opal: do not initialize LRs array in activation.

The lr member in opal_lr_act kernel structure is
ingnored unless the device is being activated in SUM
mode.

See kernel implementation of IOC_OPAL_ACTIVATE_LSP
in block/sed-opal.c

.codeql-config.yml

@@ -0,0 +1,31 @@
+name: "Cryptsetup CodeQL config"
+
+query-filters:
+- exclude:
+     id: cpp/fixme-comment
+- exclude:
+     id: cpp/empty-block
+- exclude:
+     id: cpp/poorly-documented-function
+- exclude:
+     id: cpp/loop-variable-changed
+- exclude:
+     id: cpp/empty-if
+- exclude:
+     id: cpp/long-switch
+- exclude:
+     id: cpp/complex-condition
+- exclude:
+     id: cpp/commented-out-code
+
+# These produce many false positives
+- exclude:
+     id: cpp/uninitialized-local
+- exclude:
+     id: cpp/path-injection
+- exclude:
+     id: cpp/missing-check-scanf
+
+# CodeQL should understand coverity [toctou] comments
+- exclude:
+     id: cpp/toctou-race-condition

.github/workflows/cibuild-setup-ubuntu.sh

@@ -5,9 +5,9 @@ set -ex
 PACKAGES=(
 	git make autoconf automake autopoint pkg-config libtool libtool-bin
 	gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
-	libjson-c-dev libssh-dev libblkid-dev tar libargon2-0-dev libpwquality-dev
-	sharutils dmsetup jq xxd expect keyutils netcat passwd openssh-client sshpass
-	asciidoctor
+	libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
+	sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
+	sshpass asciidoctor meson ninja-build
 )
 
 COMPILER="${COMPILER:?}"

.github/workflows/cibuild.yml

@@ -4,8 +4,7 @@ on:
     branches:
       - 'main'
       - 'wip-luks2'
-      - 'v2.3.x'
-      - 'v2.4.x'
+      - 'v2.*.x'
     paths-ignore:
       - 'docs/**'
 
@@ -17,11 +16,11 @@ jobs:
       fail-fast: false
       matrix:
         env:
-          - { COMPILER: "gcc", COMPILER_VERSION: "11",  RUN_SSH_PLUGIN_TEST: "1" }
+          - { COMPILER: "gcc", COMPILER_VERSION: "14",  RUN_SSH_PLUGIN_TEST: "1" }
     env: ${{ matrix.env }}
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4
       - name: Ubuntu setup
         run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
       - name: Configure & Make

.github/workflows/codeql.yml

@@ -0,0 +1,53 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'wip-luks2'
+      - 'v2.*.x'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    if: github.repository == 'mbroz/cryptsetup'
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
+      cancel-in-progress: true
+    permissions:
+      actions: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-extended,security-and-quality
+          config-file: .codeql-config.yml
+
+      - name: Install dependencies
+        run: |
+          sudo -E .github/workflows/cibuild-setup-ubuntu.sh
+          # Force autoconf for now, meson is broken in analysis step
+          rm meson.build
+
+        env: { COMPILER: "gcc", COMPILER_VERSION: "14",  RUN_SSH_PLUGIN_TEST: "1" }
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/coverity.yml

@@ -12,12 +12,12 @@ jobs:
     if: github.repository == 'mbroz/cryptsetup'
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4
       - name: Ubuntu setup
         run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
         env:
           COMPILER: "gcc"
-          COMPILER_VERSION: "11"
+          COMPILER_VERSION: "14"
       - name: Install Coverity
         run: |
           wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$TOKEN&project=mbroz/cryptsetup" -O cov-analysis-linux64.tar.gz

.gitignore

@@ -17,6 +17,7 @@ ABOUT-NLS
 aclocal.m4
 autom4te.cache/
 compile
+compile_commands.json
 config.guess
 config.h
 config.h.in

.gitlab-ci.yml

@@ -1,23 +1,24 @@
 stages:
   - test
+  - test-opal
 
-.dump_kernel_log:
+.fail_if_coredump_generated:
   after_script:
-    - sudo dmesg > /mnt/artifacts/dmesg.log
-    - sudo journalctl > /mnt/artifacts/journalctl.log
     - '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'
 
 include:
   - local: .gitlab/ci/debian.yml
   - local: .gitlab/ci/fedora.yml
-  - local: .gitlab/ci/rhel.yml
+  - local: .gitlab/ci/fedora-opal.yml
   - local: .gitlab/ci/centos.yml
-  - local: .gitlab/ci/annocheck.yml
+#  - local: .gitlab/ci/annocheck.yml
   - local: .gitlab/ci/csmock.yml
   - local: .gitlab/ci/gitlab-shared-docker.yml
   - local: .gitlab/ci/compilation-various-disables.yml
   - local: .gitlab/ci/compilation-gcc.gitlab-ci.yml
   - local: .gitlab/ci/compilation-clang.gitlab-ci.yml
+  - local: .gitlab/ci/compilation-spellcheck.yml
   - local: .gitlab/ci/alpinelinux.yml
-  - local: .gitlab/ci/ubuntu-32bit.yml
+  - local: .gitlab/ci/debian-i686.yml
   - local: .gitlab/ci/cifuzz.yml
+  - local: .gitlab/ci/ubuntu.yml

.gitlab/ci/alpinelinux.yml

@@ -1,14 +1,16 @@
 .alpinelinux-dependencies:
-  after_script:
-    - sudo dmesg > /mnt/artifacts/dmesg.log
-    - sudo cp /var/log/messages /mnt/artifacts/
-    - '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'
+  variables:
+    DISTRO: cryptsetup-alpine-edge
+  extends:
+    - .fail_if_coredump_generated
   before_script:
     - >
       sudo apk add
-      lvm2-dev openssl1.1-compat-dev popt-dev util-linux-dev json-c-dev
+      lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev
       argon2-dev device-mapper which sharutils gettext gettext-dev automake
       autoconf libtool build-base keyutils tar jq expect git asciidoctor
+    # Be sure we have updated basic tools and system
+    - sudo apk upgrade gcc binutils build-base musl
     - ./autogen.sh
     - ./configure --prefix=/usr --libdir=/lib --sbindir=/sbin --disable-static --enable-libargon2 --with-crypto_backend=openssl --disable-external-tokens --disable-ssh-token --enable-asciidoc
 
@@ -17,7 +19,7 @@ test-main-commit-job-alpinelinux:
     - .alpinelinux-dependencies
   tags:
     - libvirt
-    - alpinelinux
+    - cryptsetup-alpine-edge
   stage: test
   interruptible: true
   variables:
@@ -38,7 +40,7 @@ test-mergerq-job-alpinelinux:
     - .alpinelinux-dependencies
   tags:
     - libvirt
-    - alpinelinux
+    - cryptsetup-alpine-edge
   stage: test
   interruptible: true
   variables:

.gitlab/ci/annocheck.yml

@@ -1,19 +1,18 @@
 test-main-commit-job-annocheck:
   extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
   tags:
     - libvirt
-    - rhel9-annocheck
+    - cryptsetup-rhel-9
   stage: test
   interruptible: true
   allow_failure: true
   variables:
+    DISTRO: cryptsetup-rhel-9
     RUN_SSH_PLUGIN_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
   script:
-    - /opt/build-rpm-script.sh > /dev/null 2>&1
-    - annocheck /var/lib/mock/rhel-9.0.0-candidate-x86_64/result/*.rpm --profile=el9
-    - annocheck /var/lib/mock/rhel-9.0.0-candidate-x86_64/result/*.rpm --profile=el8
+    - sudo /opt/run-annocheck.sh

.gitlab/ci/build_srpm

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -e
+
+SAVED_PWD=$(pwd)
+GIT_DIR="$SAVED_PWD/upstream_git"
+SPEC="$GIT_DIR/misc/fedora/cryptsetup.spec"
+
+rm -fr $GIT_DIR
+
+git clone -q --depth 1 https://gitlab.com/cryptsetup/cryptsetup.git $GIT_DIR
+cd $GIT_DIR
+
+GIT_COMMIT=$(git rev-parse --short=8 HEAD)
+[ -z "$GIT_COMMIT" ] && exit 1
+
+sed -i "s/^AC_INIT.*/AC_INIT([cryptsetup],[$GIT_COMMIT])/" $GIT_DIR/configure.ac
+sed -i "s/^Version:.*/Version: $GIT_COMMIT/" $SPEC
+sed -i "s/%{version_no_tilde}/$GIT_COMMIT/" $SPEC
+sed -i "2i %global source_date_epoch_from_changelog 0" $SPEC
+sed -i "3i %define _unpackaged_files_terminate_build 0" $SPEC
+
+./autogen.sh
+./configure
+make -j dist
+
+rpmbuild --define "_sourcedir $GIT_DIR" --define "_srcrpmdir $SAVED_PWD" -bs $SPEC
+
+cd $SAVED_PWD
+rm -fr $GIT_DIR
+
+exit 0

.gitlab/ci/centos.yml

@@ -1,14 +1,16 @@
 .centos-openssl-backend:
   extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
   before_script:
+    - sudo dnf clean all
     - >
       sudo dnf -y -q  install
       autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
       libblkid-devel libpwquality-devel libselinux-devel libssh-devel libtool
       libuuid-devel make popt-devel libsepol-devel nc openssh-clients passwd
       pkgconfig sharutils sshpass tar uuid-devel vim-common device-mapper
-      expect gettext git jq keyutils openssl-devel openssl gem
+      expect gettext git jq keyutils openssl-devel openssl gem swtpm swtpm-tools
+      tpm2-tools
     - sudo gem install asciidoctor
     - sudo -E git clean -xdf
     - ./autogen.sh
@@ -21,11 +23,13 @@ test-main-commit-centos-stream9:
     - .centos-openssl-backend
   tags:
     - libvirt
-    - centos-stream9
+    - cryptsetup-centos-stream-9
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-centos-stream-9
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null
       when: never
@@ -42,11 +46,59 @@ test-mergerq-centos-stream9:
     - .centos-openssl-backend
   tags:
     - libvirt
-    - centos-stream9
+    - cryptsetup-centos-stream-9
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-centos-stream-9
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
+      when: never
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check
+
+test-main-commit-centos-stream10:
+  extends:
+    - .centos-openssl-backend
+  tags:
+    - libvirt
+    - cryptsetup-centos-stream-10
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-centos-stream-10
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
+      when: never
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  script:
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check
+
+test-mergerq-centos-stream10:
+  extends:
+    - .centos-openssl-backend
+  tags:
+    - libvirt
+    - cryptsetup-centos-stream-10
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-centos-stream-10
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null
       when: never

.gitlab/ci/cibuild-setup-ubuntu.sh

@@ -5,17 +5,20 @@ set -ex
 PACKAGES=(
 	git make autoconf automake autopoint pkg-config libtool libtool-bin
 	gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
-	libjson-c-dev libssh-dev libblkid-dev tar libargon2-0-dev libpwquality-dev
-	sharutils dmsetup jq xxd expect keyutils netcat passwd openssh-client sshpass
-	asciidoctor
+	libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
+	sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
+	sshpass asciidoctor
 )
 
 COMPILER="${COMPILER:?}"
 COMPILER_VERSION="${COMPILER_VERSION:?}"
 
-grep -E '^deb' /etc/apt/sources.list > /etc/apt/sources.list~
-sed -Ei 's/^deb /deb-src /' /etc/apt/sources.list~
-cat /etc/apt/sources.list~ >> /etc/apt/sources.list
+sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
+
+# use this on older Ubuntu
+# grep -E '^deb' /etc/apt/sources.list > /etc/apt/sources.list~
+# sed -Ei 's/^deb /deb-src /' /etc/apt/sources.list~
+# cat /etc/apt/sources.list~ >> /etc/apt/sources.list
 
 apt-get -y update --fix-missing
 DEBIAN_FRONTEND=noninteractive apt-get -yq install software-properties-common wget lsb-release
@@ -28,7 +31,7 @@ if [[ $COMPILER == "gcc" ]]; then
 	PACKAGES+=(gcc-$COMPILER_VERSION)
 elif [[ $COMPILER == "clang" ]]; then
 	wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
-	add-apt-repository "deb http://apt.llvm.org/${RELEASE}/   llvm-toolchain-${RELEASE}-${COMPILER_VERSION} main"
+	add-apt-repository -n "deb http://apt.llvm.org/${RELEASE}/   llvm-toolchain-${RELEASE}-${COMPILER_VERSION} main"
 
 	# scan-build
 	PACKAGES+=(clang-tools-$COMPILER_VERSION clang-$COMPILER_VERSION lldb-$COMPILER_VERSION lld-$COMPILER_VERSION clangd-$COMPILER_VERSION)
@@ -37,14 +40,8 @@ else
 	exit 1
 fi
 
-apt-get -y update --fix-missing
+#apt-get -y update --fix-missing
+(r=3;while ! apt-get -y update --fix-missing ; do ((--r))||exit;sleep 5;echo "Retrying";done)
+
 DEBIAN_FRONTEND=noninteractive apt-get -yq install "${PACKAGES[@]}"
 apt-get -y build-dep cryptsetup
-
-echo "====================== VERSIONS ==================="
-if [[ $COMPILER == "clang" ]]; then
-	echo "Using scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
-fi
-
-${COMPILER}-$COMPILER_VERSION -v
-echo "====================== END VERSIONS ==================="

.gitlab/ci/clang-Wall

@@ -25,10 +25,9 @@ EXTRA="\
  -Wswitch \
  -Wmissing-format-attribute \
  -Winit-self \
- -Wdeclaration-after-statement \
  -Wold-style-definition \
  -Wno-missing-field-initializers \
- -Wno-unused-parameter \
+ -Wunused-parameter \
  -Wno-long-long"
 
 exec $CLANG $PEDANTIC $CONVERSION \

.gitlab/ci/compilation-clang.gitlab-ci.yml

@@ -3,25 +3,86 @@ test-clang-compilation:
     - .gitlab-shared-clang
   script:
     - export CFLAGS="-Wall -Werror"
+    - ./autogen.sh
+    - $CC --version
     - ./configure
     - make -j
     - make -j check-programs
 
-test-clang-Wall-script:
+test-clang-Wall-script-ubuntu:
   extends:
     - .gitlab-shared-clang
   script:
     - export CFLAGS="-g -O0"
     - export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
+    - ./autogen.sh
+    - $CC --version
     - ./configure
     - make -j CFLAGS="-g -O0 -Werror"
     - make -j CFLAGS="-g -O0 -Werror" check-programs
 
-test-scan-build:
+test-clang-Wall-script-alpine:
+  extends:
+    - .gitlab-shared-clang-alpine
+  allow_failure: true
+  script:
+    - export CFLAGS="-g -O0"
+    - export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
+    - ./autogen.sh
+    - $CC --version
+    - ./configure
+    - make -j CFLAGS="-g -O0 -Werror"
+    - make -j CFLAGS="-g -O0 -Werror" check-programs
+
+test-scan-build-ubuntu:
   extends:
     - .gitlab-shared-clang
   script:
+    - ./autogen.sh
+    - echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
     - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
     - make clean
     - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
     - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
+
+test-scan-build-alpine:
+  extends:
+    - .gitlab-shared-clang-alpine
+  allow_failure: true
+  script:
+    - ./autogen.sh
+    - echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
+    - make clean
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
+
+test-scan-build-backends:
+  extends:
+    - .gitlab-shared-clang
+  parallel:
+    matrix:
+      - BACKENDS: [
+          "openssl",
+          "gcrypt",
+          "nss",
+          "kernel",
+          "nettle",
+          "mbedtls"
+      ]
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+      changes:
+        - lib/crypto_backend/*
+  script:
+    - DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
+    - ./autogen.sh
+    - echo "Configuring with crypto backend $BACKENDS"
+    - echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0" --with-crypto_backend=$BACKENDS
+    - make clean
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
+    - scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
+    - ./tests/vectors-test

.gitlab/ci/compilation-gcc.gitlab-ci.yml

@@ -3,25 +3,83 @@ test-gcc-compilation:
     - .gitlab-shared-gcc
   script:
     - export CFLAGS="-Wall -Werror"
+    - ./autogen.sh
+    - $CC --version
     - ./configure
     - make -j
     - make -j check-programs
 
-test-gcc-Wall-script:
+test-gcc-Wall-script-ubuntu:
   extends:
     - .gitlab-shared-gcc
   script:
     - export CFLAGS="-g -O0"
     - export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
+    - ./autogen.sh
+    - $CC --version
     - ./configure
     - make -j CFLAGS="-g -O0 -Werror"
     - make -j CFLAGS="-g -O0 -Werror" check-programs
 
-test-gcc-fanalyzer:
+test-gcc-Wall-script-alpine:
+  extends:
+    - .gitlab-shared-gcc-alpine
+  allow_failure: true
+  script:
+    - export CFLAGS="-g -O0"
+    - export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
+    - ./autogen.sh
+    - $CC --version
+    - ./configure
+    - make -j CFLAGS="-g -O0 -Werror"
+    - make -j CFLAGS="-g -O0 -Werror" check-programs
+
+test-gcc-fanalyzer-ubuntu:
   extends:
     - .gitlab-shared-gcc
   script:
-    - export CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events"
-    - ./configure
+    - ./autogen.sh
+    - $CC --version
+    - ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64
     - make -j
     - make -j check-programs
+
+test-gcc-fanalyzer-alpine:
+  extends:
+    - .gitlab-shared-gcc-alpine
+  allow_failure: true
+  script:
+    - ./autogen.sh
+    - $CC --version
+    - ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events -Wno-analyzer-fd-leak" --host=x86_64
+    - make -j
+    - make -j check-programs
+
+test-gcc-fanalyzer-backends:
+  extends:
+    - .gitlab-shared-gcc
+  parallel:
+    matrix:
+      - BACKENDS: [
+          "openssl",
+          "gcrypt",
+          "nss",
+          "kernel",
+          "nettle",
+          "mbedtls"
+      ]
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+      changes:
+        - lib/crypto_backend/*
+  script:
+    - DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
+    - ./autogen.sh
+    - $CC --version
+    - echo "Configuring with crypto backend $BACKENDS"
+    - ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64 --with-crypto_backend=$BACKENDS
+    - make -j
+    - make -j check-programs
+    - ./tests/vectors-test

.gitlab/ci/compilation-spellcheck.yml

@@ -0,0 +1,20 @@
+test-run-spellcheck:
+  image: ubuntu:noble
+  tags:
+    - gitlab-org-docker
+  stage: test
+  interruptible: true
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  artifacts:
+    name: "spellcheck-$CI_COMMIT_REF_NAME"
+    paths:
+      - _spellcheck
+  before_script:
+    - apt-get -y update --fix-missing
+    - apt-get -y install git lintian codespell
+  script:
+    - echo "Running spellcheck"
+    - .gitlab/ci/spellcheck

.gitlab/ci/compilation-various-disables.yml

@@ -4,18 +4,30 @@ test-gcc-disable-compiles:
   parallel:
     matrix:
       - DISABLE_FLAGS: [
-          "--disable-keyring",
-          "--disable-external-tokens --disable-ssh-token",
-          "--disable-luks2-reencryption",
-          "--disable-cryptsetup --disable-veritysetup --disable-integritysetup",
-          "--disable-kernel_crypto",
-          "--disable-selinux",
-          "--disable-udev",
-          "--disable-internal-argon2",
-          "--disable-blkid"
+          "keyring",
+          "external-tokens ssh-token",
+          "luks2-reencryption",
+          "cryptsetup veritysetup integritysetup",
+          "kernel_crypto",
+          "udev",
+          "internal-argon2",
+          "blkid",
+          "hw-opal"
       ]
+  artifacts:
+    name: "meson-build-logs-$CI_COMMIT_REF_NAME"
+    paths:
+      - meson_builddir/meson-logs
   script:
+    - DEBIAN_FRONTEND=noninteractive apt-get -yq install meson ninja-build
     - export CFLAGS="-Wall -Werror"
-    - ./configure $DISABLE_FLAGS
+    - ./autogen.sh
+    - echo "Configuring with --disable-$DISABLE_FLAGS"
+    - ./configure $(for i in $DISABLE_FLAGS; do echo "--disable-$i"; done)
     - make -j
     - make -j check-programs
+    - git checkout -f && git clean -xdf
+    - meson -v
+    - echo "Configuring with -D$DISABLE_FLAGS=false"
+    - meson setup meson_builddir $(for i in $DISABLE_FLAGS; do [ "$i" == "internal-argon2" ] && echo "-Dargon-implementation=internal" || echo "-D$i=false"; done)
+    - ninja -C meson_builddir

