(
-			&offset, ((page->index * (PAGE_CACHE_SIZE
-						  / crypt_stat->extent_size))
-				  + extent_offset), crypt_stat);
-		rc = ecryptfs_read_lower((enc_extent_virt +
-				extent_offset * crypt_stat->extent_size),
-				offset, crypt_stat->extent_size,
-				ecryptfs_inode);
-		if (rc < 0) {
-			ecryptfs_printk(KERN_ERR, "Error attempting "
-					"to read lower page; rc = [%d]"
-					"\n", rc);
-			goto out;
-		}
 		rc = ecryptfs_decrypt_extent(page, crypt_stat, enc_extent_page,
 					     extent_offset);
 		if (rc) {
@@ -642,7 +639,6 @@ int ecryptfs_decrypt_page(struct page *page)
 	}
 out:
 	if (enc_extent_page) {
-		kunmap(enc_extent_page);
 		__free_page(enc_extent_page);
 	}
 	return rc;
-- 
1.8.1.2

[PATCH 3/5] eCryptfs: Simplify lower file offset calculation

[Tyler Hicks]

Now that lower filesystem IO operations occur for complete
PAGE_CACHE_SIZE bytes, the calculation for converting an eCryptfs extent
index into a lower file offset can be simplified.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 fs/ecryptfs/crypto.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 4185584..3547708 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -407,15 +407,15 @@ out:
 }
 
 /**
- * ecryptfs_lower_offset_for_extent
+ * lower_offset_for_page
  *
  * Convert an eCryptfs page index into a lower byte offset
  */
-static void ecryptfs_lower_offset_for_extent(loff_t *offset, loff_t extent_num,
-					     struct ecryptfs_crypt_stat *crypt_stat)
+static loff_t lower_offset_for_page(struct ecryptfs_crypt_stat *crypt_stat,
+				    struct page *page)
 {
-	(*offset) = ecryptfs_lower_header_size(crypt_stat)
-		    + (crypt_stat->extent_size * extent_num);
+	return ecryptfs_lower_header_size(crypt_stat) +
+	       (page->index << PAGE_CACHE_SHIFT);
 }
 
 /**
@@ -517,9 +517,7 @@ int ecryptfs_encrypt_page(struct page *page)
 		}
 	}
 
-	ecryptfs_lower_offset_for_extent(&lower_offset,
-		page->index * (PAGE_CACHE_SIZE / crypt_stat->extent_size),
-		crypt_stat);
+	lower_offset = lower_offset_for_page(crypt_stat, page);
 	enc_extent_virt = kmap(enc_extent_page);
 	rc = ecryptfs_write_lower(ecryptfs_inode, enc_extent_virt, lower_offset,
 				  PAGE_CACHE_SIZE);
@@ -612,9 +610,7 @@ int ecryptfs_decrypt_page(struct page *page)
 		goto out;
 	}
 
-	ecryptfs_lower_offset_for_extent(&lower_offset,
-		page->index * (PAGE_CACHE_SIZE / crypt_stat->extent_size),
-		crypt_stat);
+	lower_offset = lower_offset_for_page(crypt_stat, page);
 	enc_extent_virt = kmap(enc_extent_page);
 	rc = ecryptfs_read_lower(enc_extent_virt, lower_offset, PAGE_CACHE_SIZE,
 				 ecryptfs_inode);
-- 
1.8.1.2

[PATCH 4/5] eCryptfs: Accept one offset parameter in page offset crypto functions

[Tyler Hicks]

There is no longer a need to accept different offset values for the
source and destination pages when encrypting/decrypting an extent in an
eCryptfs page. The two offsets can be collapsed into a single parameter.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 fs/ecryptfs/crypto.c | 42 ++++++++++++++++--------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 3547708..ec640eb 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -39,14 +39,12 @@
 
 static int
 ecryptfs_decrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
-			     struct page *dst_page, int dst_offset,
-			     struct page *src_page, int src_offset, int size,
-			     unsigned char *iv);
+			     struct page *dst_page, struct page *src_page,
+			     int offset, int size, unsigned char *iv);
 static int
 ecryptfs_encrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
-			     struct page *dst_page, int dst_offset,
-			     struct page *src_page, int src_offset, int size,
-			     unsigned char *iv);
+			     struct page *dst_page, struct page *src_page,
+			     int offset, int size, unsigned char *iv);
 
 /**
  * ecryptfs_to_hex
@@ -450,9 +448,7 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
 			(unsigned long long)(extent_base + extent_offset), rc);
 		goto out;
 	}
-	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page,
-					extent_offset * crypt_stat->extent_size,
-					page,
+	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, page,
 					extent_offset * crypt_stat->extent_size,
 					crypt_stat->extent_size, extent_iv);
 	if (rc < 0) {
@@ -555,9 +551,7 @@ static int ecryptfs_decrypt_extent(struct page *page,
 			(unsigned long long)(extent_base + extent_offset), rc);
 		goto out;
 	}
-	rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
-					extent_offset * crypt_stat->extent_size,
-					enc_extent_page,
+	rc = ecryptfs_decrypt_page_offset(crypt_stat, page, enc_extent_page,
 					extent_offset * crypt_stat->extent_size,
 					crypt_stat->extent_size, extent_iv);
 	if (rc < 0) {
@@ -716,9 +710,8 @@ out:
  * ecryptfs_encrypt_page_offset
  * @crypt_stat: The cryptographic context
  * @dst_page: The page to encrypt into
- * @dst_offset: The offset in the page to encrypt into
  * @src_page: The page to encrypt from
- * @src_offset: The offset in the page to encrypt from
+ * @offset: The byte offset into the dst_page and src_page
  * @size: The number of bytes to encrypt
  * @iv: The initialization vector to use for the encryption
  *
@@ -726,17 +719,16 @@ out:
  */
 static int
 ecryptfs_encrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
-			     struct page *dst_page, int dst_offset,
-			     struct page *src_page, int src_offset, int size,
-			     unsigned char *iv)
+			     struct page *dst_page, struct page *src_page,
+			     int offset, int size, unsigned char *iv)
 {
 	struct scatterlist src_sg, dst_sg;
 
 	sg_init_table(&src_sg, 1);
 	sg_init_table(&dst_sg, 1);
 
