2 * QEMU block full disk encryption
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
23 #include "block/block_int.h"
24 #include "block/qdict.h"
25 #include "sysemu/block-backend.h"
26 #include "crypto/block.h"
27 #include "qapi/opts-visitor.h"
28 #include "qapi/qapi-visit-crypto.h"
29 #include "qapi/qobject-input-visitor.h"
30 #include "qapi/error.h"
31 #include "qemu/module.h"
32 #include "qemu/option.h"
33 #include "qemu/cutils.h"
34 #include "qemu/memalign.h"
37 typedef struct BlockCrypto BlockCrypto;
45 static int block_crypto_probe_generic(QCryptoBlockFormat format,
50 if (qcrypto_block_has_format(format, buf, buf_size)) {
58 static int block_crypto_read_func(QCryptoBlock *block,
65 BlockDriverState *bs = opaque;
68 ret = bdrv_pread(bs->file, offset, buflen, buf, 0);
70 error_setg_errno(errp, -ret, "Could not read encryption header");
76 static int block_crypto_write_func(QCryptoBlock *block,
83 BlockDriverState *bs = opaque;
86 ret = bdrv_pwrite(bs->file, offset, buflen, buf, 0);
88 error_setg_errno(errp, -ret, "Could not write encryption header");
95 struct BlockCryptoCreateData {
98 PreallocMode prealloc;
102 static int coroutine_fn GRAPH_UNLOCKED
103 block_crypto_create_write_func(QCryptoBlock *block, size_t offset,
104 const uint8_t *buf, size_t buflen, void *opaque,
107 struct BlockCryptoCreateData *data = opaque;
110 ret = blk_pwrite(data->blk, offset, buflen, buf, 0);
112 error_setg_errno(errp, -ret, "Could not write encryption header");
118 static int coroutine_fn GRAPH_UNLOCKED
119 block_crypto_create_init_func(QCryptoBlock *block, size_t headerlen,
120 void *opaque, Error **errp)
122 struct BlockCryptoCreateData *data = opaque;
123 Error *local_error = NULL;
126 if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) {
131 /* User provided size should reflect amount of space made
132 * available to the guest, so we must take account of that
133 * which will be used by the crypto header
135 ret = blk_truncate(data->blk, data->size + headerlen, false,
136 data->prealloc, 0, &local_error);
144 /* Replace the error message with a better one */
145 error_free(local_error);
146 error_setg(errp, "The requested file size is too large");
148 error_propagate(errp, local_error);
155 static QemuOptsList block_crypto_runtime_opts_luks = {
157 .head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head),
159 BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
160 { /* end of list */ }
165 static QemuOptsList block_crypto_create_opts_luks = {
167 .head = QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks.head),
170 .name = BLOCK_OPT_SIZE,
171 .type = QEMU_OPT_SIZE,
172 .help = "Virtual disk size"
174 BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
175 BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(""),
176 BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(""),
177 BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(""),
178 BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(""),
179 BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(""),
180 BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""),
181 { /* end of list */ }
186 static QemuOptsList block_crypto_amend_opts_luks = {
188 .head = QTAILQ_HEAD_INITIALIZER(block_crypto_create_opts_luks.head),
190 BLOCK_CRYPTO_OPT_DEF_LUKS_STATE(""),
191 BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT(""),
192 BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET(""),
193 BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET(""),
194 BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""),
195 { /* end of list */ }
199 QCryptoBlockOpenOptions *
200 block_crypto_open_opts_init(QDict *opts, Error **errp)
203 QCryptoBlockOpenOptions *ret;
205 v = qobject_input_visitor_new_flat_confused(opts, errp);
210 visit_type_QCryptoBlockOpenOptions(v, NULL, &ret, errp);
217 QCryptoBlockCreateOptions *