.gitlab/ci/csmock.yml

@@ -1,17 +1,36 @@
+.dnf-csmock:
+  variables:
+    DISTRO: cryptsetup-fedora-rawhide
+    DISK_SIZE: 20
+  extends:
+    - .fail_if_coredump_generated
+  before_script:
+    - >
+      sudo dnf -y -q install
+      autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
+      libblkid-devel libpwquality-devel libselinux-devel
+      libssh-devel libtool libuuid-devel make popt-devel
+      libsepol-devel.x86_64 pkgconfig tar uuid-devel git
+      openssl-devel asciidoctor meson ninja-build
+      rpm-build csmock
+
 test-commit-job-csmock:
   extends:
-    - .dump_kernel_log
+    - .dnf-csmock
   tags:
     - libvirt
-    - rhel7-csmock
+    - cryptsetup-fedora-rawhide
   stage: test
   interruptible: true
   allow_failure: true
-  variables:
-    RUN_SSH_PLUGIN_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/ || $CI_PIPELINE_SOURCE == "merge_request_event"
   script:
-    - /opt/csmock-run-script.sh
+    - .gitlab/ci/build_srpm
+    - .gitlab/ci/run_csmock
+  artifacts:
+    when: always
+    paths:
+      - cryptsetup-csmock-results.tar.xz

.gitlab/ci/debian-i686.yml

@@ -1,12 +1,13 @@
-test-mergerq-job-ubuntu-32bit:
+test-mergerq-job-debian-i686:
   extends:
     - .debian-prep
   tags:
     - libvirt
-    - ubuntu-bionic-32bit
+    - cryptsetup-debian-12i686
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-debian-12i686
     RUN_SSH_PLUGIN_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null
@@ -19,15 +20,16 @@ test-mergerq-job-ubuntu-32bit:
     - make -j -C tests check-programs
     - sudo -E make check
 
-test-main-commit-job-ubuntu-32bit:
+test-main-commit-job-debian-i686:
   extends:
     - .debian-prep
   tags:
     - libvirt
-    - ubuntu-bionic-32bit
+    - cryptsetup-debian-12i686
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-debian-12i686
     RUN_SSH_PLUGIN_TEST: "1"
   rules:
     - if: $RUN_SYSTEMD_PLUGIN_TEST != null

.gitlab/ci/debian.yml

@@ -1,17 +1,16 @@
 .debian-prep:
   extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
   before_script:
-    - >
-      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
-      sudo apt-get -y install -y -qq swtpm meson ninja-build python3-jinja2
-      gperf libcap-dev tpm2-tss-engine-dev libmount-dev swtpm-tools
+    - sudo apt-get -y update
     - >
       sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
       pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
       libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
-      tar libargon2-0-dev libpwquality-dev sharutils dmsetup jq xxd expect
-      keyutils netcat passwd openssh-client sshpass asciidoctor
+      tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
+      keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
+      swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
+      libmount-dev swtpm-tools tpm2-tools
     - sudo apt-get -y build-dep cryptsetup
     - sudo -E git clean -xdf
     - ./autogen.sh
@@ -22,11 +21,13 @@ test-mergerq-job-debian:
     - .debian-prep
   tags:
     - libvirt
-    - debian11
+    - cryptsetup-debian-12
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -41,11 +42,13 @@ test-main-commit-job-debian:
     - .debian-prep
   tags:
     - libvirt
-    - debian11
+    - cryptsetup-debian-12
   stage: test
   interruptible: true
   variables:
+    DISTRO: cryptsetup-debian-12
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -54,3 +57,48 @@ test-main-commit-job-debian:
     - make -j
     - make -j -C tests check-programs
     - sudo -E make check
+
+# meson tests
+test-mergerq-job-debian-meson:
+  extends:
+    - .debian-prep
+  tags:
+    - libvirt
+    - cryptsetup-debian-12
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-debian-12
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - sudo apt-get -y install -y -qq meson ninja-build
+    - meson setup build
+    - ninja -C build
+    - cd build && sudo -E meson test --verbose --print-errorlogs
+
+test-main-commit-job-debian-meson:
+  extends:
+    - .debian-prep
+  tags:
+    - libvirt
+    - cryptsetup-debian-12
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-debian-12
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  script:
+    - sudo apt-get -y install -y -qq meson ninja-build
+    - meson setup build
+    - ninja -C build
+    - cd build && sudo -E meson test --verbose --print-errorlogs

.gitlab/ci/fedora-opal.yml

@@ -0,0 +1,145 @@
+.opal-template-fedora:
+  extends:
+    - .dnf-openssl-backend
+  tags:
+    - libvirt
+    - cryptsetup-fedora-rawhide
+  stage: test-opal
+  interruptible: false
+  variables:
+    OPAL2_DEV: "/dev/nvme0n1"
+    OPAL2_PSID_FILE: "/home/gitlab-runner/psid.txt"
+    VOLATILE: 1
+  script:
+    - sudo dnf install -y -q nvme-cli
+    - sudo nvme list
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check TESTS="00modules-test compat-test-opal"
+
+# Samsung SSD 980 500GB (on tiber machine)
+test-commit-rawhide-samsung980:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  extends:
+    - .opal-template-fedora
+  tags:
+    - tiber
+  resource_group: samsung980-on-tiber
+  interruptible: false
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a809"
+
+test-mergerq-rawhide-samsung980:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  extends:
+    - .opal-template-fedora
+  tags:
+    - tiber
+  resource_group: samsung980-on-tiber
+  interruptible: false
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a809"
+
+# WD PC SN740 SDDQNQD-512G-1014 (on tiber machine)
+# Disabled on 2025-03-20, seems broken
+#test-commit-rawhide-sn740:
+#  rules:
+#    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#      when: never
+#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+#  extends:
+#    - .opal-template-fedora
+#  tags:
+#    - tiber
+#  resource_group: sn740-on-tiber
+#  interruptible: false
+#  variables:
+#    PCI_PASSTHROUGH_VENDOR_ID: "15b7"
+#    PCI_PASSTHROUGH_DEVICE_ID: "5017"
+#
+#test-mergerq-rawhide-sn740:
+#  rules:
+#    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#      when: never
+#    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#  extends:
+#    - .opal-template-fedora
+#  tags:
+#    - tiber
+#  resource_group: sn740-on-tiber
+#  interruptible: false
+#  variables:
+#    PCI_PASSTHROUGH_VENDOR_ID: "15b7"
+#    PCI_PASSTHROUGH_DEVICE_ID: "5017"
+
+# Samsung SSD 980 PRO 1TB (on trantor machine)
+test-commit-rawhide-samsung980pro:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  extends:
+    - .opal-template-fedora
+  tags:
+    - trantor
+  resource_group: samsung980pro-on-trantor
+  interruptible: false
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a80a"
+
+test-mergerq-rawhide-samsung980pro:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  extends:
+    - .opal-template-fedora
+  tags:
+    - trantor
+  resource_group: samsung980pro-on-trantor
+  interruptible: false
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a80a"
+
+# # UMIS RPETJ256MGE2MDQ (on tiber machine)
+# test-commit-rawhide-umis:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   resource_group: umis-on-tiber
+#   stage: test
+#   interruptible: false
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
+#     PCI_PASSTHROUGH_DEVICE_ID: "6302"
+#
+# test-mergerq-rawhide-umis:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   resource_group: umis-on-tiber
+#   stage: test
+#   interruptible: false
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
+#     PCI_PASSTHROUGH_DEVICE_ID: "6302"

.gitlab/ci/fedora.yml

@@ -1,20 +1,19 @@
 .dnf-openssl-backend:
-  extends:
-    - .dump_kernel_log
-  before_script:
-    - >
-      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
-      sudo dnf -y -q install
-      swtpm meson ninja-build python3-jinja2 gperf libcap-devel tpm2-tss-devel
-      libmount-devel swtpm-tools
-    - >
-      sudo dnf -y -q install
+  variables:
+    DISTRO: cryptsetup-fedora-rawhide
+    PKGS: >-
       autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
       libargon2-devel libblkid-devel libpwquality-devel libselinux-devel
       libssh-devel libtool libuuid-devel make popt-devel
       libsepol-devel.x86_64 netcat openssh-clients passwd pkgconfig sharutils
       sshpass tar uuid-devel vim-common device-mapper expect gettext git jq
-      keyutils openssl-devel openssl asciidoctor
+      keyutils openssl-devel openssl asciidoctor swtpm meson ninja-build
+      python3-jinja2 gperf libcap-devel tpm2-tss-devel libmount-devel swtpm-tools
+  extends:
+    - .fail_if_coredump_generated
+  before_script:
+    - sudo dnf clean all
+    - (r=3;while ! sudo dnf -y -q install $PKGS ; do ((--r))||exit;sleep 5;echo "Retrying";done)
     - sudo -E git clean -xdf
     - ./autogen.sh
     - ./configure --enable-fips --enable-pwquality --enable-libargon2 --with-crypto_backend=openssl --enable-asciidoc
@@ -24,12 +23,14 @@ test-main-commit-job-rawhide:
     - .dnf-openssl-backend
   tags:
     - libvirt
-    - fedora-rawhide
+    - cryptsetup-fedora-rawhide
   stage: test
   interruptible: true
   allow_failure: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+    RUN_SYSTEMD_PLUGIN_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never
@@ -44,12 +45,14 @@ test-mergerq-job-rawhide:
     - .dnf-openssl-backend
   tags:
     - libvirt
-    - fedora-rawhide
+    - cryptsetup-fedora-rawhide
   stage: test
   interruptible: true
   allow_failure: true
   variables:
     RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+    RUN_SYSTEMD_PLUGIN_TEST: "1"
   rules:
     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
       when: never

.gitlab/ci/gcc-Wall

@@ -31,12 +31,13 @@ EXTRA="-Wextra \
  -Wunsafe-loop-optimizations \
  -Wold-style-definition \
  -Wno-missing-field-initializers \
- -Wno-unused-parameter \
+ -Wunused-parameter \
  -Wno-long-long \
  -Wmaybe-uninitialized \
  -Wvla \
  -Wformat-overflow \
- -Wformat-truncation"
+ -Wformat-truncation \
+ -Wstringop-overread"
 
 exec $GCC $PEDANTIC $CONVERSION \
 	-Wall $Wuninitialized \

.gitlab/ci/gitlab-shared-docker.yml

@@ -1,5 +1,6 @@
-.gitlab-shared-docker:
-  image: ubuntu:focal
+# Ubuntu
+.gitlab-shared-docker-ubuntu:
+  image: ubuntu:noble
   tags:
     - gitlab-org-docker
   stage: test
@@ -12,20 +13,49 @@
     - .gitlab/ci/cibuild-setup-ubuntu.sh
     - export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
     - export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
-    - ./autogen.sh
+
+# Alpine
+.gitlab-shared-docker-alpine:
+  image: alpine:latest
+  tags:
+    - gitlab-org-docker
+  stage: test
+  interruptible: true
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  before_script:
+    - apk add bash build-base clang clang-analyzer argp-standalone lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev device-mapper gettext-dev libssh-dev automake autoconf libtool tar asciidoctor
+    - export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
+    - export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
 
 .gitlab-shared-gcc:
   extends:
-    - .gitlab-shared-docker
+    - .gitlab-shared-docker-ubuntu
   variables:
     COMPILER: "gcc"
-    COMPILER_VERSION: "11"
-    RUN_SSH_PLUGIN_TEST: "1"
+    COMPILER_VERSION: "14"
+    CC: "gcc-14"
 
 .gitlab-shared-clang:
   extends:
-    - .gitlab-shared-docker
+    - .gitlab-shared-docker-ubuntu
   variables:
     COMPILER: "clang"
-    COMPILER_VERSION: "13"
-    RUN_SSH_PLUGIN_TEST: "1"
+    COMPILER_VERSION: "20"
+    CC: "clang-20"
+
+.gitlab-shared-gcc-alpine:
+  extends:
+    - .gitlab-shared-docker-alpine
+  variables:
+    COMPILER: "gcc"
+    CC: "gcc"
+
+.gitlab-shared-clang-alpine:
+  extends:
+    - .gitlab-shared-docker-alpine
+  variables:
+    COMPILER: "clang"
+    CC: "clang"

.gitlab/ci/rhel.yml

@@ -1,106 +0,0 @@
-.rhel-openssl-backend:
-  extends:
-    - .dump_kernel_log
-  before_script:
-    - >
-      sudo yum -y -q  install
-      autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
-      libblkid-devel libpwquality-devel libselinux-devel libssh-devel libtool
-      libuuid-devel make popt-devel libsepol-devel nc openssh-clients passwd
-      pkgconfig sharutils sshpass tar uuid-devel vim-common device-mapper
-      expect gettext git jq keyutils openssl-devel openssl gem > /dev/null 2>&1
-    - sudo gem install asciidoctor
-    - sudo -E git clean -xdf
-    - ./autogen.sh
-    - ./configure --enable-fips --enable-pwquality --with-crypto_backend=openssl --enable-asciidoc
-
-# non-FIPS jobs
-
-test-main-commit-rhel8:
-  extends:
-    - .rhel-openssl-backend
-  tags:
-    - libvirt
-    - rhel8
-  stage: test
-  interruptible: true
-  variables:
-    RUN_SSH_PLUGIN_TEST: "1"
-  rules:
-    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
-      when: never
-    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
-      when: never
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
-  script:
-    - make -j
-    - make -j -C tests check-programs
-    - sudo -E make check
-
-test-main-commit-rhel9:
-  extends:
-    - .rhel-openssl-backend
-  tags:
-    - libvirt
-    - rhel9
-  stage: test
-  interruptible: true
-  variables:
-    RUN_SSH_PLUGIN_TEST: "1"
-  rules:
-    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
-      when: never
-    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
-      when: never
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
-  script:
-    - make -j
-    - make -j -C tests check-programs
-    - sudo -E make check
-
-# FIPS jobs
-
-test-main-commit-rhel8-fips:
-  extends:
-    - .rhel-openssl-backend
-  tags:
-    - libvirt
-    - rhel8-fips
-  stage: test
-  interruptible: true
-  variables:
-    RUN_SSH_PLUGIN_TEST: "1"
-  rules:
-    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
-      when: never
-    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
-      when: never
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
-  script:
-    - fips-mode-setup --check || exit 1
-    - make -j
-    - make -j -C tests check-programs
-    - sudo -E make check
-
-test-main-commit-rhel9-fips:
-  extends:
-    - .rhel-openssl-backend
-  tags:
-    - libvirt
-    - rhel9-fips
-  stage: test
-  interruptible: true
-  allow_failure: true
-  variables:
-    RUN_SSH_PLUGIN_TEST: "1"
-  rules:
-    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
-      when: never
-    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
-      when: never
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
-  script:
-    - fips-mode-setup --check || exit 1
-    - make -j
-    - make -j -C tests check-programs
-    - sudo -E make check

.gitlab/ci/run_csmock

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+CSMOCK="sudo /usr/bin/csmock"
+CSMOCK_TOOLS="gcc,clang,cppcheck,shellcheck"
+CSMOCK_TXZ="cryptsetup-csmock-results.tar.xz"
+CSMOCK_ERR="cryptsetup-csmock-results/scan-results.err"
+
+$CSMOCK cryptsetup-*.src.rpm \
+       --keep-going --force \
+       --cswrap-timeout 300 \
+       --skip-patches \
+       --tools $CSMOCK_TOOLS \
+       --output $CSMOCK_TXZ \
+       --gcc-analyze \
+       --cppcheck-add-flag=--check-level=exhaustive \
+       || { echo "csmock command failed"; exit 2; }
+
+tar xJf $CSMOCK_TXZ $CSMOCK_ERR --strip-components 1 \
+       && test -s $CSMOCK_ERR \
+       && { echo "csmock discovered important errors"; echo 3; }
+
+exit 0

.gitlab/ci/spellcheck

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+DIR="_spellcheck"
+
+[ ! -d $DIR ] && mkdir $DIR
+
+echo "[SPELLINTIAN]"
+git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
+    xargs -r0 spellintian | \
+    grep -v "(duplicate word)" | \
+    grep -v "docs/" | tee $DIR/spell1.txt
+
+echo "[CODESPELL]"
+git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
+    xargs -r0 codespell | \
+    grep -v "EXPCT" | \
+    grep -v "params, prams" | \
+    grep -v "pad, padded" | \
+    grep -v "CIPHER, CHIP" | \
+    grep -v "gost" | \
+    grep -v "userA" | \
+    grep -v "re-use" | \
+    grep -v "fo ==" | \
+    grep -v "docs/" | tee $DIR/spell2.txt
+
+
+[ -s $DIR/spell1.txt ] && exit 1
+[ -s $DIR/spell2.txt ] && exit 2
+
+exit 0

.gitlab/ci/ubuntu.yml

@@ -0,0 +1,106 @@
+.ubuntu-prep:
+  extends:
+    - .fail_if_coredump_generated
+  before_script:
+    - sudo apt-get -y update
+    - >
+      sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
+      pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
+      libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
+      tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
+      keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
+      swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
+      libmount-dev swtpm-tools tpm2-tools
+    # scsi_debug, gost crypto
+    - sudo apt-get -y install dkms linux-headers-$(uname -r) linux-modules-extra-$(uname -r) gost-crypto-dkms
+    - sudo apt-get -y build-dep cryptsetup
+    - sudo -E git clean -xdf
+    - ./autogen.sh
+    - ./configure --enable-libargon2 --enable-asciidoc
+
+test-mergerq-job-ubuntu:
+  extends:
+    - .ubuntu-prep
+  tags:
+    - libvirt
+    - cryptsetup-ubuntu-2404
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-ubuntu-2404
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check
+
+test-main-commit-job-ubuntu:
+  extends:
+    - .ubuntu-prep
+  tags:
+    - libvirt
+    - cryptsetup-ubuntu-2404
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-ubuntu-2404
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  script:
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check
+
+# meson tests
+test-mergerq-job-ubuntu-meson:
+  extends:
+    - .ubuntu-prep
+  tags:
+    - libvirt
+    - cryptsetup-ubuntu-2404
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-ubuntu-2404
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - sudo apt-get -y install -y -qq meson ninja-build
+    - meson setup build
+    - ninja -C build
+    - cd build && sudo -E meson test --verbose --print-errorlogs
+
+test-main-commit-job-ubuntu-meson:
+  extends:
+    - .ubuntu-prep
+  tags:
+    - libvirt
+    - cryptsetup-ubuntu-2404
+  stage: test
+  interruptible: true
+  variables:
+    DISTRO: cryptsetup-ubuntu-2404
+    RUN_SSH_PLUGIN_TEST: "1"
+    RUN_KEYRING_TRUSTED_TEST: "1"
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  script:
+    - sudo apt-get -y install -y -qq meson ninja-build
+    - meson setup build
+    - ninja -C build
+    - cd build && sudo -E meson test --verbose --print-errorlogs

