kernel-2.4.35.diff

Fast and transparent file system and swap encryption package for linux. No source code changes to li

Before this patch can be applied to kernel, drivers/block/loop.c and
include/linux/loop.h source files must be removed:

    rm -f drivers/block/loop.c include/linux/loop.h

diff -urN linux-2.4.35-noloop/Documentation/Configure.help linux-2.4.35-AES/Documentation/Configure.help
--- linux-2.4.35-noloop/Documentation/Configure.help	2007-07-27 18:17:26.000000000 +0300
+++ linux-2.4.35-AES/Documentation/Configure.help	2007-07-27 18:33:04.000000000 +0300
@@ -622,6 +622,27 @@
 
   If unsure, say N.
 
+AES encrypted loop device support
+CONFIG_BLK_DEV_LOOP_AES
+  If you want to use AES encryption algorithm to encrypt loop devices,
+  say Y here. If you don't know what to do here, say N.
+
+loop encryption key scrubbing support
+CONFIG_BLK_DEV_LOOP_KEYSCRUB
+  Loop encryption key scrubbing moves and inverts key bits in
+  kernel RAM so that the thin oxide which forms the storage
+  capacitor dielectric of DRAM cells is not permitted to develop
+  detectable property. For more info, see Peter Gutmann's paper:
+  http://www.cypherpunks.to/~peter/usenix01.pdf
+
+  Paranoid tinfoil hat crowd say Y here, everyone else say N.
+
+VIA padlock hardware AES support
+CONFIG_BLK_DEV_LOOP_PADLOCK
+  If you have VIA processor that supports padlock xcrypt instructions,
+  say Y here. If enabled, presence of VIA padlock instructions is detected
+  at run time, but code still works on non-padlock processors too.
+
 ATA/IDE/MFM/RLL support
 CONFIG_IDE
   If you say Y here, your kernel will be able to manage low cost mass
diff -urN linux-2.4.35-noloop/drivers/block/Config.in linux-2.4.35-AES/drivers/block/Config.in
--- linux-2.4.35-noloop/drivers/block/Config.in	2004-08-08 14:15:13.000000000 +0300
+++ linux-2.4.35-AES/drivers/block/Config.in	2007-07-27 18:33:04.000000000 +0300
@@ -42,6 +42,15 @@
 dep_tristate 'Promise SATA SX8 support' CONFIG_BLK_DEV_SX8 $CONFIG_PCI
 
 tristate 'Loopback device support' CONFIG_BLK_DEV_LOOP
+if [ "$CONFIG_BLK_DEV_LOOP" != "n" ]; then
+   bool '  AES encrypted loop device support' CONFIG_BLK_DEV_LOOP_AES
+   bool '  loop encryption key scrubbing support' CONFIG_BLK_DEV_LOOP_KEYSCRUB
+   if [ "$CONFIG_BLK_DEV_LOOP_AES" = "y" ]; then
+      if [ "$CONFIG_X86" = "y" -o "$CONFIG_X86_64" = "y" ]; then
+         bool '  VIA padlock hardware AES support' CONFIG_BLK_DEV_LOOP_PADLOCK
+      fi
+   fi
+fi
 dep_tristate 'Network block device support' CONFIG_BLK_DEV_NBD $CONFIG_NET
 
 tristate 'RAM disk support' CONFIG_BLK_DEV_RAM
diff -urN linux-2.4.35-noloop/drivers/block/loop.c linux-2.4.35-AES/drivers/block/loop.c
--- linux-2.4.35-noloop/drivers/block/loop.c	1970-01-01 02:00:00.000000000 +0200
+++ linux-2.4.35-AES/drivers/block/loop.c	2007-07-27 18:33:04.000000000 +0300
@@ -0,0 +1,2271 @@
+/*
+ *  linux/drivers/block/loop.c
+ *
+ *  Written by Theodore Ts'o, 3/29/93
+ *
+ * Copyright 1993 by Theodore Ts'o.  Redistribution of this file is
+ * permitted under the GNU General Public License.
+ *
+ * DES encryption plus some minor changes by Werner Almesberger, 30-MAY-1993
+ * more DES encryption plus IDEA encryption by Nicholas J. Leon, June 20, 1996
+ *
+ * Modularized and updated for 1.1.16 kernel - Mitch Dsouza 28th May 1994
+ * Adapted for 1.3.59 kernel - Andries Brouwer, 1 Feb 1996
+ *
+ * Fixed do_loop_request() re-entrancy - [e-mail] Mar 20, 1997
+ *
+ * Added devfs support - Richard Gooch <[e-mail]> 16-Jan-1998
+ *
+ * Handle sparse backing files correctly - Kenn Humborg, Jun 28, 1998
+ *
+ * Loadable modules and other fixes by AK, 1998
+ *
+ * Make real block number available to downstream transfer functions, enables
+ * CBC (and relatives) mode encryption requiring unique IVs per data block.
+ * Reed H. Petty, [e-mail]
+ *
+ * Maximum number of loop devices now dynamic via max_loop module parameter.
+ * Russell Kroll <[e-mail]> 19990701
+ *
+ * Maximum number of loop devices when compiled-in now selectable by passing
+ * max_loop=<1-255> to the kernel on boot.
+ * Erik I. Bols