-	sg_set_page(&src_sg, src_page, size, src_offset);
-	sg_set_page(&dst_sg, dst_page, size, dst_offset);
+	sg_set_page(&src_sg, src_page, size, offset);
+	sg_set_page(&dst_sg, dst_page, size, offset);
 	return encrypt_scatterlist(crypt_stat, &dst_sg, &src_sg, size, iv);
 }
 
@@ -744,9 +736,8 @@ ecryptfs_encrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
  * ecryptfs_decrypt_page_offset
  * @crypt_stat: The cryptographic context
  * @dst_page: The page to decrypt into
- * @dst_offset: The offset in the page to decrypt into
  * @src_page: The page to decrypt from
- * @src_offset: The offset in the page to decrypt from
+ * @offset: The byte offset into the dst_page and src_page
  * @size: The number of bytes to decrypt
  * @iv: The initialization vector to use for the decryption
  *
@@ -754,17 +745,16 @@ ecryptfs_encrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
  */
 static int
 ecryptfs_decrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
-			     struct page *dst_page, int dst_offset,
-			     struct page *src_page, int src_offset, int size,
-			     unsigned char *iv)
+			     struct page *dst_page, struct page *src_page,
+			     int offset, int size, unsigned char *iv)
 {
 	struct scatterlist src_sg, dst_sg;
 
 	sg_init_table(&src_sg, 1);
-	sg_set_page(&src_sg, src_page, size, src_offset);
+	sg_set_page(&src_sg, src_page, size, offset);
 
 	sg_init_table(&dst_sg, 1);
-	sg_set_page(&dst_sg, dst_page, size, dst_offset);
+	sg_set_page(&dst_sg, dst_page, size, offset);
 
 	return decrypt_scatterlist(crypt_stat, &dst_sg, &src_sg, size, iv);
 }
-- 
1.8.1.2

[PATCH 5/5] eCryptfs: Decrypt pages in-place

[Tyler Hicks]

When reading in a page, eCryptfs would allocate a helper page, fill it
with encrypted data from the lower filesytem, and then decrypt the data
from the encrypted page and store the result in the eCryptfs page cache
page.

The crypto API supports in-place crypto operations which means that the
allocation of the helper page is unnecessary when decrypting. This patch
gets rid of the unneeded page allocation by reading encrypted data from
the lower filesystem directly into the page cache page. The page cache
page is then decrypted in-place.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 fs/ecryptfs/crypto.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index ec640eb..35b409b 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -586,8 +586,7 @@ int ecryptfs_decrypt_page(struct page *page)
 {
 	struct inode *ecryptfs_inode;
 	struct ecryptfs_crypt_stat *crypt_stat;
-	char *enc_extent_virt;
-	struct page *enc_extent_page = NULL;
+	char *page_virt;
 	unsigned long extent_offset;
 	loff_t lower_offset;
 	int rc = 0;
@@ -596,19 +595,12 @@ int ecryptfs_decrypt_page(struct page *page)
 	crypt_stat =
 		&(ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat);
 	BUG_ON(!(crypt_stat->flags & ECRYPTFS_ENCRYPTED));
-	enc_extent_page = alloc_page(GFP_USER);
-	if (!enc_extent_page) {
-		rc = -ENOMEM;
-		ecryptfs_printk(KERN_ERR, "Error allocating memory for "
-				"encrypted extent\n");
-		goto out;
-	}
 
 	lower_offset = lower_offset_for_page(crypt_stat, page);
-	enc_extent_virt = kmap(enc_extent_page);
-	rc = ecryptfs_read_lower(enc_extent_virt, lower_offset, PAGE_CACHE_SIZE,
+	page_virt = kmap(page);
+	rc = ecryptfs_read_lower(page_virt, lower_offset, PAGE_CACHE_SIZE,
 				 ecryptfs_inode);
-	kunmap(enc_extent_page);
+	kunmap(page);
 	if (rc < 0) {
 		ecryptfs_printk(KERN_ERR,
 			"Error attempting to read lower page; rc = [%d]\n",
@@ -619,7 +611,7 @@ int ecryptfs_decrypt_page(struct page *page)
 	for (extent_offset = 0;
 	     extent_offset < (PAGE_CACHE_SIZE / crypt_stat->extent_size);
 	     extent_offset++) {
-		rc = ecryptfs_decrypt_extent(page, crypt_stat, enc_extent_page,
+		rc = ecryptfs_decrypt_extent(page, crypt_stat, page,
 					     extent_offset);
 		if (rc) {
 			printk(KERN_ERR "%s: Error encrypting extent; "
@@ -628,9 +620,6 @@ int ecryptfs_decrypt_page(struct page *page)
 		}
 	}
 out:
-	if (enc_extent_page) {
-		__free_page(enc_extent_page);
-	}
 	return rc;
 }
 
-- 
1.8.1.2