.gitlab/issue_templates/Bug.md

@@ -9,7 +9,10 @@
 
 ### Debug log
 <!-- Paste a debug log of the failing command (add --debug option) between the markers below (to keep raw debug format).-->
+<!-- We need a lot of information from the debug log; without it, we cannot process your report. -->
+<!-- Debug log does not contain any private information. Do not paste private data; we'll ask you for more information if needed. -->
 ```
 Output with --debug option:
 
 ```
+<!-- NOTE: WITHOUT DEBUG LOG, THE BUG REPORT WILL BE CLOSED. ALSO, PLEASE DO NOT TRY TO REMOVE PARTS OF THE DEBUG LOG! -->

.lgtm.yml

@@ -1,11 +0,0 @@
-queries:
-  - exclude: cpp/fixme-comment
-  - exclude: cpp/empty-block
-# symver attribute detection cannot be used, disable it for lgtm
-extraction:
-  cpp:
-    configure:
-      command:
-      - "./autogen.sh"
-      - "./configure --enable-external-tokens --enable-ssh-token"
-      - "echo \"#undef HAVE_ATTRIBUTE_SYMVER\" >> config.h"

CONTRIBUTING.md

@@ -0,0 +1,158 @@
+Contributing to cryptsetup
+==========================
+For basic information about the cryptsetup project, please read [README](README.md).
+
+The Cryptsetup project uses free, open-source licenses; details are described in [licensing](README.licensing).
+
+For contribution code or documentation to the cryptsetup project, you must have the necessary rights to the content, and your contribution must be provided under the required license.
+
+We welcome contributions from everyone.
+
+Cryptsetup is an independent project with much volunteer effort, and our resources are limited.
+Following the guidelines specified in this file makes it easier for us to process your issue.
+
+Project maintainers can remove or reject abusive or otherwise unacceptable comments or code.
+
+Git repository
+--------------
+The primary repository is located at [gitlab.com/cryptsetup/cryptsetup](https://gitlab.com/cryptsetup/cryptsetup).
+The development branch is ``main``; minor stable releases can use their branches with cherry-picked or backported patches.
+
+There are backup mirrors located at [github.com/mbroz/cryptsetup](https://github.com/mbroz/cryptsetup) and [git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git](https://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git).
+
+How to make a bug report
+------------------------
+To report an issue or feature request, please use GitLab [cryptsetup issue tracker](https://gitlab.com/cryptsetup/cryptsetup/-/issues).
+
+Before reporting an issue, please try to search documentation and existing issues. Always try to reproduce the problem on the latest supported release.
+Please *always* collect and attach ``--debug`` log and other information as instructed in the issue template.
+Even if you think the problem is obvious, we need logged information about the environment (like versions of kernel modules, etc.).
+
+Please do not report distribution-specific issues if they are not present in the latest upstream release.
+For such reports, please use downstream distribution-specific trackers.
+If the issue is related to upstream, downstream maintainers will redirect you here, or upstream maintainers will join the discussion.
+
+If you think that you found some security bug, please follow the instructions in the [SECURITY](SECURITY.md) file.
+
+How to contribute changes to cryptsetup
+---------------------------------------
+The following notes are a very short introduction to cryptsetup internal processes and an overview of generic rules that should be followed for all changes.
+
+Changes from developers and external contributors should go through the GitLab repository [merge reguests](https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests).
+Alternatively (for trivial changes), you can send a patch to [cryptsetup mailing list](mailto:cryptsetup@lists.linux.dev).
+
+Please do not write personal emails with questions or patches to maintainers and developers.
+
+### Project structure
+Cryptsetup projects include a libcryptsetup library, tools, token plugins, documentation, and a test suite.
+
+Cryptsetup library (libcryptsetup) exports [versioned symbols](lib/libcryptsetup.sym).
+Tools (cryptsetup, veritysetup, integritysetup) use libcryptsetup shared library.
+Some isolated parts in the lib directory can be reused for tools (the source is recompiled).
+
+The basic directory structure in the repository is
+```
+├── docs - Documentation and release notes.
+├── lib  - libcryptsetup implementation
+│   ├── bitlk           - Bitlocker format
+│   ├── crypto_backend  - Cryptography backend
+│   ├── fvault2         - FileVault2 format
+│   ├── integrity       - Linux dm-integrity interface
+│   ├── loopaes         - Linux LoopAES format
+│   ├── luks1           - LUKS1 format
+│   ├── luks2           - LUKS2 format including OPAL2 SED
+│   ├── tcrypt          - TrueCrypt / VeraCrypt format
+│   └── verity          - Linux dm-verity interface
+├── man - Manual pages (in AsciiDoc format)
+├── misc - Miscellaneous additions
+├── po - Translation files
+├── scripts - Scripts for system configuration
+├── src - Tools implementation
+├── tests - Testsuite (test units, regression tests, fuzzing)
+└── tokens - Token plugins
+```
+### Coordination with other projects
+The cryptsetup tools and library use low-level functions that depend on many other subsystems.
+Currently, the project is supported only for Linux (it will not work on Android or other systems).
+
+Cryptsetup project requires some parts of the Linux kernel, notably the *Device Mapper* (dm-crypt, dm-integrity, dm-verity, dm-zero modules) and kernel *userspace cryptographic interface*.
+Missing kernel interface can significantly limit (or even disallow) cryptsetup functionality.
+
+Integration in operating systems also depends on several other projects, most notably *systemd* (that implements its own tooling using libcryptsetup) and *util-Linux* (*blkid* parsing of supported format metadata). Some changes must be synchronized in all needed places (kernel, blkid, libcryptsetup).
+
+Several other projects implement their own token metadata (either through binary token plugins or through generic libcryptsetup JSON token access functions).
+
+### Used cryptography algorithms
+Cryptsetup avoids implementing cryptographic primitives but uses cryptographic libraries.
+Exceptions were PBKDF internal implementations - PBKDF2 and Argon2 until these were integrated into major cryptographic libraries.
+
+Cryptsetup can be compiled with several cryptographic libraries backend (OpenSSL, libgcrypt, Nettle, NSS, and Linux kernel userspace API).
+OpenSSL is the default and strongly recommended configuration.
+
+If the cryptographic library does not implement some cryptographic primitive (for example, if running in a FIPS-140 environment or just
+because it does not include it at all), functionality could be limited.
+
+### Configuration and versioning
+Cryptsetup can be configured using *Autoconf* or *Meson*. Autoconf support is being deprecated in the long term.
+Currently, all new configuration options must be implemented in both systems.
+
+Cryptsetup intentionally does not use a system configuration file (located in /etc).
+All functionality must be determined dynamically.
+
+All related /etc configuration files (crypttab, fstab and others) are maintained by systemd (in some legacy distributions by cryptsetup downstream).
+
+Cryptsetup uses [semantic versioning](https://semver.org/).
+Major and minor releases are always based on the main git branch; the minor stable (patch) versions can have some specific branch with backported or cherry-picked patches (from the main branch).
+Usually, minor releases happen twice per year and stable patch updates according to reported bugs (in 1-3 month intervals).
+
+### Compilation and debugging
+The library and tools are written in C language; we require C99 and support gcc and Clang compilers.
+Manual pages are generated from AsciiDoc sources and libcryptsetup API documentation by Doxygen (from libcryptsetup.h comments).
+Testsuite is a combination of local C utilities, fuzzing implementation in C++, bash scripts, and uses many other system utilities.
+
+All tools contain compiled-in debug messages that are available through --debug options.
+
+With Autoconf and libtool, you can run the cryptsetup tool in the debugger without installation using this one-line script:
+```
+libtool --mode=execute gdb --args ./cryptsetup --debug $@
+```
+This will ensure that a properly compiled libcryptsetup file is used.
+
+### Coding style
+Cryptsetup uses [Linux kernel coding style](https://cdn.kernel.org/doc/html/latest/process/coding-style.html) for libcryptsetup and tools (where applicable) with some additional notes:
+- Use tabulators for indentation; the line should not exceed 100 characters with an 8-character tabulator. Otherwise, use a tab of any length. :-).
+- The minimal C standard required is C99.
+- The ``goto`` use is allowed only for error path (``goto out`` for common code path, ``goto err`` for specific error code path).
+- Split patches per change; do not submit huge patches combining several changes.
+- Use an elaborative description in the patch header.
+- No need to use sign-off-by lines.
+- Use name prefixes (``crypt_``, ``LUKS2_`` and similar).
+- Avoid extensive preprocessor use (specifically conditional ``#if`` or ``#ifdef`` sections).
+- To check detected configuration options stored in config.h, always use ``#if SOMETHING`` (do NOT use ``#ifdef``).
+- Use output only through ``log_err, log_std, log_verbose, log_dbg`` macros.
+  The ``log_dbg`` is always in English; the others should be wrapped in the ``_()`` macro for translation.
+- Use ``assert()`` but only for simple invariants and variables (avoid calling functions).
+  Do not use assert for user-defined input (this should be a normal error path).
+- The code style is quite relaxed in testing scripts (code there is not intended for production use).
+
+### General rules and testing
+- Cryptsetup should work on all architectures supported by the Linux kernel.
+Only very few functionalities require specific hardware (notably Opal SED support).
+If you want to introduce some specific hardware support, please discuss it with the maintainers first.
+
+- All code changes should go through merge requests and reviews.
+Code can be merged after review approval (done by someone with the commit right to the development repository), but reviews from external people are very welcome, too.
+
+- All new functionality must come with at least rudimentary coverage in the test suite.
+Always run the test suite before opening the merge request (``make check`` with root privilege).
+
+- We have continuous integration (CI) that runs many tests automatically, but the output is not directly visible for external merge request authors (for security reasons).
+All CI scripts are available in .gitlab and .github folders in the project repository.
+
+  Maintainers will provide you log files if anything fails. Your code must produce no warnings before it is merged.
+
+- We run compilation with many extended [gcc](.gitlab/ci/gcc-Wall) and [Clang](.gitlab/ci/clang-Wall) warnings and include some analyzers, notably
+  - [Coverity](https://scan.coverity.com), GitHub CodeQL, Clang scan-build, and gcc static analyzer, and
+  - fuzzing integrated in [OSS-fuzz project](https://github.com/google/oss-fuzz/tree/master/projects/cryptsetup).
+
+- Testsuite can also partially run under Valgrind dynamic analyzer with ``make valgrind-check``.

FAQ.md

@@ -38,7 +38,7 @@
   LUKS1 and LUKS2.
  
   The LUKS1 on-disk format specification is at  
-  https://www.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf  
+  https://cdn.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf  
   The LUKS2 on-disk format specification is at  
   https://gitlab.com/cryptsetup/LUKS2-docs
 
@@ -169,17 +169,12 @@
   me write the section.  Please note that by contributing to this FAQ,
   you accept the license described below.
 
-  This work is under the "Attribution-Share Alike 3.0 Unported" license,
-  which means distribution is unlimited, you may create derived works, but
+  This work is licensed under a Creative Commons CC-BY-SA-4.0
+  "Attribution-ShareAlike 4.0 International" license which means
+  distribution is unlimited, you may create derived works, but
   attributions to original authors and this license statement must be
-  retained and the derived work must be under the same license.  See
-  https://creativecommons.org/licenses/by-sa/3.0/ for more details of the
-  license.
-
-  Side note: I did text license research some time ago and I think this
-  license is best suited for the purpose at hand and creates the least
-  problems.
-
+  retained and the derived work must be under the same license.
+  See https://creativecommons.org/licenses/by-sa/4.0/ for more details.
 
   * **1.6 Where is the project website?**
 
@@ -710,9 +705,12 @@
   this.  The only legitimate reason I can think of is if you want to have
   two LUKS devices with the same volume key.  Even then, I think it would
   be preferable to just use key-slots with the same passphrase, or to use
-  plain dm-crypt instead.  If you really have a good reason, please tell
-  me.  If I am convinced, I will add how to do this here.
+  plain dm-crypt instead.
 
+  Use the --volume-key-file option, like this:
+```
+    cryptsetup luksFormat --volume-key-file keyfile /dev/loop0
+```
 
   * **2.12 What are the security requirements for a key read from file?**
 
@@ -1928,10 +1926,6 @@
   Hence, LUKS has no kill option because it would do much more harm than
   good.
 
-  Still, if you have a good use-case (i.e.  non-abstract real-world
-  situation) where a Nuke-Option would actually be beneficial, please let
-  me know.
-
 
  * **5.22 Does cryptsetup open network connections to websites, etc. ?**
 
@@ -2685,8 +2679,7 @@ can be converted to the raw volume key for example via:
 
   Note that at the time this FAQ item was written, 1.5.4 was the latest
   1.5.x version and it has the flaw, i.e.  works with the old Whirlpool
-  version.  Possibly later 1.5.x versions will work as well.  If not,
-  please let me know.
+  version.  Possibly later 1.5.x versions will work as well.
 
   The only two ways to access older LUKS containers created with Whirlpool
   are to either decrypt with an old gcrypt version that has the flaw or to
@@ -2802,8 +2795,7 @@ can be converted to the raw volume key for example via:
   03) Creating your own initrd
 
   The two examples below should give you most of what is needed.  This is
-  tested with LUKS1 and should work with LUKS2 as well.  If not, please
-  let me know.
+  tested with LUKS1 and should work with LUKS2 as well.
 
   Here is a really minimal example.  It does nothing but set up some
   things and then drop to an interactive shell.  It is perfect to try out

Makefile.am

@@ -1,4 +1,18 @@
-EXTRA_DIST = README.md COPYING.LGPL FAQ.md docs misc autogen.sh
+EXTRA_DIST = README.md SECURITY.md README.licensing CONTRIBUTING.md FAQ.md docs misc autogen.sh
+EXTRA_DIST += meson_options.txt \
+	meson.build \
+	lib/crypto_backend/argon2/meson.build \
+	lib/crypto_backend/meson.build \
+	lib/meson.build \
+	man/meson.build \
+	po/meson.build \
+	scripts/meson.build \
+	src/meson.build \
+	tests/meson.build \
+	tests/fuzz/meson.build \
+	tokens/meson.build \
+	tokens/ssh/meson.build
+
 SUBDIRS = po tests tests/fuzz
 CLEANFILES =
 DISTCLEAN_TARGETS =
@@ -11,8 +25,7 @@ AM_CPPFLAGS = \
         -DLIBDIR=\""$(libdir)"\"                \
         -DPREFIX=\""$(prefix)"\"                \
         -DSYSCONFDIR=\""$(sysconfdir)"\"        \
-        -DVERSION=\""$(VERSION)"\"              \
-        -DEXTERNAL_LUKS2_TOKENS_PATH=\"${EXTERNAL_LUKS2_TOKENS_PATH}\"
+        -DVERSION=\""$(VERSION)"\"
 AM_CFLAGS = -Wall
 AM_CXXFLAGS = -Wall
 AM_LDFLAGS =

README.licensing

@@ -0,0 +1,20 @@
+The cryptsetup project does not use the same license for all of the code and documentation.
+
+There is code and documentation under:
+
+   * GPL-2.0-or-later   - GNU General Public License version 2, or any later version
+
+   * LGPL-2.1-or-later WITH cryptsetup-OpenSSL-exception
+   * LGPL-2.1-or-later  - GNU Lesser General Public License 2.1 or any later version,
+                          (with cryptsetup-OpenSSL-exception where applicable)
+
+   * Apache-2.0         - Apache License 2.0
+
+   * CC-BY-SA-4.0       - Creative Commons Attribution Share Alike 4.0 International
+
+   * Public Domain
+
+Please, check the source code for more details.
+
+The ./COPYING file (GPL-2.0-or-later) is the default license for code without
+an explicitly defined license.

README.md

@@ -21,67 +21,56 @@ block integrity kernel module.
 
 LUKS Design
 -----------
-**LUKS** is the standard for Linux disk encryption. By providing a standard on-disk format,
-it does not only facilitate compatibility among distributions, but also provides secure management
+**LUKS** is the standard for Linux disk encryption. By providing a standardized on-disk format,
+it not only facilitate compatibility among distributions, but also enables secure management
 of multiple user passwords. LUKS stores all necessary setup information in the partition header,
-enabling to transport or migrate data seamlessly.
+which enables users to transport or migrate data seamlessly.
 
 ### Specification and documentation
-
   * The latest version of the
   [LUKS2 format specification](https://gitlab.com/cryptsetup/LUKS2-docs).
   * The latest version of the
-  [LUKS1 format specification](https://www.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf).
+  [LUKS1 format specification](https://cdn.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf).
   * [Project home page](https://gitlab.com/cryptsetup/cryptsetup/).
   * [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions)
 
 Download
 --------
-All release tarballs and release notes are hosted on
-[kernel.org](https://www.kernel.org/pub/linux/utils/cryptsetup/).
+Release notes and tarballs are available at
+[kernel.org](https://cdn.kernel.org/pub/linux/utils/cryptsetup/).
 
-**The latest stable cryptsetup release version is 2.6.1**
-  * [cryptsetup-2.6.1.tar.xz](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.6/cryptsetup-2.6.1.tar.xz)
-  * Signature [cryptsetup-2.6.1.tar.sign](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.6/cryptsetup-2.6.1.tar.sign)
+**The latest stable cryptsetup release version is 2.8.1**
+  * [cryptsetup-2.8.1.tar.xz](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.xz)
+  * Signature [cryptsetup-2.8.1.tar.sign](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.sign)
     _(You need to decompress file first to check signature.)_
-  * [Cryptsetup 2.6.1 Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.6/v2.6.1-ReleaseNotes).
+  * [Cryptsetup 2.8.1 Release Notes](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.1-ReleaseNotes).
 
-Previous versions
- * [Version 2.5.0](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.5/cryptsetup-2.5.0.tar.xz) -
-   [Signature](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.5/cryptsetup-2.5.0.tar.sign) -
-   [Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.5/v2.5.0-ReleaseNotes).
- * [Version 1.7.5](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/cryptsetup-1.7.5.tar.xz) -
-   [Signature](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/cryptsetup-1.7.5.tar.sign) -
-   [Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/v1.7.5-ReleaseNotes).
+[Previous versions](https://cdn.kernel.org/pub/linux/utils/cryptsetup)
 
 Source and API documentation
 ----------------------------
-For development version code, please refer to
-[source](https://gitlab.com/cryptsetup/cryptsetup/tree/master) page,
-mirror on [kernel.org](https://git.kernel.org/cgit/utils/cryptsetup/cryptsetup.git/) or
+For development version code, please refer to the
+[source](https://gitlab.com/cryptsetup/cryptsetup/tree/master) page, with mirrors
+at [kernel.org](https://git.kernel.org/cgit/utils/cryptsetup/cryptsetup.git/) and
 [GitHub](https://github.com/mbroz/cryptsetup).
 
 For libcryptsetup documentation see
 [libcryptsetup API](https://mbroz.fedorapeople.org/libcryptsetup_API/) page.
 
-The libcryptsetup API/ABI changes are tracked in
-[compatibility report](https://abi-laboratory.pro/tracker/timeline/cryptsetup/).
-
 NLS PO files are maintained by
 [TranslationProject](https://translationproject.org/domain/cryptsetup.html).
 
 Required packages
 -----------------
-All distributions provide cryptsetup as distro package. If you need to compile cryptsetup yourself,
-some packages are required for compilation.
-Please always prefer distro specific build tools to manually configuring cryptsetup.
+All major Linux distributions provide cryptsetup as a bundled package. If you need
+to compile cryptsetup yourself, various additional packages are required.
+Any distribution-specific build tools are preferred when manually configuring cryptsetup.
 