218 block_crypto_create_opts_init(QDict *opts, Error **errp)
221 QCryptoBlockCreateOptions *ret;
223 v = qobject_input_visitor_new_flat_confused(opts, errp);
228 visit_type_QCryptoBlockCreateOptions(v, NULL, &ret, errp);
234 QCryptoBlockAmendOptions *
235 block_crypto_amend_opts_init(QDict *opts, Error **errp)
238 QCryptoBlockAmendOptions *ret;
240 v = qobject_input_visitor_new_flat_confused(opts, errp);
245 visit_type_QCryptoBlockAmendOptions(v, NULL, &ret, errp);
252 static int block_crypto_open_generic(QCryptoBlockFormat format,
253 QemuOptsList *opts_spec,
254 BlockDriverState *bs,
259 BlockCrypto *crypto = bs->opaque;
260 QemuOpts *opts = NULL;
262 QCryptoBlockOpenOptions *open_opts = NULL;
263 unsigned int cflags = 0;
264 QDict *cryptoopts = NULL;
266 ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
271 bs->supported_write_flags = BDRV_REQ_FUA &
272 bs->file->bs->supported_write_flags;
274 opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort);
275 if (!qemu_opts_absorb_qdict(opts, options, errp)) {
280 cryptoopts = qemu_opts_to_qdict(opts, NULL);
281 qdict_put_str(cryptoopts, "format", QCryptoBlockFormat_str(format));
283 open_opts = block_crypto_open_opts_init(cryptoopts, errp);
289 if (flags & BDRV_O_NO_IO) {
290 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
292 crypto->block = qcrypto_block_open(open_opts, NULL,
293 block_crypto_read_func,
299 if (!crypto->block) {
304 bs->encrypted = true;
308 qobject_unref(cryptoopts);
309 qapi_free_QCryptoBlockOpenOptions(open_opts);
314 static int coroutine_fn GRAPH_UNLOCKED
315 block_crypto_co_create_generic(BlockDriverState *bs, int64_t size,
316 QCryptoBlockCreateOptions *opts,
317 PreallocMode prealloc, Error **errp)
321 QCryptoBlock *crypto = NULL;
322 struct BlockCryptoCreateData data;
324 blk = blk_co_new_with_bs(bs, BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL,
331 if (prealloc == PREALLOC_MODE_METADATA) {
332 prealloc = PREALLOC_MODE_OFF;
335 data = (struct BlockCryptoCreateData) {
338 .prealloc = prealloc,
341 crypto = qcrypto_block_create(opts, NULL,
342 block_crypto_create_init_func,
343 block_crypto_create_write_func,
354 qcrypto_block_free(crypto);
359 static int coroutine_fn GRAPH_RDLOCK
360 block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
361 PreallocMode prealloc, BdrvRequestFlags flags,
364 BlockCrypto *crypto = bs->opaque;
365 uint64_t payload_offset =
366 qcrypto_block_get_payload_offset(crypto->block);
368 if (payload_offset > INT64_MAX - offset) {
369 error_setg(errp, "The requested file size is too large");
373 offset += payload_offset;
375 return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
378 static void block_crypto_close(BlockDriverState *bs)
380 BlockCrypto *crypto = bs->opaque;
381 qcrypto_block_free(crypto->block);
384 static int block_crypto_reopen_prepare(BDRVReopenState *state,
385 BlockReopenQueue *queue, Error **errp)
387 /* nothing needs checking */
392 * 1 MB bounce buffer gives good performance / memory tradeoff
393 * when using cache=none|directsync.
395 #define BLOCK_CRYPTO_MAX_IO_SIZE (1024 * 1024)
397 static int coroutine_fn GRAPH_RDLOCK
398 block_crypto_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
399 QEMUIOVector *qiov, BdrvRequestFlags flags)
401 BlockCrypto *crypto = bs->opaque;
402 uint64_t cur_bytes; /* number of bytes in current iteration */
403 uint64_t bytes_done = 0;
404 uint8_t *cipher_data = NULL;
405 QEMUIOVector hd_qiov;
407 uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
408 uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
410 assert(payload_offset < INT64_MAX);
411 assert(QEMU_IS_ALIGNED(offset, sector_size));
412 assert(QEMU_IS_ALIGNED(bytes, sector_size));
414 qemu_iovec_init(&hd_qiov, qiov->niov);
416 /* Bounce buffer because we don't wish to expose cipher text
417 * in qiov which points to guest memory.