-Here is the list of packages needed for the compilation of project for particular distributions:
+Below are the packages needed to build for certain Linux distributions:
 
 **For Fedora**:
 ```
-git gcc make autoconf automake gettext-devel pkgconfig openssl-devel popt-devel device-mapper-devel
-libuuid-devel json-c-devel libblkid-devel findutils libtool libssh-devel tar
+git gcc make autoconf automake gettext-devel pkgconfig openssl-devel popt-devel device-mapper-devel libuuid-devel json-c-devel libblkid-devel findutils libtool libssh-devel tar rubygem-asciidoctor
 
 Optionally: libargon2-devel libpwquality-devel
 ```
@@ -92,57 +81,57 @@ sharutils device-mapper jq vim-common expect keyutils netcat shadow-utils openss
 
 **For Debian and Ubuntu**:
 ```
-git gcc make autoconf automake autopoint pkg-config libtool gettext libssl-dev libdevmapper-dev
-libpopt-dev uuid-dev libsepol1-dev libjson-c-dev libssh-dev libblkid-dev tar
+git gcc make autoconf automake autopoint pkg-config libtool gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev tar asciidoctor
 
 Optionally: libargon2-0-dev libpwquality-dev
 ```
 To run the internal testsuite (make check) you also need to install
 ```
-sharutils dmsetup jq xxd expect keyutils netcat passwd openssh-client sshpass
+sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client sshpass
 ```
 
-Note that the list could change as the distributions evolve.
+Note that the list may change as Linux distributions evolve.
 
 Compilation
 -----------
-The cryptsetup project uses **automake** and **autoconf** system to generate all needed files
-for compilation. If you check it from the git snapshot, use **./autogen.sh && ./configure && make**
-to compile the project. If you use downloaded released **tar.xz** archive, the configure script
-is already pre-generated (no need to run **autoconf.sh**).
-See **./configure --help** and use **--disable-[feature]** and **--enable-[feature]** options.
+The cryptsetup project uses **automake** and **autoconf** system to generate all files needed to build.
+When building from a git snapshot,, use **./autogen.sh && ./configure && make**
+to compile the project. When building from a release **tar.xz** tarball, the configure script
+is pre-generated (no need to run **autoconf.sh**).
+See **./configure --help** and use the **--disable-[feature]** and **--enable-[feature]** options.
 
-For running the test suite that come with the project, type **make check**.
-Note that most tests will need root user privileges and run many dangerous storage fail simulations.
-Do **not** run tests with root privilege on production systems! Some tests will need scsi_debug
-kernel module to be available.
+To run the test suite that come with the project, type **make check**.
+Note that most tests will need root user privileges and will run dangerous storage failure simulations.
+Do **not** run tests with root privilege on production systems! Some tests will need the **scsi_debug**
+kernel module to be installed.
 
-For more details, please refer to [automake](https://www.gnu.org/software/automake/manual/automake.html)
-and [autoconf](https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf.html) manuals.
+For more details, please refer to the
+[automake](https://www.gnu.org/software/automake/manual/automake.html) and
+[autoconf](https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf.html) documentation.
 
 Help!
 -----
 ### Documentation
-Please read the following documentation before posting questions in the mailing list...
-You will be able to ask better questions and better understand the answers.
+Please read the following before posting questions to the mailing list so that
+you can ask better questions and better understand answers.
 
 * [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions),
 * [LUKS Specifications](#specification-and-documentation), and
 * manuals (aka man page, man pages, man-page) 
 
-The FAQ is online and in the source code for the project. The Specifications are referenced above
-in this document. The man pages are in source and should be available after installation using
-standard man commands, e.g. **man cryptsetup**.
+The FAQ is available online and in the source code for the project. The specifications are
+referenced above in this document. The man pages live within the source tree and should be
+available after installation using standard man commands, e.g. **man cryptsetup**.
 
 ### Mailing List
-
 For cryptsetup and LUKS related questions, please use the cryptsetup mailing list
 [cryptsetup@lists.linux.dev](mailto:cryptsetup@lists.linux.dev),
 hosted at [kernel.org subspace](https://subspace.kernel.org/lists.linux.dev.html).
-To subscribe send an empty mail to
+To subscribe send an empty email message to
 [cryptsetup+subscribe@lists.linux.dev](mailto:cryptsetup+subscribe@lists.linux.dev).
 
 You can also browse and/or search the mailing [list archive](https://lore.kernel.org/cryptsetup/).
-News (NNTP), Atom feed and git access to public inbox is available through [lore.kernel.org](https://lore.kernel.org) service.
+USEnet News (NNTP), Atom feed and git access to the public inbox is available through
+[lore.kernel.org](https://lore.kernel.org) service.
 
-The former dm-crypt [list archive](https://lore.kernel.org/dm-crypt/) is also available.
+The former **dm-crypt** [list archive](https://lore.kernel.org/dm-crypt/) is also available.

configure.ac

@@ -1,9 +1,9 @@
 AC_PREREQ([2.67])
-AC_INIT([cryptsetup],[2.6.1])
+AC_INIT([cryptsetup],[2.8.1])
 
 dnl library version from <major>.<minor>.<release>[-<suffix>]
 LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
-LIBCRYPTSETUP_VERSION_INFO=21:0:9
+LIBCRYPTSETUP_VERSION_INFO=23:0:11
 
 AM_SILENT_RULES([yes])
 AC_CONFIG_SRCDIR(src/cryptsetup.c)
@@ -128,12 +128,10 @@ if test "x$enable_largefile" = "xno"; then
   AC_MSG_ERROR([Building with --disable-largefile is not supported, it can cause data corruption.])
 fi
 
-AC_C_CONST
 AC_C_BIGENDIAN
 AC_TYPE_OFF_T
 AC_SYS_LARGEFILE
 AC_FUNC_FSEEKO
-AC_PROG_GCC_TRADITIONAL
 AC_FUNC_STRERROR_R
 
 dnl ==========================================================================
@@ -267,6 +265,9 @@ AC_DEFUN([CONFIGURE_GCRYPT], [
 		GCRYPT_REQ_VERSION=1.1.42
 	fi
 
+	use_internal_pbkdf2=0
+	use_internal_argon2=1
+
 	dnl libgcrypt rejects to use pkgconfig, use AM_PATH_LIBGCRYPT from gcrypt-devel here.
 	dnl Do not require gcrypt-devel if other crypto backend is used.
 	m4_ifdef([AM_PATH_LIBGCRYPT],[
@@ -290,7 +291,24 @@ AC_DEFUN([CONFIGURE_GCRYPT], [
 		NO_FIPS([])
 	fi
 
+	m4_ifdef([AM_PATH_LIBGCRYPT],[
+	AC_ARG_ENABLE([gcrypt-argon2],
+		dnl Check if we can use gcrypt Argon2 (1.11.0 supports empty password)
+		AS_HELP_STRING([--disable-gcrypt-argon2], [force disable internal gcrypt Argon2]),
+		[],
+		[AM_PATH_LIBGCRYPT([1.11.0], [use_internal_argon2=0], [use_internal_argon2=1])])
+	AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
+	AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
+
+	AC_MSG_CHECKING([if internal cryptsetup Argon2 is compiled-in])
+	if test $use_internal_argon2 = 0; then
+		AC_MSG_RESULT([no])
+	else
+		AC_MSG_RESULT([yes])
+	fi
+
 	AC_CHECK_DECLS([GCRY_CIPHER_MODE_XTS], [], [], [#include <gcrypt.h>])
+	AC_CHECK_DECLS([GCRY_KDF_ARGON2], [], [], [#include <gcrypt.h>])
 
 	if test "x$enable_static_cryptsetup" = "xyes"; then
 		saved_LIBS=$LIBS
@@ -310,19 +328,25 @@ AC_DEFUN([CONFIGURE_GCRYPT], [
 ])
 
 AC_DEFUN([CONFIGURE_OPENSSL], [
-	PKG_CHECK_MODULES([OPENSSL], [openssl >= 0.9.8],,
+	PKG_CHECK_MODULES([LIBCRYPTO], [libcrypto >= 0.9.8],,
 		AC_MSG_ERROR([You need openssl library.]))
-	CRYPTO_CFLAGS=$OPENSSL_CFLAGS
-	CRYPTO_LIBS=$OPENSSL_LIBS
+	CRYPTO_CFLAGS=$LIBCRYPTO_CFLAGS
+	CRYPTO_LIBS=$LIBCRYPTO_LIBS
 	use_internal_pbkdf2=0
+	use_internal_argon2=1
 
 	if test "x$enable_static_cryptsetup" = "xyes"; then
 		saved_PKG_CONFIG=$PKG_CONFIG
 		PKG_CONFIG="$PKG_CONFIG --static"
-		PKG_CHECK_MODULES([OPENSSL_STATIC], [openssl])
-		CRYPTO_STATIC_LIBS=$OPENSSL_STATIC_LIBS
+		PKG_CHECK_MODULES([LIBCRYPTO_STATIC], [libcrypto])
+		CRYPTO_STATIC_LIBS=$LIBCRYPTO_STATIC_LIBS
 		PKG_CONFIG=$saved_PKG_CONFIG
 	fi
+
+	saved_LIBS=$LIBS
+	AC_CHECK_DECLS([OSSL_get_max_threads], [], [], [#include <openssl/thread.h>])
+	AC_CHECK_DECLS([OSSL_KDF_PARAM_ARGON2_VERSION], [use_internal_argon2=0], [], [#include <openssl/core_names.h>])
+	LIBS=$saved_LIBS
 ])
 
 AC_DEFUN([CONFIGURE_NSS], [
@@ -343,6 +367,7 @@ AC_DEFUN([CONFIGURE_NSS], [
 	CRYPTO_CFLAGS=$NSS_CFLAGS
 	CRYPTO_LIBS=$NSS_LIBS
 	use_internal_pbkdf2=1
+	use_internal_argon2=1
 	NO_FIPS([])
 ])
 
@@ -353,6 +378,7 @@ AC_DEFUN([CONFIGURE_KERNEL], [
 #		[AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])],
 #		[#include <sys/socket.h>])
 	use_internal_pbkdf2=1
+	use_internal_argon2=1
 	NO_FIPS([])
 ])
 
@@ -369,6 +395,24 @@ AC_DEFUN([CONFIGURE_NETTLE], [
 
 	CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
 	use_internal_pbkdf2=0
+	use_internal_argon2=1
+	NO_FIPS([])
+])
+
+AC_DEFUN([CONFIGURE_MBEDTLS], [
+	AC_CHECK_HEADERS(mbedtls/version.h,,
+		[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
+
+	saved_LIBS=$LIBS
+	AC_CHECK_LIB(mbedcrypto, mbedtls_md_init,,
+		[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
+	AC_CHECK_FUNCS(mbedtls_pkcs5_pbkdf2_hmac_ext)
+	CRYPTO_LIBS=$LIBS
+	LIBS=$saved_LIBS
+
+	CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
+	use_internal_pbkdf2=0
+	use_internal_argon2=1
 	NO_FIPS([])
 ])
 
@@ -454,7 +498,7 @@ fi
 
 dnl Crypto backend configuration.
 AC_ARG_WITH([crypto_backend],
-	AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle) [openssl]]),
+	AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle/mbedtls) [openssl]]),
 	[], [with_crypto_backend=openssl])
 
 dnl Kernel crypto API backend needed for benchmark and tcrypt
@@ -474,6 +518,7 @@ case $with_crypto_backend in
 	nss)     CONFIGURE_NSS([]) ;;
 	kernel)  CONFIGURE_KERNEL([]) ;;
 	nettle)  CONFIGURE_NETTLE([]) ;;
+	mbedtls) CONFIGURE_MBEDTLS([]) ;;
 	*) AC_MSG_ERROR([Unknown crypto backend.]) ;;
 esac
 AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT,  test "$with_crypto_backend" = "gcrypt")
@@ -481,6 +526,7 @@ AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test "$with_crypto_backend" = "openssl")
 AM_CONDITIONAL(CRYPTO_BACKEND_NSS,     test "$with_crypto_backend" = "nss")
 AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL,  test "$with_crypto_backend" = "kernel")
 AM_CONDITIONAL(CRYPTO_BACKEND_NETTLE,  test "$with_crypto_backend" = "nettle")
+AM_CONDITIONAL(CRYPTO_BACKEND_MBEDTLS, test "$with_crypto_backend" = "mbedtls")
 
 AM_CONDITIONAL(CRYPTO_INTERNAL_PBKDF2, test $use_internal_pbkdf2 = 1)
 AC_DEFINE_UNQUOTED(USE_INTERNAL_PBKDF2, [$use_internal_pbkdf2], [Use internal PBKDF2])
@@ -493,12 +539,21 @@ AC_ARG_ENABLE([internal-argon2],
 AC_ARG_ENABLE([libargon2],
 	AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)]))
 
-if test "x$enable_libargon2" = "xyes" ; then
+if test $use_internal_argon2 = 0 || ( test "x$enable_internal_argon2" = "xno" && test "x$enable_libargon2" != "xyes" ); then
+	if test "x$enable_internal_argon2" = "xyes" || test "x$enable_libargon2" = "xyes"; then
+		AC_MSG_NOTICE([Argon2 in $with_crypto_backend lib is used; internal Argon2 options are ignored.])
+	fi
+	enable_internal_argon2=no
+	enable_internal_sse_argon2=no
+	enable_libargon2=no
+	use_internal_argon2=0
+elif test "x$enable_libargon2" = "xyes" ; then
 	AC_CHECK_HEADERS(argon2.h,,
 		[AC_MSG_ERROR([You need libargon2 development library installed.])])
 	AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include <argon2.h>])
 	PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"])
 	enable_internal_argon2=no
+	use_internal_argon2=0
 else
 	AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.])
 
@@ -517,11 +572,10 @@ else
 	fi
 fi
 
-if test "x$enable_internal_argon2" = "xyes"; then
-	AC_DEFINE(USE_INTERNAL_ARGON2, 1, [Use internal Argon2])
-fi
 AM_CONDITIONAL(CRYPTO_INTERNAL_ARGON2, test "x$enable_internal_argon2" = "xyes")
 AM_CONDITIONAL(CRYPTO_INTERNAL_SSE_ARGON2, test "x$enable_internal_sse_argon2" = "xyes")
+dnl If libargon is in use, we have defined HAVE_ARGON2_H
+AC_DEFINE_UNQUOTED(USE_INTERNAL_ARGON2, [$use_internal_argon2], [Use internal Argon2])
 
 dnl Link with blkid to check for other device types
 AC_ARG_ENABLE([blkid],
@@ -556,6 +610,27 @@ AM_CONDITIONAL(HAVE_BLKID, test "x$enable_blkid" = "xyes")
 AM_CONDITIONAL(HAVE_BLKID_WIPE, test "x$enable_blkid_wipe" = "xyes")
 AM_CONDITIONAL(HAVE_BLKID_STEP_BACK, test "x$enable_blkid_step_back" = "xyes")
 
+AC_ARG_ENABLE([hw-opal],
+	AS_HELP_STRING([--disable-hw-opal], [disable use of hardware-backed OPAL for device encryption]),
+	[],
+	[enable_hw_opal=yes])
+
+if test "x$enable_hw_opal" = "xyes"; then
+	have_opal=yes
+	AC_CHECK_DECLS([ OPAL_FL_SUM_SUPPORTED,
+			 IOC_OPAL_GET_LR_STATUS,
+			 IOC_OPAL_GET_GEOMETRY
+		       ],
+		       [],
+		       [have_opal=no],
+		       [#include <linux/sed-opal.h>])
+	if test "x$have_opal" = "xyes"; then
+		AC_DEFINE([HAVE_HW_OPAL], 1, [Define to 1 to enable OPAL support.])
+	else
+		AC_MSG_WARN([Can not compile with OPAL support, kernel headers are too old, requires v6.4.])
+	fi
+fi
+
 dnl Magic for cryptsetup.static build.
 if test "x$enable_static_cryptsetup" = "xyes"; then
 	saved_PKG_CONFIG=$PKG_CONFIG
@@ -605,8 +680,36 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 ])
 CFLAGS=$saved_CFLAGS
 
+dnl Force compiler to use zero_call_used_regs("used") to check for the function attribute support.
+dnl Otherwise the compiler may falsely advertise it with __has_attribute operator, even though
+dnl it does not implement it on some archs.
+AC_MSG_CHECKING([for zero_call_used_regs(user)])
+saved_CFLAGS=$CFLAGS
+CFLAGS="-O0 -Werror"
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+	void _test_function(void);
+	__attribute__((zero_call_used_regs("used"))) void _test_function(void) {
+		volatile int *i; volatile int j = 0; if (j) *i = 0;
+	}
+]],
+[[ _test_function() ]]
+)],[
+	AC_DEFINE([HAVE_ATTRIBUTE_ZEROCALLUSEDREGS], 1, [Define to 1 to use __attribute__((zero_call_used_regs("used")))])
+	AC_MSG_RESULT([yes])
+], [
+	AC_MSG_RESULT([no])
+])
+CFLAGS=$saved_CFLAGS
+
 AC_MSG_CHECKING([for systemd tmpfiles config directory])
-PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
+if test "x$prefix" != "xNONE"; then
+	saved_PKG_CONFIG=$PKG_CONFIG
+	PKG_CONFIG="$PKG_CONFIG --define-variable=prefix='${prefix}'"
+	PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
+	PKG_CONFIG=$saved_PKG_CONFIG
+else
+	PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
+fi
 AC_MSG_RESULT([$systemd_tmpfilesdir])
 
 AC_SUBST([DEVMAPPER_LIBS])
@@ -634,16 +737,16 @@ dnl Set Requires.private for libcryptsetup.pc
 dnl pwquality is used only by tools
 PKGMODULES="uuid devmapper json-c"
 case $with_crypto_backend in
-	gcrypt)  PKGMODULES+=" libgcrypt" ;;
-	openssl) PKGMODULES+=" openssl" ;;
-	nss)     PKGMODULES+=" nss" ;;
-	nettle)  PKGMODULES+=" nettle" ;;
+	gcrypt)  PKGMODULES="$PKGMODULES libgcrypt" ;;
+	openssl) PKGMODULES="$PKGMODULES openssl" ;;
+	nss)     PKGMODULES="$PKGMODULES nss" ;;
+	nettle)  PKGMODULES="$PKGMODULES nettle" ;;
 esac
 if test "x$enable_libargon2" = "xyes"; then
-	PKGMODULES+=" libargon2"
+	PKGMODULES="$PKGMODULES libargon2"
 fi
 if test "x$enable_blkid" = "xyes"; then
-	PKGMODULES+=" blkid"
+	PKGMODULES="$PKGMODULES blkid"
 fi
 AC_SUBST([PKGMODULES])
 dnl ==========================================================================
@@ -681,9 +784,9 @@ AC_DEFUN([CS_ABSPATH], [
 ])
 
 dnl ==========================================================================
-CS_STR_WITH([plain-hash],   [password hashing function for plain mode], [ripemd160])
+CS_STR_WITH([plain-hash],   [password hashing function for plain mode], [sha256])
 CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
-CS_STR_WITH([plain-mode],   [cipher mode for plain mode], [cbc-essiv:sha256])
+CS_STR_WITH([plain-mode],   [cipher mode for plain mode], [xts-plain64])
 CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
 
 CS_STR_WITH([luks1-hash],   [hash function for LUKS1 header], [sha256])
@@ -720,8 +823,9 @@ CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096])
 CS_NUM_WITH([verity-salt-size],  [salt size for verity mode], [32])
 CS_NUM_WITH([verity-fec-roots],  [parity bytes for verity FEC], [2])
 
-CS_STR_WITH([tmpfilesdir], [override default path to directory with systemd temporary files], [])
-test -z "$with_tmpfilesdir" && with_tmpfilesdir=$systemd_tmpfilesdir
+AC_ARG_WITH([tmpfilesdir],
+	AS_HELP_STRING([--with-tmpfilesdir=DIR], [override default path to directory with systemd temporary files]),
+	[], [with_tmpfilesdir=$systemd_tmpfilesdir])
 test "x$with_tmpfilesdir" = "xno" || {
 	CS_ABSPATH([${with_tmpfilesdir}],[with-tmpfilesdir])
 	DEFAULT_TMPFILESDIR=$with_tmpfilesdir
@@ -740,7 +844,9 @@ test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700
 DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms
 AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS)
 
-CS_STR_WITH([luks2-external-tokens-path], [path to directory with LUKSv2 external token handlers (plugins)], [LIBDIR/cryptsetup])
+AC_ARG_WITH([luks2-external-tokens-path],
+	AS_HELP_STRING([--with-luks2-external-tokens-path=DIR], [path to directory with LUKSv2 external token handlers (plugins)]),
+	[], [with_luks2_external_tokens_path=""])
 if test -n "$with_luks2_external_tokens_path"; then
 	CS_ABSPATH([${with_luks2_external_tokens_path}],[with-luks2-external-tokens-path])
 	EXTERNAL_LUKS2_TOKENS_PATH=$with_luks2_external_tokens_path
@@ -748,6 +854,17 @@ else
 	EXTERNAL_LUKS2_TOKENS_PATH="\${libdir}/cryptsetup"
 fi
 AC_SUBST(EXTERNAL_LUKS2_TOKENS_PATH)
+dnl We need to define expanded EXTERNAL_LUKS2_TOKENS_PATH, but some other code can depend on prefix=NONE.
+dnl Pretend you do not see this hack :-)
+saved_prefix=$prefix
+saved_exec_prefix=$exec_prefix
+test "x$prefix" = "xNONE" && prefix="$ac_default_prefix"
+test "x$exec_prefix" = "xNONE" && exec_prefix="$prefix"
+expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$EXTERNAL_LUKS2_TOKENS_PATH")
+expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$expanded_EXTERNAL_LUKS2_TOKENS_PATH")
+AC_DEFINE_UNQUOTED([EXTERNAL_LUKS2_TOKENS_PATH], ["$expanded_EXTERNAL_LUKS2_TOKENS_PATH"], [path to directory with LUKSv2 external token handlers (plugins)])
+prefix=$saved_prefix
+exec_prefix=$saved_exec_prefix
 
 dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only).
 AC_ARG_WITH([default_luks_format],

docs/Keyring.txt

@@ -12,30 +12,53 @@ no longer stored directly in dm-crypt target. Starting with cryptsetup 2.0 we
 load VK in kernel keyring by default for LUKSv2 devices (when dm-crypt with the
 feature is available).
 
-Currently cryptsetup loads VK in 'logon' type kernel key so that VK is passed in
-the kernel and can't be read from userspace afterward. Also cryptsetup loads VK in
-thread keyring (before passing the reference to dm-crypt target) so that the key
+Currently, cryptsetup loads VK in 'logon' type kernel key so that VK is passed in
+the kernel and can't be read from userspace afterwards. Also, cryptsetup loads VK in
+the thread keyring (before passing the reference to dm-crypt target) so that the key
 lifetime is directly bound to the process that performs the dm-crypt setup. When
-cryptsetup process exits (for whatever reason) the key gets unlinked in kernel
+cryptsetup process exits (for whatever reason) the key gets unlinked in the kernel
 automatically. In summary, the key description visible in dm-crypt table line is
 a reference to VK that usually no longer exists in kernel keyring service if you
-used cryptsetup to for device activation.
+used cryptsetup for device activation.
 
 Using this feature dm-crypt no longer maintains a direct key copy (but there's
-always at least one copy in kernel crypto layer).
+always at least one copy in the kernel crypto layer).
+
+Additionally, libcryptsetup supports the linking of volume keys to
+user-specified kernel keyring with crypt_set_keyring_to_link(). The user may
+specify keyring name, key type ('user' or 'logon') and key description where
+libcryptsetup should link the verified volume key upon subsequent device
+activation (or key verification alone).
+
+The volume key(s) (provided the key type is 'user') linked in the user keyring
+can be later used to activate the device via crypt_activate_by_keyslot_context()
+with CRYPT_KC_TYPE_VK_KEYRING type keyslot context
+(acquired by crypt_keyslot_context_init_by_vk_in_keyring()).
+
+Example of how to use volume key linked in custom user keyring from cryptsetup
+utility:
+
+1) Open the device and store the volume key to the session keyring:
+# cryptsetup open <device> --link-vk-to-keyring "@s::%user:testkey" tst
+
+2) Add a keyslot using the stored volume key in a keyring:
+# cryptsetup luksAddKey <device> --volume-key-keyring "%user:testkey"
+
+3) Activate the device using the volume key cached in a keyring ('user' type key)
+# cryptsetup open <device> <active_name> --volume-key-keyring "testkey"
 
 II) Keyslot passphrase
 The second use case for kernel keyring is to allow cryptsetup reading the keyslot
-passphrase stored in kernel keyring instead. The user may load passphrase in kernel
+passphrase stored in kernel keyring instead. The user may load the passphrase in the kernel
 keyring and notify cryptsetup to read it from there later. Currently, cryptsetup
 cli supports kernel keyring for passphrase only via LUKS2 internal token
-(luks2-keyring). Library also provides a general method for device activation by
-reading passphrase from keyring: crypt_activate_by_keyring(). The key type
+(luks2-keyring). The library also provides a general method for device activation by
+reading the passphrase from the keyring: crypt_activate_by_keyring(). The key type
 for use case II) must always be 'user' since we need to read the actual key
-data from userspace unlike with VK in I). Ability to read keyslot passphrase
-from kernel keyring also allows easily auto-activate LUKS2 devices.
+data from userspace unlike with VK in I). The ability to read keyslot passphrases
+from kernel keyring also allows easy auto-activate LUKS2 devices.
 
-Simple example how to use kernel keyring for keyslot passphrase:
+Simple example of how to use kernel keyring for keyslot passphrase:
 
 1) create LUKS2 keyring token for keyslot 0 (in LUKS2 device/image)
 cryptsetup token add --key-description my:key -S 0 /dev/device
@@ -43,7 +66,7 @@ cryptsetup token add --key-description my:key -S 0 /dev/device
 2) Load keyslot passphrase in user keyring
 read -s -p "Keyslot passphrase: "; echo -n $REPLY | keyctl padd user my:key @u
 
-3) Activate device using passphrase stored in kernel keyring
+3) Activate the device using the passphrase stored in the kernel keyring
 cryptsetup open /dev/device my_unlocked_device
 
 4a) unlink the key when no longer needed by
@@ -52,5 +75,5 @@ keyctl unlink %user:my:key @u
 4b) or revoke it immediately by
 keyctl revoke %user:my:key
 
-If cryptsetup asks for passphrase in step 3) something went wrong with keyring
+If cryptsetup asks for a passphrase in step 3) something went wrong with keyring
 activation. See --debug output then.

docs/LUKS2-locking.txt

@@ -5,7 +5,7 @@ Why
 ~~~
 
 LUKS2 format keeps two identical copies of metadata stored consecutively
-at the head of metadata device (file or bdev). The metadata
+at the head of the metadata device (file or bdev). The metadata
 area (both copies) must be updated in a single atomic operation to avoid
 header corruption during concurrent write.
 
@@ -15,17 +15,17 @@ locking with legacy format was not so obvious as it is with the LUKSv2 format.
 
 With LUKS2 the boundary between read-only and read-write is blurry and what
 used to be the exclusively read-only operation (i.e., cryptsetup open command) may
-easily become read-update operation silently without user's knowledge.
-Major feature of LUKS2 format is resilience against accidental
+easily become read-update operation silently without the user's knowledge.
+A major feature of the LUKS2 format is resilience against accidental
 corruption of metadata (i.e., partial header overwrite by parted or cfdisk
-while creating partition on mistaken block device).
-Such header corruption is detected early on header read and auto-recovery
+while creating a partition on a mistaken block device).
+Such header corruption is detected early on the header read and the auto-recovery
 procedure takes place (the corrupted header with checksum mismatch is being
 replaced by the secondary one if that one is intact).
-On current Linux systems header load operation may be triggered without user
-direct intervention for example by udev rule or from systemd service.
-Such clash of header read and auto-recovery procedure could have severe
-consequences with the worst case of having LUKS2 device unaccessible or being
+On current Linux systems header load operation may be triggered without the user
+direct intervention for example by an udev rule or from a systemd service.
+Such a clash of header read and auto-recovery procedure could have severe
+consequences with the worst case of having a LUKS2 device inaccessible or being
 broken beyond repair.
 
 The whole locking of LUKSv2 device headers split into two categories depending
@@ -36,17 +36,17 @@ I) block device
 
 We perform flock() on file descriptors of files stored in a private
 directory (by default /run/lock/cryptsetup). The file name is derived
-from major:minor couple of affected block device. Note we recommend
-that access to private locking directory is supposed to be limited
-to superuser only. For this method to work the distribution needs
+from major:minor couple of the affected block device. Note we recommend
+that access to the private locking directory is supposed to be limited
+to the superuser only. For this method to work the distribution needs
 to install the locking directory with appropriate access rights.
 
 II) regular files
 ~~~~~~~~~~~~~~~~~
 
-First notable difference between headers stored in a file
+A first notable difference between headers stored in a file
 vs. headers stored in a block device is that headers in a file may be
-manipulated by the regular user unlike headers on block devices. Therefore
+manipulated by the regular user, unlike headers on block devices. Therefore
 we perform flock() protection on file with the luks2 header directly.
 
 Limitations
@@ -58,4 +58,40 @@ while locking is enabled.
 We do not suppress any other negative effect that two or more concurrent
 writers of the same header may cause.
 
-b) The locking is not cluster aware in any way.
+b) The locking is not cluster-aware in any way.
+
+Additional LUKS2 locks
+======================
+
+LUKS2 reencryption device lock
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Device in LUKS2 reencryption is protected by an exclusive lock placed in the default
+locking directory. The lock's purpose is to exclude multiple processes from
+performing reencryption on the same device (identified by LUKS uuid). The lock
+is taken no matter the LUKS2 reencryption mode (online or offline).
+
+LUKS2 memory hard global lock
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+An optional global lock that makes libcryptsetup serialize memory hard
+pbkdf function when deriving a key encryption key from passphrase on unlocking
+LUKS2 keyslot. The lock has to be enabled via the CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF
+flag. The lock is placed in the default locking directory.
+
+LUKS2 OPAL lock
+~~~~~~~~~~~~~~~
+
+Exclusive per device lock taken when manipulating LUKS2 device configured for use with
+SED OPAL2 locking range.
+
+Lock ordering
+=============
+
+To avoid a deadlock following rules must apply:
+
+- LUKS2 reencrytpion lock must be taken before LUKS2 OPAL lock.
+
+- LUKS2 OPAL lock must be taken before LUKS2 metadata lock.
+
+- LUKS2 memory hard global lock can not be used with other locks.

docs/doxyfile

@@ -1,4 +1,4 @@
-# Doxyfile 1.9.1
+# Doxyfile 1.9.8
 
 #---------------------------------------------------------------------------
 # Project related configuration options
@@ -10,9 +10,9 @@ PROJECT_BRIEF          = "Public cryptsetup API"
 PROJECT_LOGO           =
 OUTPUT_DIRECTORY       = doxygen_api_docs
 CREATE_SUBDIRS         = NO
+CREATE_SUBDIRS_LEVEL   = 8
 ALLOW_UNICODE_NAMES    = NO
 OUTPUT_LANGUAGE        = English
-OUTPUT_TEXT_DIRECTION  = None
 BRIEF_MEMBER_DESC      = YES
 REPEAT_BRIEF           = YES
 ABBREVIATE_BRIEF       =
@@ -39,6 +39,7 @@ OPTIMIZE_OUTPUT_SLICE  = NO
 EXTENSION_MAPPING      =
 MARKDOWN_SUPPORT       = YES
 TOC_INCLUDE_HEADINGS   = 5
+MARKDOWN_ID_STYLE      = DOXYGEN
 AUTOLINK_SUPPORT       = YES
 BUILTIN_STL_SUPPORT    = NO
 CPP_CLI_SUPPORT        = NO
@@ -52,6 +53,7 @@ INLINE_SIMPLE_STRUCTS  = NO
 TYPEDEF_HIDES_STRUCT   = YES
 LOOKUP_CACHE_SIZE      = 0
 NUM_PROC_THREADS       = 1
+TIMESTAMP              = NO
 #---------------------------------------------------------------------------
 # Build related configuration options
 #---------------------------------------------------------------------------
@@ -72,6 +74,7 @@ INTERNAL_DOCS          = NO
 CASE_SENSE_NAMES       = YES
 HIDE_SCOPE_NAMES       = NO
 HIDE_COMPOUND_REFERENCE= NO
+SHOW_HEADERFILE        = YES
 SHOW_INCLUDE_FILES     = YES
 SHOW_GROUPED_MEMB_INC  = NO
 FORCE_LOCAL_INCLUDES   = NO
@@ -101,9 +104,12 @@ QUIET                  = NO
 WARNINGS               = YES
 WARN_IF_UNDOCUMENTED   = YES
 WARN_IF_DOC_ERROR      = YES
+WARN_IF_INCOMPLETE_DOC = YES
 WARN_NO_PARAMDOC       = NO
+WARN_IF_UNDOC_ENUM_VAL = NO
 WARN_AS_ERROR          = NO
 WARN_FORMAT            = "$file:$line: $text"
+WARN_LINE_FORMAT       = "at line $line of file $file"
 WARN_LOGFILE           =
 #---------------------------------------------------------------------------
 # Configuration options related to the input files
@@ -111,6 +117,7 @@ WARN_LOGFILE           =
 INPUT                  = doxygen_index.h \
                          ../lib/libcryptsetup.h
 INPUT_ENCODING         = UTF-8
+INPUT_FILE_ENCODING    =
 FILE_PATTERNS          =
 RECURSIVE              = NO
 EXCLUDE                =
@@ -126,6 +133,7 @@ FILTER_PATTERNS        =
 FILTER_SOURCE_FILES    = NO
 FILTER_SOURCE_PATTERNS =
 USE_MDFILE_AS_MAINPAGE =
+FORTRAN_COMMENT_AFTER  = 72
 #---------------------------------------------------------------------------
 # Configuration options related to source browsing
 #---------------------------------------------------------------------------
@@ -158,15 +166,17 @@ HTML_FOOTER            =
 HTML_STYLESHEET        =
 HTML_EXTRA_STYLESHEET  =
 HTML_EXTRA_FILES       =
+HTML_COLORSTYLE        = AUTO_LIGHT
 HTML_COLORSTYLE_HUE    = 220
 HTML_COLORSTYLE_SAT    = 100
 HTML_COLORSTYLE_GAMMA  = 80
-HTML_TIMESTAMP         = YES
 HTML_DYNAMIC_MENUS     = YES
 HTML_DYNAMIC_SECTIONS  = NO
+HTML_CODE_FOLDING      = YES
 HTML_INDEX_NUM_ENTRIES = 100
 GENERATE_DOCSET        = NO
 DOCSET_FEEDNAME        = "Doxygen generated docs"
+DOCSET_FEEDURL         =
 DOCSET_BUNDLE_ID       = org.doxygen.Project
 DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
 DOCSET_PUBLISHER_NAME  = Publisher
@@ -177,6 +187,7 @@ GENERATE_CHI           = NO
 CHM_INDEX_ENCODING     =
 BINARY_TOC             = NO
 TOC_EXPAND             = NO
+SITEMAP_URL            =
 GENERATE_QHP           = NO
 QCH_FILE               =
 QHP_NAMESPACE          = org.doxygen.Project
@@ -189,14 +200,16 @@ GENERATE_ECLIPSEHELP   = NO
 ECLIPSE_DOC_ID         = org.doxygen.Project
 DISABLE_INDEX          = NO
 GENERATE_TREEVIEW      = NO
+FULL_SIDEBAR           = NO
 ENUM_VALUES_PER_LINE   = 4
 TREEVIEW_WIDTH         = 250
 EXT_LINKS_IN_WINDOW    = NO
+OBFUSCATE_EMAILS       = YES
 HTML_FORMULA_FORMAT    = png
 FORMULA_FONTSIZE       = 10
-FORMULA_TRANSPARENT    = YES
 FORMULA_MACROFILE      =
 USE_MATHJAX            = NO
+MATHJAX_VERSION        = MathJax_2
 MATHJAX_FORMAT         = HTML-CSS
 MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
 MATHJAX_EXTENSIONS     =
@@ -227,9 +240,7 @@ PDF_HYPERLINKS         = YES
 USE_PDFLATEX           = YES
 LATEX_BATCHMODE        = NO
 LATEX_HIDE_INDICES     = NO
-LATEX_SOURCE_CODE      = NO
 LATEX_BIB_STYLE        = plain
-LATEX_TIMESTAMP        = NO
 LATEX_EMOJI_DIRECTORY  =
 #---------------------------------------------------------------------------
 # Configuration options related to the RTF output
@@ -240,7 +251,6 @@ COMPACT_RTF            = NO
 RTF_HYPERLINKS         = NO
 RTF_STYLESHEET_FILE    =
 RTF_EXTENSIONS_FILE    =
-RTF_SOURCE_CODE        = NO
 #---------------------------------------------------------------------------
 # Configuration options related to the man page output
 #---------------------------------------------------------------------------
@@ -261,12 +271,17 @@ XML_NS_MEMB_FILE_SCOPE = NO
 #---------------------------------------------------------------------------
 GENERATE_DOCBOOK       = NO
 DOCBOOK_OUTPUT         = docbook
-DOCBOOK_PROGRAMLISTING = NO
 #---------------------------------------------------------------------------
 # Configuration options for the AutoGen Definitions output
 #---------------------------------------------------------------------------
 GENERATE_AUTOGEN_DEF   = NO
 #---------------------------------------------------------------------------
+# Configuration options related to Sqlite3 output
+#---------------------------------------------------------------------------
+GENERATE_SQLITE3       = NO
+SQLITE3_OUTPUT         = sqlite3
+SQLITE3_RECREATE_DB    = YES
+#---------------------------------------------------------------------------
 # Configuration options related to the Perl module output
 #---------------------------------------------------------------------------
 GENERATE_PERLMOD       = NO
@@ -294,15 +309,14 @@ ALLEXTERNALS           = NO
 EXTERNAL_GROUPS        = YES
 EXTERNAL_PAGES         = YES
 #---------------------------------------------------------------------------
-# Configuration options related to the dot tool
+# Configuration options related to diagram generator tools
 #---------------------------------------------------------------------------
-CLASS_DIAGRAMS         = YES
-DIA_PATH               =
 HIDE_UNDOC_RELATIONS   = YES
 HAVE_DOT               = NO
 DOT_NUM_THREADS        = 0
-DOT_FONTNAME           = Helvetica
-DOT_FONTSIZE           = 10
+DOT_COMMON_ATTR        = "fontname=Helvetica,fontsize=10"
+DOT_EDGE_ATTR          = "labelfontname=Helvetica,labelfontsize=10"
+DOT_NODE_ATTR          = "shape=box,height=0.2,width=0.4"
 DOT_FONTPATH           =
 CLASS_GRAPH            = YES
 COLLABORATION_GRAPH    = YES
@@ -318,18 +332,20 @@ CALL_GRAPH             = NO
 CALLER_GRAPH           = NO
 GRAPHICAL_HIERARCHY    = YES
 DIRECTORY_GRAPH        = YES
+DIR_GRAPH_MAX_DEPTH    = 1
 DOT_IMAGE_FORMAT       = png
 INTERACTIVE_SVG        = NO
 DOT_PATH               =
 DOTFILE_DIRS           =
-MSCFILE_DIRS           =
+DIA_PATH               =
 DIAFILE_DIRS           =
 PLANTUML_JAR_PATH      =
 PLANTUML_CFG_FILE      =
 PLANTUML_INCLUDE_PATH  =
 DOT_GRAPH_MAX_NODES    = 50
 MAX_DOT_GRAPH_DEPTH    = 0
-DOT_TRANSPARENT        = NO
 DOT_MULTI_TARGETS      = NO
 GENERATE_LEGEND        = YES
 DOT_CLEANUP            = YES
+MSCGEN_TOOL            =
+MSCFILE_DIRS           =

docs/examples/crypt_log_usage.c

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * libcryptsetup API log example
  *
- * Copyright (C) 2011-2023 Red Hat, Inc. All rights reserved.
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
  */
 