420 qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE,
422 if (cipher_data == NULL) {
428 cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE);
430 qemu_iovec_reset(&hd_qiov);
431 qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes);
433 ret = bdrv_co_preadv(bs->file, payload_offset + offset + bytes_done,
434 cur_bytes, &hd_qiov, 0);
439 if (qcrypto_block_decrypt(crypto->block, offset + bytes_done,
440 cipher_data, cur_bytes, NULL) < 0) {
445 qemu_iovec_from_buf(qiov, bytes_done, cipher_data, cur_bytes);
448 bytes_done += cur_bytes;
452 qemu_iovec_destroy(&hd_qiov);
453 qemu_vfree(cipher_data);
459 static int coroutine_fn GRAPH_RDLOCK
460 block_crypto_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
461 QEMUIOVector *qiov, BdrvRequestFlags flags)
463 BlockCrypto *crypto = bs->opaque;
464 uint64_t cur_bytes; /* number of bytes in current iteration */
465 uint64_t bytes_done = 0;
466 uint8_t *cipher_data = NULL;
467 QEMUIOVector hd_qiov;
469 uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
470 uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
472 flags &= ~BDRV_REQ_REGISTERED_BUF;
474 assert(payload_offset < INT64_MAX);
475 assert(QEMU_IS_ALIGNED(offset, sector_size));
476 assert(QEMU_IS_ALIGNED(bytes, sector_size));
478 qemu_iovec_init(&hd_qiov, qiov->niov);
480 /* Bounce buffer because we're not permitted to touch
481 * contents of qiov - it points to guest memory.
484 qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE,
486 if (cipher_data == NULL) {
492 cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE);
494 qemu_iovec_to_buf(qiov, bytes_done, cipher_data, cur_bytes);
496 if (qcrypto_block_encrypt(crypto->block, offset + bytes_done,
497 cipher_data, cur_bytes, NULL) < 0) {
502 qemu_iovec_reset(&hd_qiov);
503 qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes);
505 ret = bdrv_co_pwritev(bs->file, payload_offset + offset + bytes_done,
506 cur_bytes, &hd_qiov, flags);
512 bytes_done += cur_bytes;
516 qemu_iovec_destroy(&hd_qiov);
517 qemu_vfree(cipher_data);
522 static void block_crypto_refresh_limits(BlockDriverState *bs, Error **errp)
524 BlockCrypto *crypto = bs->opaque;
525 uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
526 bs->bl.request_alignment = sector_size; /* No sub-sector I/O */
530 static int64_t coroutine_fn GRAPH_RDLOCK
531 block_crypto_co_getlength(BlockDriverState *bs)
533 BlockCrypto *crypto = bs->opaque;
534 int64_t len = bdrv_co_getlength(bs->file->bs);
536 uint64_t offset = qcrypto_block_get_payload_offset(crypto->block);
537 assert(offset < INT64_MAX);
549 static BlockMeasureInfo *block_crypto_measure(QemuOpts *opts,
550 BlockDriverState *in_bs,
553 g_autoptr(QCryptoBlockCreateOptions) create_opts = NULL;
554 Error *local_err = NULL;
555 BlockMeasureInfo *info;
557 size_t luks_payload_size;
561 * Preallocation mode doesn't affect size requirements but we must consume
564 g_free(qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC));
566 size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
569 int64_t ssize = bdrv_getlength(in_bs);
572 error_setg_errno(&local_err, -ssize,
573 "Unable to get image virtual_size");
580 cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL,
581 &block_crypto_create_opts_luks, true);
582 qdict_put_str(cryptoopts, "format", "luks");
583 create_opts = block_crypto_create_opts_init(cryptoopts, &local_err);
584 qobject_unref(cryptoopts);
589 if (!qcrypto_block_calculate_payload_offset(create_opts, NULL,
596 * Unallocated blocks are still encrypted so allocation status makes no
597 * difference to the file size.