 #include <stdio.h>

docs/examples/crypt_luks_usage.c

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  *  libcryptsetup API - using LUKS device example
  *
- * Copyright (C) 2011-2023 Red Hat, Inc. All rights reserved.
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
  */
 
 #include <stdio.h>

docs/licenses/COPYING.Apache-2.0

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

docs/licenses/COPYING.CC-BY-SA-4.0

@@ -0,0 +1,428 @@
+Attribution-ShareAlike 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+    wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More considerations
+     for the public:
+    wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution-ShareAlike 4.0 International Public
+License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-ShareAlike 4.0 International Public License ("Public
+License"). To the extent this Public License may be interpreted as a
+contract, You are granted the Licensed Rights in consideration of Your
+acceptance of these terms and conditions, and the Licensor grants You
+such rights in consideration of benefits the Licensor receives from
+making the Licensed Material available under these terms and
+conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  l. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  m. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+     including for purposes of Section 3(b); and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the “Licensor.” The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.
+

docs/licenses/COPYING.GPL-2.0-or-later-WITH-cryptsetup-OpenSSL-exception

@@ -0,0 +1,354 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
+
+-----
+In addition, as a special exception, the copyright holders give
+permission to link the code of portions of this program with the
+OpenSSL library under certain conditions as described in each
+individual source file, and distribute linked combinations
+including the two.
+
+You must obey the GNU General Public License in all respects
+for all of the code used other than OpenSSL.  If you modify
+file(s) with this exception, you may extend this exception to your
+version of the file(s), but you are not obligated to do so.  If you
+do not wish to do so, delete this exception statement from your
+version.  If you delete this exception statement from all source
+files in the program, then also delete it here.

docs/v2.7.0-ReleaseNotes

@@ -0,0 +1,437 @@
+Cryptsetup 2.7.0 Release Notes
+==============================
+Stable release with new features and bug fixes.
+
+Changes since version 2.6.1
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Introduce support for hardware OPAL disk encryption.
+
+  Some SATA and NVMe devices support hardware encryption through OPAL2
+  TCG interface (SEDs - self-encrypting drives). Using hardware disk
+  encryption is controversial as you must trust proprietary hardware.
+
+  On the other side, using both software and hardware encryption
+  layers increases the security margin by adding an additional layer
+  of protection. There is usually no performance drop if OPAL encryption
+  is used (the drive always operates with full throughput), and it does
+  not add any utilization to the main CPU.
+
+  LUKS2 now supports hardware encryption through the Linux kernel
+  SED OPAL interface (CONFIG_BLK_SED_OPAL Linux kernel option must be
+  enabled). Cryptsetup OPAL is never enabled by default; you have to use
+  luksFormat parameters to use it. OPAL support can be disabled during
+  the build phase with --disable-hw-opal configure option.
+
+  LUKS2 OPAL encryption is configured the same way as software encryption
+  - it stores metadata in the LUKS2 header and activates encryption for
+  the data area on the disk (configured OPAL locking range).
+  LUKS2 header metadata must always be visible (thus not encrypted).
+  The key stored in LUKS2 keyslots contains two parts - volume key
+  for software (dm-crypt) encryption and unlocking key for OPAL.
+  OPAL unlocking key is independent of the dm-crypt volume key and is
+  always 256 bits long. Cryptsetup does not support full drive OPAL
+  encryption; only a specific locking range is always used.
+
+  If the OPAL device is in its initial factory state (after factory
+  reset), cryptsetup needs to configure the OPAL admin user and password.
+  If the OPAL admin user is already set, the OPAL password must be
+  provided during luksFormat.
+  The provided password is needed only to configure or reset the OPAL
+  locking range; LUKS device activation requires LUKS passphrase only.
+  LUKS passphrase should be different from OPAL password (OPAL admin user
+  is configured inside OPAL hardware while LUKS unlocking passphrase
+  unlocks LUKS keyslot).
+
+  OPAL encryption can be used in combination with software (dm-crypt)
+  encryption (--hw-opal option) or without the software layer
+  (--hw-opal-only option).
+  You can see the configured segment parameters in the luksDump command.
+  LUKS2 devices with OPAL segments set a new requirement flag in
+  the LUKS2 header to prevent older cryptsetup metadata manipulation.
+  Do not use hardware-only encryption if you do not fully trust your
+  hardware vendor.
+
+  Compatibility notes:
+    - Linux kernel SED interface does NOT work through USB external
+    adapters due to the missing compatibility layer in Linux USB storage
+    drivers (even if USB hardware itself can support OPAL commands).
+    - other TCG security subsystems like Ruby or Pyrite are not
+    supported. Note that many drives support only Pyrite subsystem that
+    does NOT encrypt data (it provides only authentication).
+    - compatibility among OPAL-enabled drives is often very problematic,
+    specifically for older drives. Many drives have bugs in the firmware
+    that make the Linux kernel interface unusable.
+    - if you forget the OPAL admin password, the only way to recover is
+    the full drive factory reset through the PSID key (usually printed
+    on the drive itself) that wipes all data on the drive (not only the
+    LUKS area).
+    - cryptsetup reencryption is not supported for LUKS2 OPAL-enabled
+    devices
+    - most OPAL drives use AES-XTS cipher mode (older drives can use
+    AES-CBC). This information is not available through kernel SED API.
+    - locked OPAL locking ranges return IO errors while reading; this
+    can produce a lot of scary messages in the log if some tools (like
+    blkid) try to read the locked area.
+
+  Examples:
+
+  * Formatting the drive
+  Use --hw-opal with luksFormat (or --hw-opal-only for hardware only
+  encryption):
+
+  # cryptsetup luksFormat --hw-opal <device>
+  Enter passphrase for <device>: ***
+  Enter OPAL Admin password: ***
+
+  * Check configuration with luksDump.
+  Note "hw-opal-crypt" segment that uses both dm-crypt and OPAL
+  encryption - keyslot stores 768 bits key (512 sw + 256 bits OPAL key).
+
+  # cryptsetup luksDump <device>
+    LUKS header information
+    Version:        2
+    ...
+    Data segments:
+       0: hw-opal-crypt
+         offset: 16777216 [bytes]
+         length: ... [bytes]
+         cipher: aes-xts-plain64
+         sector: 512 [bytes]
+         HW OPAL encryption:
+                OPAL segment number: 1
+                OPAL key: 256 bits
+                OPAL segment length: ... [bytes]
+     Keyslots:
+       0: luks2
+         Key:        768 bits
+      ...
+
+  For devices with OPAL encryption ONLY (only 256 bits OPAL unlocking
+  key is stored):
+     LUKS header information
+     Version:        2
+     ...
+
+     Data segments:
+        0: hw-opal
+          offset: 16777216 [bytes]
+          length: ... [bytes]
+          cipher: (no SW encryption)
+          HW OPAL encryption:
+                OPAL segment number: 1
+                OPAL key: 256 bits
+                OPAL segment length: ... [bytes]
+     Keyslots:
+       0: luks2
+         Key:        256 bits
+         ...
+
+  * Activation and deactivation (open, close, luksSuspend, luksResume)
+  with OPAL works the same as for the LUKS2 device.
+
+  * Erase LUKS metadata (keyslots) and remove OPAL locking range:
+  # cryptsetup luksErase <device>
+    Enter OPAL Admin password: ***
+
+  The LUKS header is destroyed (unlike in normal LUKS luksErase) as
+  data are no longer accessible even with previous volume key knowledge.
+
+  * Factory reset OPAL drive (if you do not know the Admin password).
+    You need the PSID (physical presence security ID), which is usually
+    printed on the device label. Note this will reset the device to
+    factory state, erasing all data on it (not only LUKS).
+
+  # cryptsetup luksErase --hw-opal-factory-reset <device>
+    Enter OPAL PSID: ***
+
+* plain mode: Set default cipher to aes-xts-plain64 and password hashing
+  to sha256.
+
+  NOTE: this is a backward incompatible change for plain mode (if you
+  rely on defaults). It is not relevant for LUKS devices.
+
+  The default plain encryption mode was CBC for a long time, with many
+  performance problems. Using XTS mode aligns it with LUKS defaults.
+
+  The hash algorithm for plain mode was ripemd160, which is considered
+  deprecated, so the new default is sha256.
+
+  The default key size remains 256 bits (it means using AES-128 as XTS
+  requires two keys).
+
+  Always specify cipher, hash, and key size for plain mode (or even
+  better, use LUKS as it stores all options in its metadata on disk).
+  As we need to upgrade algorithms from time to time because of security
+  reasons, cryptsetup now warns users to specify these options explicitly
+  in the open cryptsetup command if plain mode is used.
+  Cryptsetup does not block using any legacy encryption type; just it
+  must be specified explicitly on the cryptsetup command line.
+
+  You can configure these defaults during build time if you need to
+  enforce backward compatibility.
+  To get the backward-compatible setting, use:
+    --with-plain-hash=ripemd160 --with-plain-cipher=aes
+    --with-plain-mode=cbc-essiv:sha256
+
+  Compiled-in defaults are visible in cryptsetup --help output.
+
+* Allow activation (open), luksResume, and luksAddKey to use the volume
+  key stored in a keyring.
+* Allow to store volume key to a user-specified keyring in open and
+  luksResume commands.
+
+  These options are intended to be used for integration with other
+  systems for automation.
+
+  Users can now use the volume key (not passphrase) stored in arbitrary
+  kernel keyring and directly use it in particular cryptsetup commands
+  with --volume-key-keyring option. The keyring can use various policies
+  (set outside of the cryptsetup scope, for example, by keyctl).
+
+  The --volume-key-keyring option takes a key description in
+  keyctl-compatible syntax and can either be a numeric key ID or
+  a string name in the format [%<key type>:]<key name>.
+  The default key type is "user".
+
+  To store the volume key in a keyring, you can use cryptsetup with
+  --link-vk-to-keyring option that is available for open and luksResume
+  cryptsetup command. The option argument has a more complex format:
+  <keyring_description>::<key_description>.
+  The <keyring_description> contains the existing kernel keyring
+  description (numeric id or keyctl format). The <keyring_description>
+  may be optionally prefixed with "%:" or "%keyring:". The string "::" is
+  a delimiter that separates keyring and key descriptions.
+  The <key_description> has the same syntax as used in the
+  --volume-key-keyring option.
+
+  Example:
+
+  Open the device and store the volume key to the keyring:
+  # cryptsetup open <device> --link-vk-to-keyring "@s::%user:testkey" tst
+
+  Add keyslot using the stored key in a keyring:
+  # cryptsetup luksAddKey <device> --volume-key-keyring "%user:testkey"
+
+* Do not flush IO operations if resize grows the device.
+  This can help performance in specific cases where the encrypted device
+  is extended automatically while running many IO operations.
+
+* Use only half of detected free memory for Argon2 PBKDF on systems
+  without swap (for LUKS2 new keyslot or format operations).
+
+  This should avoid out-of-memory crashes on low-memory systems without
+  swap. The benchmark for memory-hard KDF during format is tricky, and
+  it seems that relying on the maximum half of physical memory is not
+  enough; relying on free memory should bring the needed security margin
+  while still using Argon2.
+  There is no change for systems with active swap.
+  Note, for very-low memory-constrained systems, a user should avoid
+  memory-hard PBKDF completely (manually select legacy PBKDF2 instead
+  of Argon2); cryptsetup does not change PBKDF automatically.
+
+* Add the possibility to specify a directory for external LUKS2 token
+  handlers (plugins).
+
+  Use --external-tokens-path parameter in cryptsetup or
+  crypt_token_set_external_path API call. The parameter is required to be
+  an absolute path, and it is set per process context. This parameter is
+  intended mainly for testing and developing new tokens.
+
+* Do not allow reencryption/decryption on LUKS2 devices with
+  authenticated encryption or hardware (OPAL) encryption.
+
+  The operation fails later anyway; cryptsetup now detects incompatible
+  parameters early.
+
+* Do not fail LUKS format if the operation was interrupted on subsequent
+  device wipe.
+
+  Device wipe (used with authenticated encryption) is an optional
+  operation and can be interrupted; not yet wiped part of the device will
+  only report integrity errors (until overwritten with new data).
+
+* Fix the LUKS2 keyslot option to be used while activating the device
+  by a token.
+
+  It can also be used to check if a specific token (--token-id) can
+  unlock a specific keyslot (--key-slot option) when --test-passphrase
+  option is specified.
+
+* Properly report if the dm-verity device cannot be activated due to
+  the inability to verify the signed root hash (ENOKEY).
+
+* Fix to check passphrase for selected keyslot only when adding
+  new keyslot.
+
+  If the user specifies the exact keyslot to unlock, cryptsetup no longer
+  checks other keyslots.
+
+* Fix to not wipe the keyslot area before in-place overwrite.
+
+  If the LUKS2 keyslot area has to be overwritten (due to lack of free
+  space for keyslot swap), cryptsetup does not wipe the affected area as
+  the first step (it will be overwritten later anyway).
+  Previously, there was an unnecessary risk of losing the keyslot data
+  if the code crashed before adding the new keyslot.
+
+  If there is enough space in the keyslot area, cryptsetup never
+  overwrites the older keyslot before the new one is written correctly
+  (even if the keyslot number remains the same).
+
+* bitlk: Fix segfaults when attempting to verify the volume key.
+
+  Also, clarify that verifying the volume key is impossible without
+  providing a passphrase or recovery key.
+
+* Add --disable-blkid command line option to avoid blkid device check.
+
+* Add support for the meson build system.
+
+  All basic operations are supported (compile, test, and dist) with some
+  minor exceptions; please see the meson manual for more info.
+
+  The Meson build system will completely replace autotools in some future
+  major release. Both autotools and meson build systems are supported,
+  and the release archive is built with autotools.
+
+* Fix wipe operation that overwrites the whole device if used for LUKS2
+  header with no keyslot area.
+
+  Formatting a LUKS2 device with no defined keyslots area is a very
+  specific operation, and the code now properly recognizes such
+  configuration.
+
+* Fix luksErase to work with detached LUKS header.
+
+* Disallow the use of internal kernel crypto driver names in "capi"
+  specification.
+
+  The common way to specify cipher mode in cryptsetup is to use
+  cipher-mode-iv notation (like aes-xts-plain64).
+  With the introduction of authenticated ciphers, we also allow
+  "capi:<spec>" notation that is directly used by dm-crypt
+  (e.g., capi:xts(aes)-plain64).
+
+  CAPI specification was never intended to be used directly in the LUKS
+  header; unfortunately, the code allowed it until now.
+  Devices with CAPI specification in metadata can no longer be activated;
+  header repair is required.
+
+  CAPI specification could allow attackers to change the cipher
+  specification to enforce loading some specific kernel crypto driver
+  (for example, load driver with known side-channel issues).
+  This can be problematic, specifically in a cloud environment
+  (modifying LUKS2 metadata in container image).
+
+  Thanks to Jan Wichelmann, Luca Wilke, and Thomas Eisenbarth from
+  University of Luebeck for noticing the problems with this code.
+
+* Fix reencryption to fail early for unknown cipher.
+
+* tcrypt: Support new Blake2 hash for VeraCrypt.
+
+  VeraCrypt introduces support for Blake2 PRF for PBKDF2; also support it
+  in cryptsetup compatible tcrypt format.
+
+* tcrypt: use hash values as substring for limiting KDF check.
+
+  This allows the user to specify --hash sha or --hash blake2 to limit
+  the KDF scan without the need to specify the full algorithm name
+  (similar to cipher where we already use substring match).
+
+* Add Aria cipher support and block size info.
+
+  Aria cipher is similar to AES and is supported in Linux kernel crypto
+  API in recent releases.
+  It can be now used also for LUKS keyslot encryption.
+
+* Do not decrease PBKDF parameters if the user forces them.
+
+  If a user explicitly specifies PBKDF parameters (like iterations,
+  used memory, or threads), do not limit them, even if it can cause
+  resource exhaustion.
+  The force options were mostly used for decreasing parameters, but it
+  should work even opposite - despite the fact it can mean an
+  out-of-memory crash.
+
+  The only limits are hard limits per the PBKDF algorithm.
+
+* Support OpenSSL 3.2 Argon2 implementation.
+
+  Argon2 is now available directly in OpenSSL, so the code no longer
+  needs to use libargon implementation.
+  Configure script should detect this automatically.
+
+* Add support for Argon2 from libgcrypt
+  (requires yet unreleased gcrypt 1.11).
+
+  Argon2 has been available since version 1.10, but we need version 1.11,
+  which will allow empty passwords.
+
+* Used Argon2 PBKDF implementation is now reported in debug mode
+  in the cryptographic backend version. For native support in
+  OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
+  If libargon2 is used, "cryptsetup libargon2" (for embedded
+  library) or "external libargon2" is displayed.
+
+* Link only libcrypto from OpenSSL.
+
+  This reduces dependencies as other OpenSSL libraries are not needed.
+
+* Disable reencryption for Direct-Access (DAX) devices.
+
+  Linux kernel device-mapper cannot stack DAX/non-DAX devices in
+  the mapping table, so online reencryption cannot work. Detect DAX
+  devices and warn users during LUKS format. Also, DAX or persistent
+  memory devices do not provide atomic sector updates; any single
+  modification can corrupt the whole encryption block.
+
+* Print a warning message if the device is not aligned to sector size.
+
+  If a partition is resized after format, activation could fail when
+  the device is not multiple of a sector size. Print at least a warning
+  here, as the activation error message is visible only in kernel syslog.
+
+* Fix sector size and integrity fields display for non-LUKS2 crypt
+  devices for the status command.
+
+* Fix suspend for LUKS2 with authenticated encryption (also suspend
+  dm-integrity device underneath).
+
+  This should stop the dm-integrity device from issuing journal updates
+  and possibly corrupt data if the user also tries to modify the
+  underlying device.
+
+* Update keyring and locking documentation and LUKS2 specification
+  for OPAL2 support.
+
+Libcryptsetup API extensions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The libcryptsetup API is backward compatible for all existing symbols.
+
+New symbols:
+  crypt_activate_by_keyslot_context
+  crypt_format_luks2_opal
+  crypt_get_hw_encryption_type
+  crypt_get_hw_encryption_key_size
+  crypt_keyslot_context_init_by_keyring
+  crypt_keyslot_context_init_by_vk_in_keyring
+  crypt_keyslot_context_init_by_signed_key
+  crypt_resume_by_keyslot_context
+  crypt_token_set_external_path
+  crypt_set_keyring_to_link
+  crypt_wipe_hw_opal
+
+New defines (hw encryption status):
+  CRYPT_SW_ONLY
+  CRYPT_OPAL_HW_ONLY
+  CRYPT_SW_AND_OPAL_HW
+
+New keyslot context types:
+  CRYPT_KC_TYPE_KEYRING
+  CRYPT_KC_TYPE_VK_KEYRING
+  CRYPT_KC_TYPE_SIGNED_KEY
+
+New requirement flag:
+  CRYPT_REQUIREMENT_OPAL

docs/v2.7.1-ReleaseNotes

@@ -0,0 +1,30 @@
+Cryptsetup 2.7.1 Release Notes
+==============================
+Stable bug-fix release with minor extensions.
+
+All users of cryptsetup 2.7.0 should upgrade to this version.
+
+Changes since version 2.7.0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Fix interrupted LUKS1 decryption resume.
+  With the replacement of the cryptsetup-reencrypt tool by the cryptsetup
+  reencrypt command, resuming the interrupted LUKS1 decryption operation
+  could fail. LUKS2 was not affected.
+
+* Allow --link-vk-to-keyring with --test-passphrase option.
+  This option allows uploading the volume key in a user-specified kernel
+  keyring without activating the device.
+
+* Fix crash when --active-name was used in decryption initialization.
+
+* Updates and changes to man pages, including indentation, sorting options
+  alphabetically, fixing mistakes in crypt_set_keyring_to_link, and fixing
+  some typos.
+
+* Fix compilation with libargon2 when --disable-internal-argon2 was used.
+
+* Do not require installed argon2.h header and never compile internal
+  libargon2 code if the crypto library directly supports Argon2.
+
+* Fixes to regression tests to support older Linux distributions.

docs/v2.7.2-ReleaseNotes

@@ -0,0 +1,31 @@
+Cryptsetup 2.7.2 Release Notes
+==============================
+Stable bug-fix release.
+
+All users of cryptsetup 2.7 should upgrade to this version.
+
+Changes since version 2.7.1
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+* Fix activation of OPAL-only encrypted LUKS device with tokens.
+  The issue was caused by an invalid volume key check (assert)
+  that is impossible without software encryption.
+
+* Fix formatting of OPAL devices with 4096-byte sector size.
+
+* Fix incorrect OPAL locking range alignment calculation if used
+  over an unaligned device partition.
+
+* Add --hw-opal-factory-reset option description to the manual page.
+
+* Do not check the passphrase quality for OPAL Admin PIN,
+  as this passphrase already exists.
+
+* Update license for FAQ document to CC BY-SA 4.0.
+
+NOTE: Please note that with OPAL-only (--hw-opal-only) encryption,
+the configured OPAL administrator PIN (passphrase) allows unlocking
+all configured locking ranges without LUKS keyslot decryption
+(without knowledge of LUKS passphrase).
+Because of many observed problems with compatibility, cryptsetup
+currently DOES NOT use OPAL single-user mode, which would allow such
+decoupling of OPAL admin PIN access.

docs/v2.7.3-ReleaseNotes

@@ -0,0 +1,114 @@
+Cryptsetup 2.7.3 Release Notes
+==============================
+Stable bug-fix release with security fixes.
+
+All users of cryptsetup 2.7 must upgrade to this version.
+
+Changes since version 2.7.2
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Do not allow formatting LUKS2 with Opal SED (hardware encryption)
+  if the reported logical sector size for the block device and Opal
+  encryption logical block differs.
+
+  Such a configuration can lead to a partially encrypted Opal locking
+  range or data destruction following the expected locking range.
+
+  Some NVMe drives support multiple LBAF profiles (typically supporting
+  512-byte and 4096-byte sector size). Some broken Opal NVMe firmware can
+  report bogus encryption size that disagrees with real used sector size.
+  This usually happens after low-level NVMe reformatting (LBAF profile
+  change with nvme utility) to different sector size.
+  Moreover, some firmware versions do not properly reset this even after
+  explicit PSID revert.
+
+  Cryptsetup calculates the Opal locking range using the reported block
+  size in Opal geometry ioctl.  Unfortunately, the broken firmware drive
+  internally uses the logical block size of the block device, which can
+  differ. This can lead to two possible situations:
+
+  - Opal reports a smaller block size (512-byte) while the drive uses
+  a 4096-byte sector. The configured locking range is then much larger,
+  destroying data following the expected locking range setting.
+
+  - Opal reports a larger block size (4096-byte) while the drive uses
+  a 512-byte sector. The configured locking range is then much smaller,
+  leaving the remaining space in the locking range unencrypted (violating
+  the confidentiality of data).
+
+  Cryptsetup now detects this discrepancy and disallows LUKS2 format with
+  Opal hardware encryption in such a case.
+
+  For already formatted devices, you will see this warning:
+    "Bogus OPAL logical block size differs from device block size."
+
+  If you also used software encryption (dm-crypt over Opal), data will
+  still be fully encrypted with software dm-crypt.
+  With hw-only encryption,  your configuration is probably already broken
+  (insecure or accessing data beyond the assigned area).
+
+  Note that this is caused by bad firmware (seen with multiple vendors),
+  and the problem was reported, at least for drives we have access to.
+
+* Fixes to wiping LUKS2 headers after Opal locking area erase.
+
+  As the hardware locking range is destroyed (cryptsetup erase command),
+  the LUKS2 header is no longer usable and was partially wiped.
+  Now the code fully wipes also the secondary header, as the previous
+  code wiped only the primary LUKS area.
+
+  Note that this is an exception, as the normal erase command wipes only
+  the keyslots, keeping the LUKS2 header in place.  With Opal encryption,
+  the data segment is no longer valid, so the whole LUKS2 header is no
+  longer usable.
+
+* Mention the need for possible PSID revert before Opal format for some
+  drives (man page).
+
+* Fix Bitlocker-compatible code to ignore newly seen metadata entries.
+
+  Recent Windows OS versions started to include new (undocumented)
+  metadata entries in Bitlocker. These entries are now quietly ignored,
+  allowing Bitlocker images to open with cryptsetup again.
+
+* Fix interactive query retry if LUKS2 unbound keyslot is present.
+
+  If an unbound keyslot is present, the password query retry count is
+  now properly applied.
+
+* Detect unsupported zoned devices for LUKS header devices.
+
+  Zoned devices cannot be written with direct-io and used for LUKS header
+  logic in general. Code now rejects placing the LUKS header on a zoned
+  device, while you can still create a detached header and use a zoned
+  device for encrypted data.
+
+* Allow "capi" cipher format for benchmark command and fix parsing
+  of plain IV in "capi" format.
+
+  Some ciphers can be specified only in Linux kernel crypto notation
+  (in short, "capi"). Code now allows this format also for benchmark,
+  for example, "benchmark -c capi:xts\(aes\)-plain64"
+  (that is equivalent to -c aes-xts-plain64).
+
+* Add support for HCTR2 encryption mode.
+
+  The HCTR2 encryption mode was added to the Linux kernel for fscrypt,
+  but as it is a length-preserving mode (with sector tweak), it can be
+  easily used for disk encryption, too.
+  The mode has the same property as wide modes (any change is propagated
+  to the whole sector instead of only one block as in XTS mode).
+
+  As it needs a larger initialization vector (32 bytes), we need to add
+  an exception in the userspace format code.
+  You can now use --cipher aes-hctr2-plain64 for the format operation.
+
+* Source code now uses SPDX license identifiers instead of full
+  license preambles.
+
+* Fix missing includes for cryptographic backend that could cause
+  compilation errors for some systems.
+
+* Fix tests to work correctly in FIPS mode with recent OpenSSL 3.2.
+
+* Fix various (mostly false positive) issues detected by Coverity.

docs/v2.7.4-ReleaseNotes

@@ -0,0 +1,62 @@
+Cryptsetup 2.7.4 Release Notes
+==============================
+Stable bug-fix release.
+
+All users of cryptsetup 2.7 should upgrade to this version.
+
+Changes since version 2.7.3
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Detect device busy failure for device-mapper table-referenced devices.
+
+  Some device-mapper ioctl failures can disappear in libdevmapper,
+  causing the libcryptsetup wrapper to return an invalid error (EINVAL)
+  instead of EEXIST or EBUSY. One such case is when there is a device
+  creation race, and the device-mapper device name is created, but
+  the following mapping table load fails. This can happen because some
+  block devices used in table mapping have already been claimed by
+  another process (the kernel needs exclusive access).
+
+  The kernel ioctl properly returns EBUSY; this errno is lost in
+  libdevmapper (dm_task_get_errno returns 0). It should be fixed by
+  libdevmapper in the future.
+
+  Such behavior was seen in the systemd way of handling dm-verity
+  devices. With these changes, the code should react for EEXIST and
+  EBUSY, as another process has already activated the device.
+
+  Code calling libcryptsetup also must not check the underlying device
+  with an exclusive open flag (O_EXCL). Otherwise, it could cause a race
+  in the kernel device-mapper, resulting in no process succeeding device
+  activation (see also CRYPT_ACTIVATE_SHARED flag below).
+
+* Fix shared activation for dm-verity devices.
+
+  The CRYPT_ACTIVATE_SHARED flag was silently ignored when activating
+  dm-verity devices. Dm-verity shared activation is generally safe
+  since all verity devices are read-only.
+
+  The shared flag is a way to skip the exclusive access check for the
+  device, allowing it to create multiple mappings with the same device or
+  properly handle a racy concurrent activation of devices with the same
+  name from different processes.
+
+* Add --shared option for veritysetup open action.
+
+  The option allows the data device to be used in multiple device-mapper
+  table mappings (skip exclusive access check) or to allow concurrent
+  dm-verity device activation of the same device (only one process
+  succeeds in this case; the other will return EEXIST or EBUSY).
+
+* Do not use exclusive flag for the allocated backing loop files.
+
+  Using this flag is an undefined operation for opening an existing file.
+  The flag should be used only for allocated loop (block) devices.
+
+* Fixes for problems found by static analyzers and Valgrind.
+
+  These include fixes for non-default libgcrypt, NSS, and Nettle
+  cryptographic backends, buffer operations to avoid partial read/write,
+  and several other workarounds for mostly false positive warnings.
+
+* Fixes to tests and CI scripts.

docs/v2.7.5-ReleaseNotes

@@ -0,0 +1,23 @@
+Cryptsetup 2.7.5 Release Notes
+==============================
+Stable bug-fix release.
+
+All users of cryptsetup 2.7 must upgrade to this version.
+
+Changes since version 2.7.4
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+* Fix possible online reencryption data corruption (only in 2.7.x).
+
+  In some situations (initializing a suspended device-mapper device),
+  cryptsetup disabled direct-io device access. This caused unsafe
+  online reencryption operations that could lead to data corruption.
+  The code now adds strict checks (and aborts the operation) and
+  changes direct-io detection code to prevent data corruption.
+
+* Fix a clang compilation error in SSH token plugin.
+
+  As clang linker treats missing symbols as errors, the linker phase
+  for the SSH token failed as the optional cryptsetup_token_buffer_free
+  was not defined.
+
+* Fix crypto backend initialization in crypt_format_luks2_opal API call.

docs/v2.8.0-ReleaseNotes

@@ -0,0 +1,328 @@
+Cryptsetup 2.8.0 Release Notes
+==============================
+Stable release with new features and bug fixes
+
+All users of cryptsetup 2.7 must upgrade to this version.
+
+Changes since version 2.7.5
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Introduce support for inline mode (use HW sectors with additional hardware metadata space).
+
+  Some enterprise NVMe drives allow formatting sector size with additional metadata space,
+  for example, sector size 4096 bytes + 64 bytes for metadata.
+  We hope common firmware will soon support such features in more recent models.
+
+  If this metadata space is available (not internally used by a data integrity profile),
+  it removes the need to use the dm-integrity layer for sector metadata allocation.
+  This means that the performance bottleneck caused by the dm-integrity journal is eliminated.
+
+  Note: such drive must be reformatted with an external nvme tool.
+  You can check for support (reported as LBA format) by running the command
+    "nvme id-ns -H <nvme device>" and then you can reformat to the selected profile
+  (with complete data loss) with "nvme format -l <lbaf>.
+  This way, you can also reformat NVMe drive to 4096-byte sectors,which is strongly recommended
+  for encryption performance.
+
+  The required device mapper for inline mode was introduced in Linux kernel version 6.11.
+
+  The inline mode can be used with the new --integrity-inline option.
+
+  For integritysetup, the kernel dm-integrity layer is still used, but it directly maps metadata
+  to the hardware (eliminating the journal).
+  For cryptsetup, the dm-integrity layer is eliminated, and only the dm-crypt kernel driver is used.
+  The libcryptsetup exports a new crypt_format_inline API call.
+
+  Examples (underlying device must provide inline HW metadata space):
+
+  Use integritysetup format with inline mode with default CRC32 checksums:
+
+   # integritysetup format --sector-size 4096 --integrity-inline <device> [--no-wipe]
+   # integritysetup open <device> test
+   # integritysetup status test
+     /dev/mapper/test is active.
+       type:    INTEGRITY
+       tag size: 4 [bytes]
+       integrity: crc32c
+       device: <device>
+       sector size:  4096 [bytes]
+       ...
+       inline mode
+       journal: not active
+
+  Use LUKS2 with authenticated encryption (here with AEGIS AEAD cipher):
+
+   # cryptsetup luksFormat --integrity-inline --integrity aead --sector-size 4096 \
+                -c aegis128-random --key-size 128 <device> [--integrity-no-wipe]
+   # cryptsetup open <device> test
+   # cryptsetup luksDump <device>
+     ...
+     Requirements:   inline-hw-tags
+
+  After format, the inline mode is used automatically, and no special options are needed.
+  Please check the manual pages for more details about used options.
+
+  Note that the LUKS2 authenticated encryption is still an experimental feature.
+  The inline mode only improves performance by removing the dm-integrity layer.
+
+* Finalize use of keyslot context API.
+
+  Keyslot context is a generic abstraction over keyslot manipulation.
+  It extends many exiting commands by additional functions like tokens in activation, resume,
+  reencryption and similar commands without introducing new specific API functions.
+
+* Make all keyslot context types fully self-contained.
+
+  In the previous version, the caller is responsible for releasing of some allocated memory.
+  In this version, all memory is allocated internally. The existing keyslot context API function
+  provides backward compatibility through versioned symbols.
+
+* Add --key-description and --new-key-description cryptsetup options.
+
+  These can be used for the specification of the keyring with passphrase retrieval in the open,
+  resize, luksResume, luksFormat, luksAddKey and luksDump.
+
+* Support more precise keyslot selection in reencryption initialization.
+
+  Reencryption must update stored keys in keyslots, so it needs to unlock all keyslots first.
+
+  When no specific keyslot is selected by the --key-slot option, all active keyslots are updated.
+
+  Users may narrow down the selection of keyslots by specifying either --token-id, --token-type
+  or --token-only option. Only keyslots associated with the specific token (--token-id) or
+  a specific type (--token-type) or any token (--token-only) will be updated.
+  All other keyslots will be erased after reencryption is finished.
+
+  During reencryption, there are two volume keys (old and new).
+  For very specific use cases, reencryption can also be initialized by providing
+  volume keys directly by --volume-key-file, --new-volume-key-file, --volume-key-keyring
+  or --new-volume-key-keyring options. These options allow reencryption of the device with
+  no active keyslots (these can be added later).
+  If the --force-no-keyslots option is specified, all active keyslots will be erased after
+  the reencryption operation is finished.
+
+* Allow reencryption to resume using token and volume keys.
+
+  The reencryption can be resumed using tokens (similar to initialization described above).
+  For very specific use cases, reencryption can be resumed by providing volume keys.
+
+* Cryptsetup repair command now tries to check LUKS keyslot areas for corruption.
+
+  A keyslot binary area contains an encrypted volume key diffused to a larger area by
+  the anti-forensic splitter. If this area is corrupted, the keyslot can no longer be unlocked,
+  even with the correct password.
+
+  Active keyslot area should look like random data, so some specific corruption can be detected
+  by randomness analysis.
+
+  Cryptsetup repair command now tries to analyze the area expecting a uniform distribution
+  of bytes in 4096-byte blocks. If a problem is detected, it tries to localize corruption
+  in a smaller block (using the expected bit count).
+  Both tests are based on the Chi-squared statistical test.
+
+  This analysis can replace the external keyslot check program and usually is more sensitive.
+  However, it cannot detect all corruptions and can produce false positives.
+
+  Please use it as a hint when your password is no longer accepted, and you suspect
+  header corruption. This is the example output of the analysis:
+
+  # cryptsetup repair <device>
+    Keyslot 2 binary data could be corrupted.
+      Suspected offset: 0x88000
+    You can use hexdump -v -C -n 128 -s <offset_0xXXXX> <device> to inspect the data.
+
+  The test does not modify the header. A keyslot corruption cannot be repaired.
+  You have to use a backup header.
+
+* Opal2 SED: PSID keyfile is now expected to be 32 alphanumeric characters.
+
+  If the keyfile size is not explicitly set, it uses only first 32 bytes.
+  All Opal2 manufacturers seem to use PSID of this length.
+
+* Opal2: Avoid the Erase method and use Secure Erase for locking range.
+
+  The Erase method is defined for Single-user mode (SUM) and works on SUM-enabled locking ranges.
+  As we do not use SUM yet, this always fails and falls back to Secure erase anyway.
+
+* Opal2: Fix some error description (in debug only).
+
+  Some Opal error messages were incorrect.
+  Cryptsetup now use all codes according to TCG specifications.
+
+* Opal2: Do not allow deferred deactivation.
+
+  The self-encrypting drive must be locked immediately; deferred deactivation is not supported.
+
+* Allow --reduce-device-size and --device-size combination for reencryption (encrypt) action.
+
+  For some very specific cases, this can be used to encrypt only part of the device together
+  with allocation a new space for the LUKS header.
+
+* Fix the userspace storage backend to support kernel "capi:" cipher specification format.
+
+  This avoids unnecessary fallback to the device-mapper instead of the userspace crypto library
+  in luksFormat. The "capi:" is Linux kernel cryptographic format.
+  For example, capi:xts(aes)-plain64 is equivalent of aes-xts-plain64.
+
+* Disallow conversion from LUKS2 to LUKS1 if kernel "capi:" cipher specification is used.
+
+  LUKS1 never officially supported this cipher specification format.
+  Such devices cannot be converted to LUKS1 (while existing devices can still be activated).
+
+* Explicitly disallow kernel "capi:" cipher specification format for LUKS2 keyslot encryption.
+
+  This specification is intended to be used for data encryption, not for keyslots.
+
+* Do not allow conversion of LUKS2 to LUKS1 if an unbound keyslot is present.
+
+  LUKS1 does not support unbound keyslots. Such devices cannot be converted.
+
+* cryptsetup: Adjust the XTS key size for kernel "capi:" cipher specification.
+
+  Double key size as there are two keys the same way as for dm-crypt format.
+
+* Remove keyslot warning about possible failure due to low memory.
+
+  This check was intended to warn users about possible out-of-memory situations
+  but produced many false positives.
+
+* Do not limit Argon2 KDF memory cost on systems with more than 4GB of available memory.
+
+  The memory cost is intended to be limited only in low-memory situations (like virtual machines
+  without swap), not on systems with plenty of RAM.
+
+* Properly report out of memory error for cryptographic backends implementing Argon2.
+
+* Avoid KDF2 memory cost overflow on 32-bit platforms.
+
+* Do not use page size as a fallback for device block size.
+
+  This check produced wrong values if used on platforms with larger page sizes (64kB)
+  and specific underlying storage (like ZFS).
+
+* veritysetup: Check hash device size in advance.
+
+  If hashes are stored in a file image, allocate the size in advance.
+  For a block device, check if hashes (Merkle tree) fits the device.
+
+* Print a better error message for unsupported LUKS2 AEAD device resize.
+
+* Optimize LUKS2 metadata writes.
+
+  LUKS2 supports several JSON area length configurations. Do not write full metadata
+  (including padding), as it may generate noticeable overhead with LUKS2.
+
+* veritysetup: support --error-as-corruption option.
+
+  The panic/restart_on_error options were introduced in Linux kernel 6.12 and process errors
+  (like media read error) the same way as data corruption.
+  Use this flag in combination with --panic-on-corruption or --restart-on-corruption.
+
+* Report all sizes in status and dump command output in the correct units.
+
+  Since the support of --sector-size option, the meaning of "sectors" became ambiguous as it
+  usually means 512-byte sectors (device-mapper unit). Confusion occurs when the sector size
+  is 4096 bytes while units used for display are 512-byte sectors.
+
+  All status commands in tools now display units explicitly to avoid confusion.
+
+  For example:
+  # cryptsetup status test
+    ...
+    sector size:  4096 [bytes]
+    offset:  32768 [512-byte units] (134217728 [bytes])
+    size:    7501443760 [512-byte units] (30725913640960 [bytes])
+
+  If you parse the output of status commands, please check your scripts to ensure they work
+  with the new output properly.
+
+* Add --integrity-key-size option to cryptsetup.
+
+  This option can be used to set up non-standard integrity key size (e.g. for HMAC).
+  It adds a new (optional) JSON "key_size" attribute in the segment.integrity JSON object
+  (see updated LUKS2 specification). If not set, the code uses selected hash length size.
+
+* Support trusted & encrypted keyrings for plain devices.
+
+* Support plain format resize with a keyring key.
+
+  If a plain dm-crypt device references the keyring, cryptsetup now allows resizing.
+  The user must ensure that the key in the keyring is unchanged since activation.
+  Otherwise, reloading the key can cause data corruption after an unexpected key change.
+
+* TCRYPT: Clear mapping of system-encrypted partitions.
+
+  TrueCrypt/VeraCrypt supports full system encryption (only a partition table is not encrypted)
+  or system partition encryption (only a system partition is encrypted).
+  The metadata header then contains the offset and size of the encrypted area.
+  Cryptsetup needs to know the specific partition offset to calculate encryption parameters.
+
+  To properly map a partition, the user must specify a real partition device so cryptsetup
+  can calculate this offset. As the partition can be an image in a file, cryptsetup now tries
+  to determine proper parameters and use device size stored in VeraCrypt metadata.
+
+  Please see the manual page description (TCRYPT section) for a detailed description.
+
+* TCRYPT: Print all information from the decrypted metadata header in the tcryptDump command.
+
+  Print also volume sizes (if present) and flags.
+
+* Always lock the volume key structure in memory.
+
+  Some memory for safe allocation was not allocated from locked (unswappable) memory.
+  Older cryptsetup locked all memory. Selective locking was introduced in version 2.6.0.
+
+* Do not run direct-io read check on block devices.
+
+  Block devices always support direct-io.
+  This check produced unnecessary error with locked Opal2 devices.
+
+* Fix a possible segfault in deferred deactivation.
+
+  Thanks Clément Guérin for the report.
+
+* Exclude cipher allocation time from the cryptsetup benchmark.
+
+* Add Mbed-TLS optional crypto backend.
+
+  Mbed-TLS is a tiny TLS implementation designed for embedded environments.
+  The backend can be enabled with the --with-crypto_backend=mbedtls configure option.
+
+* Fix the wrong preprocessor use of #ifdef for config.h processed by Meson.
+
+  Cryptsetup supports Autoconf and, optionally, Meson configuration.
+  Part of the code wrongly used #ifdef instead of #if conditional sections.
+  This caused problems with Meson-generated config.h.
+
+* Reorganize license files.
+
+  The license text files are now in docs/licenses.
+  The COPYING file in the root directory is the default license.
+
+Libcryptsetup API extensions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The libcryptsetup API is backward compatible with all existing symbols.
+
+Due to the self-contained memory allocation, these symbols have the new version
+ crypt_keyslot_context_init_by_passphrase;
+ crypt_keyslot_context_init_by_keyfile;
+ crypt_keyslot_context_init_by_token;
+ crypt_keyslot_context_init_by_volume_key;
+ crypt_keyslot_context_init_by_signed_key;
+ crypt_keyslot_context_init_by_keyring;
+ crypt_keyslot_context_init_by_vk_in_keyring;
+
+New symbols:
+ crypt_format_inline
+ crypt_get_old_volume_key_size
+ crypt_reencrypt_init_by_keyslot_context
+ crypt_safe_memcpy
+
+New defines:
+ CRYPT_ACTIVATE_HIGH_PRIORITY
+ CRYPT_ACTIVATE_ERROR_AS_CORRUPTION
+ CRYPT_ACTIVATE_INLINE_MODE
+ CRYPT_REENCRYPT_CREATE_NEW_DIGEST
+
+New requirement flag:
+ CRYPT_REQUIREMENT_INLINE_HW_TAGS