599 info = g_new0(BlockMeasureInfo, 1);
600 info->fully_allocated = luks_payload_size + size;
601 info->required = luks_payload_size + size;
605 error_propagate(errp, local_err);
610 static int block_crypto_probe_luks(const uint8_t *buf,
612 const char *filename) {
613 return block_crypto_probe_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS,
614 buf, buf_size, filename);
617 static int block_crypto_open_luks(BlockDriverState *bs,
622 return block_crypto_open_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS,
623 &block_crypto_runtime_opts_luks,
624 bs, options, flags, errp);
627 static int coroutine_fn GRAPH_UNLOCKED
628 block_crypto_co_create_luks(BlockdevCreateOptions *create_options, Error **errp)
630 BlockdevCreateOptionsLUKS *luks_opts;
631 BlockDriverState *bs = NULL;
632 QCryptoBlockCreateOptions create_opts;
633 PreallocMode preallocation = PREALLOC_MODE_OFF;
636 assert(create_options->driver == BLOCKDEV_DRIVER_LUKS);
637 luks_opts = &create_options->u.luks;
639 bs = bdrv_co_open_blockdev_ref(luks_opts->file, errp);
644 create_opts = (QCryptoBlockCreateOptions) {
645 .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
646 .u.luks = *qapi_BlockdevCreateOptionsLUKS_base(luks_opts),
649 if (luks_opts->has_preallocation) {
650 preallocation = luks_opts->preallocation;
653 ret = block_crypto_co_create_generic(bs, luks_opts->size, &create_opts,
654 preallocation, errp);
665 static int coroutine_fn GRAPH_UNLOCKED
666 block_crypto_co_create_opts_luks(BlockDriver *drv, const char *filename,
667 QemuOpts *opts, Error **errp)
669 QCryptoBlockCreateOptions *create_opts = NULL;
670 BlockDriverState *bs = NULL;
672 PreallocMode prealloc;
676 Error *local_err = NULL;
679 size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
681 buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
682 prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
683 PREALLOC_MODE_OFF, &local_err);
686 error_propagate(errp, local_err);
690 cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL,
691 &block_crypto_create_opts_luks,
694 qdict_put_str(cryptoopts, "format", "luks");
695 create_opts = block_crypto_create_opts_init(cryptoopts, errp);
701 /* Create protocol layer */
702 ret = bdrv_co_create_file(filename, opts, errp);
707 bs = bdrv_co_open(filename, NULL, NULL,
708 BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
714 /* Create format layer */
715 ret = block_crypto_co_create_generic(bs, size, create_opts, prealloc, errp);
723 * If an error occurred, delete 'filename'. Even if the file existed
724 * beforehand, it has been truncated and corrupted in the process.
727 bdrv_graph_co_rdlock();
728 bdrv_co_delete_file_noerr(bs);
729 bdrv_graph_co_rdunlock();
733 qapi_free_QCryptoBlockCreateOptions(create_opts);
734 qobject_unref(cryptoopts);
738 static int coroutine_fn GRAPH_RDLOCK
739 block_crypto_co_get_info_luks(BlockDriverState *bs, BlockDriverInfo *bdi)
741 BlockDriverInfo subbdi;
744 ret = bdrv_co_get_info(bs->file->bs, &subbdi);
749 bdi->cluster_size = subbdi.cluster_size;
754 static ImageInfoSpecific *
755 block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp)
757 BlockCrypto *crypto = bs->opaque;
758 ImageInfoSpecific *spec_info;
759 QCryptoBlockInfo *info;
761 info = qcrypto_block_get_info(crypto->block, errp);
765 assert(info->format == Q_CRYPTO_BLOCK_FORMAT_LUKS);
767 spec_info = g_new(ImageInfoSpecific, 1);
768 spec_info->type = IMAGE_INFO_SPECIFIC_KIND_LUKS;
769 spec_info->u.luks.data = g_new(QCryptoBlockInfoLUKS, 1);
770 *spec_info->u.luks.data = info->u.luks;
772 /* Blank out pointers we've just stolen to avoid double free */
773 memset(&info->u.luks, 0, sizeof(info->u.luks));
775 qapi_free_QCryptoBlockInfo(info);
780 static int GRAPH_RDLOCK
781 block_crypto_amend_prepare(BlockDriverState *bs, Error **errp)
783 BlockCrypto *crypto = bs->opaque;
786 /* apply for exclusive read/write permissions to the underlying file */
787 crypto->updating_keys = true;
788 ret = bdrv_child_refresh_perms(bs, bs->file, errp);
790 /* Well, in this case we will not be updating any keys */
791 crypto->updating_keys = false;
796 static void GRAPH_RDLOCK
797 block_crypto_amend_cleanup(BlockDriverState *bs)
799 BlockCrypto *crypto = bs->opaque;
802 /* release exclusive read/write permissions to the underlying file */
803 crypto->updating_keys = false;
804 bdrv_child_refresh_perms(bs, bs->file, &errp);
807 error_report_err(errp);
812 block_crypto_amend_options_generic_luks(BlockDriverState *bs,
813 QCryptoBlockAmendOptions *amend_options,
817 BlockCrypto *crypto = bs->opaque;
820 assert(crypto->block);
822 return qcrypto_block_amend_options(crypto->block,
823 block_crypto_read_func,
824 block_crypto_write_func,
831 static int GRAPH_RDLOCK
832 block_crypto_amend_options_luks(BlockDriverState *bs,
834 BlockDriverAmendStatusCB *status_cb,
839 BlockCrypto *crypto = bs->opaque;
840 QDict *cryptoopts = NULL;
841 QCryptoBlockAmendOptions *amend_options = NULL;
845 assert(crypto->block);
847 cryptoopts = qemu_opts_to_qdict(opts, NULL);
848 qdict_put_str(cryptoopts, "format", "luks");
849 amend_options = block_crypto_amend_opts_init(cryptoopts, errp);
850 qobject_unref(cryptoopts);
851 if (!amend_options) {
855 ret = block_crypto_amend_prepare(bs, errp);
859 ret = block_crypto_amend_options_generic_luks(bs, amend_options,
863 block_crypto_amend_cleanup(bs);
865 qapi_free_QCryptoBlockAmendOptions(amend_options);
870 coroutine_fn block_crypto_co_amend_luks(BlockDriverState *bs,
871 BlockdevAmendOptions *opts,
875 QCryptoBlockAmendOptions amend_opts;
877 amend_opts = (QCryptoBlockAmendOptions) {
878 .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
879 .u.luks = *qapi_BlockdevAmendOptionsLUKS_base(&opts->u.luks),
881 return block_crypto_amend_options_generic_luks(bs, &amend_opts,
886 block_crypto_child_perms(BlockDriverState *bs, BdrvChild *c,
887 const BdrvChildRole role,
888 BlockReopenQueue *reopen_queue,
889 uint64_t perm, uint64_t shared,
890 uint64_t *nperm, uint64_t *nshared)
893 BlockCrypto *crypto = bs->opaque;
895 bdrv_default_perms(bs, c, role, reopen_queue, perm, shared, nperm, nshared);
898 * For backward compatibility, manually share the write
899 * and resize permission
901 *nshared |= shared & (BLK_PERM_WRITE | BLK_PERM_RESIZE);
903 * Since we are not fully a format driver, don't always request
904 * the read/resize permission but only when explicitly
907 *nperm &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
908 *nperm |= perm & (BLK_PERM_WRITE | BLK_PERM_RESIZE);
911 * This driver doesn't modify LUKS metadata except
912 * when updating the encryption slots.
913 * Thus unlike a proper format driver we don't ask for
914 * shared write/read permission. However we need it
915 * when we are updating the keys, to ensure that only we
916 * have access to the device.
918 * Encryption update will set the crypto->updating_keys
919 * during that period and refresh permissions
922 if (crypto->updating_keys) {
923 /* need exclusive write access for header update */
924 *nperm |= BLK_PERM_WRITE;
925 /* unshare read and write permission */
926 *nshared &= ~(BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE);
931 static const char *const block_crypto_strong_runtime_opts[] = {
932 BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
937 static BlockDriver bdrv_crypto_luks = {
938 .format_name = "luks",
939 .instance_size = sizeof(BlockCrypto),
940 .bdrv_probe = block_crypto_probe_luks,
941 .bdrv_open = block_crypto_open_luks,
942 .bdrv_close = block_crypto_close,
943 .bdrv_child_perm = block_crypto_child_perms,
944 .bdrv_co_create = block_crypto_co_create_luks,
945 .bdrv_co_create_opts = block_crypto_co_create_opts_luks,
946 .bdrv_co_truncate = block_crypto_co_truncate,
947 .create_opts = &block_crypto_create_opts_luks,
948 .amend_opts = &block_crypto_amend_opts_luks,
950 .bdrv_reopen_prepare = block_crypto_reopen_prepare,
951 .bdrv_refresh_limits = block_crypto_refresh_limits,
952 .bdrv_co_preadv = block_crypto_co_preadv,
953 .bdrv_co_pwritev = block_crypto_co_pwritev,
954 .bdrv_co_getlength = block_crypto_co_getlength,
955 .bdrv_measure = block_crypto_measure,
956 .bdrv_co_get_info = block_crypto_co_get_info_luks,
957 .bdrv_get_specific_info = block_crypto_get_specific_info_luks,
958 .bdrv_amend_options = block_crypto_amend_options_luks,
959 .bdrv_co_amend = block_crypto_co_amend_luks,
960 .bdrv_amend_pre_run = block_crypto_amend_prepare,
961 .bdrv_amend_clean = block_crypto_amend_cleanup,
965 .strong_runtime_opts = block_crypto_strong_runtime_opts,
968 static void block_crypto_init(void)
970 bdrv_register(&bdrv_crypto_luks);
973 block_init(block_crypto_init);