docs/v2.8.1-ReleaseNotes

@@ -0,0 +1,40 @@
+Cryptsetup 2.8.1 Release Notes
+==============================
+Stable bug-fix release with minor extensions.
+
+All users of cryptsetup 2.8.0 must upgrade to this version.
+
+Changes since version 2.8.0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Fix status and deactivation of TCRYPT (VeraCrypt compatible) devices that use chained ciphers.
+
+* Fix unlocking BITLK (BitLocker compatible) devices with multibyte UTF8 characters in the passphrase.
+
+* Do not allow activation of the LUKS2 device if the used keyslot is not encrypted (it uses a null cipher).
+
+  Such a configuration cannot be created by cryptsetup, but can be crafted outside of it.
+  Null cipher is sometimes used to create an empty container for later reencryption.
+  Only an empty passphrase can activate such a container (the same as in LUKS1).
+
+* Do not silently decrease PBKDF parallel cost (threads) if set by an option.
+  The maximum parallel cost is limited to 4 threads.
+
+* Fixes to configuration and installation scripts.
+
+  Meson and autoconf tools now properly support --prefix option for temporary directory installation.
+  Multiple fixes and cleanups to config.h for compatibility between Meson and autoconf.
+  Fix the luks2-external-tokens-path Meson option to work the same as in autoconf.
+  Fix Meson install for tool binaries, install fvault2Open man page and include test/fuzz/meson.build in release.
+
+* Major update to manual pages.
+
+  Try to explain the PBKDF hardcoded limits.
+  Add a better explanation for automatic integrity tag recalculation.
+  Mention crypt/verity/integritytab.
+  Remove or reformulate some misleading warnings present only with old and no longer supported kernels.
+  Clarify that some commands do not wipe data and unify OPAL reset wording.
+  Clarify the --label option.
+  There are also many other grammar and stylistic fixes to unify the man-page style.
+
+* Fixes for false-positive and annoying (optional) warnings added in recent compilers.

lib/Makemodule.am

@@ -103,6 +103,8 @@ libcryptsetup_la_SOURCES = \
 	lib/luks2/luks2_token.c		\
 	lib/luks2/luks2_internal.h	\
 	lib/luks2/luks2.h		\
+	lib/luks2/hw_opal/hw_opal.c	\
+	lib/luks2/hw_opal/hw_opal.h	\
 	lib/utils_blkid.c		\
 	lib/utils_blkid.h		\
 	lib/bitlk/bitlk.h		\

lib/bitlk/bitlk.c

@@ -1,23 +1,10 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * BITLK (BitLocker-compatible) volume handling
  *
- * Copyright (C) 2019-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2019-2023 Milan Broz
- * Copyright (C) 2019-2023 Vojtech Trefny
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2019-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2019-2025 Milan Broz
+ * Copyright (C) 2019-2025 Vojtech Trefny
  */
 
 #include <errno.h>
@@ -124,6 +111,7 @@ struct bitlk_superblock {
 struct bitlk_fve_metadata {
 	/* FVE metadata block header */
 	uint8_t signature[8];
+	/* size of this block (in 16-byte units) */
 	uint16_t fve_size;
 	uint16_t fve_version;
 	uint16_t curr_state;
@@ -145,6 +133,32 @@ struct bitlk_fve_metadata {
 	uint64_t creation_time;
 } __attribute__ ((packed));
 
+struct bitlk_validation_hash {
+	uint16_t size;
+	uint16_t role;
+	uint16_t type;
+	uint16_t flags;
+	/* likely a hash type code, anything other than 0x2005 isn't supported */
+	uint16_t hash_type;
+	uint16_t unknown1;
+	/* SHA-256 */
+	uint8_t hash[32];
+} __attribute__ ((packed));
+
+struct bitlk_fve_metadata_validation {
+	/* FVE metadata validation block header */
+	uint16_t validation_size;
+	uint16_t validation_version;
+	uint32_t fve_crc32;
+	/* this is a single nested structure's header defined here for simplicity */
+	uint16_t nested_struct_size;
+	uint16_t nested_struct_role;
+	uint16_t nested_struct_type;
+	uint16_t nested_struct_flags;
+	/* datum containing a similar nested structure (encrypted using VMK) with hash (SHA256) */
+	uint8_t nested_struct_data[BITLK_VALIDATION_VMK_DATA_SIZE];
+} __attribute__ ((packed));
+
 struct bitlk_entry_header_block {
 	uint64_t offset;
 	uint64_t size;
@@ -324,6 +338,9 @@ static int parse_vmk_entry(struct crypt_device *cd, uint8_t *data, int start, in
 		/* unknown timestamps in recovery protected VMK */
 		} else if (key_entry_value == BITLK_ENTRY_VALUE_RECOVERY_TIME) {
 			;
+		/* optional hint (?) string (masked email?), we can safely ignore it */
+		} else if (key_entry_value == BITLK_ENTRY_VALUE_HINT) {
+			;
 		} else if (key_entry_value == BITLK_ENTRY_VALUE_STRING) {
 			if (key_entry_size < BITLK_ENTRY_HEADER_LEN)
 				return -EINVAL;
@@ -353,6 +370,9 @@ static int parse_vmk_entry(struct crypt_device *cd, uint8_t *data, int start, in
 		/* no idea what this is, lets hope it's not important */
 		} else if (key_entry_value == BITLK_ENTRY_VALUE_USE_KEY && (*vmk)->protection == BITLK_PROTECTION_STARTUP_KEY) {
 			;
+		/* quietly ignore unsupported TPM key */
+		} else if (key_entry_value == BITLK_ENTRY_VALUE_TPM_KEY && (*vmk)->protection == BITLK_PROTECTION_TPM) {
+			;
 		} else {
 			if (supported) {
 				log_err(cd, _("Unexpected metadata entry value '%u' found when parsing supported Volume Master Key."), key_entry_value);
@@ -368,6 +388,54 @@ static int parse_vmk_entry(struct crypt_device *cd, uint8_t *data, int start, in
 	return 0;
 }
 
+static bool check_fve_metadata(struct bitlk_fve_metadata *fve)
+{
+	if (memcmp(fve->signature, BITLK_SIGNATURE, sizeof(fve->signature)) || le16_to_cpu(fve->fve_version) != 2 ||
+		(fve->fve_size << 4) > BITLK_FVE_METADATA_SIZE)
+		return false;
+
+	return true;
+}
+
+static bool check_fve_metadata_validation(struct bitlk_fve_metadata_validation *validation)
+{
+	/* only check if there is room for CRC-32, the actual size must be larger */
+	if (le16_to_cpu(validation->validation_size) < 8 || le16_to_cpu(validation->validation_version > 2))
+		return false;
+
+	return true;
+}
+
+static bool parse_fve_metadata_validation(struct bitlk_metadata *params, struct bitlk_fve_metadata_validation *validation)
+{
+	/* extra checks for a nested structure (MAC) and BITLK FVE metadata */
+
+	if (le16_to_cpu(validation->validation_size) < sizeof(struct bitlk_fve_metadata_validation))
+		return false;
+
+	if (le16_to_cpu(validation->nested_struct_size != BITLK_VALIDATION_VMK_HEADER_SIZE + BITLK_VALIDATION_VMK_DATA_SIZE) ||
+		le16_to_cpu(validation->nested_struct_role) != 0 ||
+		le16_to_cpu(validation->nested_struct_type) != 5)
+		return false;
+
+	/* nonce */
+	memcpy(params->validation->nonce,
+		validation->nested_struct_data,
+		BITLK_NONCE_SIZE);
+
+	/* MAC tag */
+	memcpy(params->validation->mac_tag,
+		validation->nested_struct_data + BITLK_NONCE_SIZE,
+		BITLK_VMK_MAC_TAG_SIZE);
+
+	/* AES-CCM encrypted datum with SHA256 hash */
+	memcpy(params->validation->enc_datum,
+		validation->nested_struct_data + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE,
+		BITLK_VALIDATION_VMK_DATA_SIZE - BITLK_NONCE_SIZE - BITLK_VMK_MAC_TAG_SIZE);
+
+	return true;
+}
+
 void BITLK_bitlk_fvek_free(struct bitlk_fvek *fvek)
 {
 	if (!fvek)
@@ -382,10 +450,8 @@ void BITLK_bitlk_vmk_free(struct bitlk_vmk *vmk)
 	struct bitlk_vmk *vmk_next = NULL;
 
 	while (vmk) {
-		if (vmk->guid)
-			free(vmk->guid);
-		if (vmk->name)
-			free(vmk->name);
+		free(vmk->guid);
+		free(vmk->name);
 		crypt_free_volume_key(vmk->vk);
 		vmk_next = vmk->next;
 		free(vmk);
@@ -399,8 +465,8 @@ void BITLK_bitlk_metadata_free(struct bitlk_metadata *metadata)
 		return;
 
 	free(metadata->guid);
-	if (metadata->description)
-		free(metadata->description);
+	free(metadata->description);
+	free(metadata->validation);
 	BITLK_bitlk_vmk_free(metadata->vmks);
 	BITLK_bitlk_fvek_free(metadata->fvek);
 }
@@ -412,20 +478,25 @@ int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params)
 	struct bitlk_signature sig = {};
 	struct bitlk_superblock sb = {};
 	struct bitlk_fve_metadata fve = {};
+	struct bitlk_fve_metadata_validation validation = {};
 	struct bitlk_entry_vmk entry_vmk = {};
 	uint8_t *fve_entries = NULL;
+	uint8_t *fve_validated_block = NULL;
 	size_t fve_entries_size = 0;
 	uint32_t fve_metadata_size = 0;
+	uint32_t fve_size_real = 0;
 	int fve_offset = 0;
 	char guid_buf[UUID_STR_LEN] = {0};
 	uint16_t entry_size = 0;
 	uint16_t entry_type = 0;
 	int i = 0;
 	int r = 0;
+	int valid_fve_metadata_idx = -1;
 	int start = 0;
 	size_t key_size = 0;
 	const char *key = NULL;
 	char *description = NULL;
+	struct crypt_hash *hash;
 
 	struct bitlk_vmk *vmk = NULL;
 	struct bitlk_vmk *vmk_p = params->vmks;
@@ -500,15 +571,80 @@ int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params)
 	for (i = 0; i < 3; i++)
 		params->metadata_offset[i] = le64_to_cpu(sb.fve_offset[i]);
 
-	log_dbg(cd, "Reading BITLK FVE metadata of size %zu on device %s, offset %" PRIu64 ".",
-		sizeof(fve), device_path(device), params->metadata_offset[0]);
+	fve_validated_block = malloc(BITLK_FVE_METADATA_SIZE);
+	if (fve_validated_block == NULL) {
+		r = -ENOMEM;
+		goto out;
+	}
 
-	/* read FVE metadata from the first metadata area */
-	if (read_lseek_blockwise(devfd, device_block_size(cd, device),
-		device_alignment(device), &fve, sizeof(fve), params->metadata_offset[0]) != sizeof(fve) ||
-		memcmp(fve.signature, BITLK_SIGNATURE, sizeof(fve.signature)) ||
-		le16_to_cpu(fve.fve_version) != 2) {
-		log_err(cd, _("Failed to read BITLK FVE metadata from %s."), device_path(device));
+	for (i = 0; i < 3; i++) {
+		/* iterate over FVE metadata copies and pick the valid one */
+		log_dbg(cd, "Reading BITLK FVE metadata copy #%d of size %zu on device %s, offset %" PRIu64 ".",
+			i, sizeof(fve), device_path(device), params->metadata_offset[i]);
+
+		if (read_lseek_blockwise(devfd, device_block_size(cd, device),
+			device_alignment(device), &fve, sizeof(fve), params->metadata_offset[i]) != sizeof(fve) ||
+			!check_fve_metadata(&fve) ||
+			(fve_size_real = le16_to_cpu(fve.fve_size) << 4, read_lseek_blockwise(devfd, device_block_size(cd, device),
+			device_alignment(device), &validation, sizeof(validation), params->metadata_offset[i] + fve_size_real) != sizeof(validation)) ||
+			!check_fve_metadata_validation(&validation) ||
+			/* double-fetch is here, but we aren't validating MAC */
+			read_lseek_blockwise(devfd, device_block_size(cd, device), device_alignment(device), fve_validated_block, fve_size_real,
+			params->metadata_offset[i]) != fve_size_real ||
+			(crypt_crc32(~0, fve_validated_block, fve_size_real) ^ ~0) != le32_to_cpu(validation.fve_crc32)) {
+			/* found an invalid FVE metadata copy, log and skip */
+			log_dbg(cd, _("Failed to read or validate BITLK FVE metadata copy #%d from %s."), i, device_path(device));
+		} else {
+			/* found a valid FVE metadata copy, use it */
+			valid_fve_metadata_idx = i;
+			break;
+		}
+	}
+
+	if (valid_fve_metadata_idx < 0) {
+		/* all FVE metadata copies are invalid, fail */
+		log_err(cd, _("Failed to read and validate BITLK FVE metadata from %s."), device_path(device));
+		r = -EINVAL;
+		goto out;
+	}
+
+	/* check that a valid FVE metadata block is in its expected location */
+	if (params->metadata_offset[valid_fve_metadata_idx] != le64_to_cpu(fve.fve_offset[valid_fve_metadata_idx])) {
+		log_err(cd, _("Failed to validate the location of BITLK FVE metadata from %s."), device_path(device));
+		r = -EINVAL;
+		goto out;
+	}
+
+	/* update offsets from a valid FVE metadata copy */
+	for (i = 0; i < 3; i++)
+		params->metadata_offset[i] = le64_to_cpu(fve.fve_offset[i]);
+
+	/* check that the FVE metadata hasn't changed between reads, because we are preparing for the MAC check */
+	if (memcmp(&fve, fve_validated_block, sizeof(fve)) != 0) {
+		log_err(cd, _("BITLK FVE metadata changed between reads from %s."), device_path(device));
+		r = -EINVAL;
+		goto out;
+	}
+
+	crypt_backend_memzero(&params->sha256_fve, 32);
+	if (crypt_hash_init(&hash, "sha256")) {
+		log_err(cd, _("Failed to hash BITLK FVE metadata read from %s."), device_path(device));
+		r = -EINVAL;
+		goto out;
+	}
+	crypt_hash_write(hash, (const char *)fve_validated_block, fve_size_real);
+	crypt_hash_final(hash, (char *)&params->sha256_fve, 32);
+	crypt_hash_destroy(hash);
+
+	/* do some extended checks against FVE metadata, but not including MAC verification */
+	params->validation = malloc(sizeof(struct bitlk_validation));
+	if (!params->validation) {
+		r = -ENOMEM;
+		goto out;
+	}
+
+	if (!parse_fve_metadata_validation(params, &validation)) {
+		log_err(cd, _("Failed to parse BITLK FVE validation metadata from %s."), device_path(device));
 		r = -EINVAL;
 		goto out;
 	}
@@ -593,17 +729,18 @@ int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params)
 	}
 	memset(fve_entries, 0, fve_entries_size);
 
-	log_dbg(cd, "Reading BITLK FVE metadata entries of size %zu on device %s, offset %" PRIu64 ".",
-		fve_entries_size, device_path(device), params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN);
+	log_dbg(cd, "Getting BITLK FVE metadata entries of size %zu on device %s, offset %" PRIu64 ".",
+		fve_entries_size, device_path(device), params->metadata_offset[valid_fve_metadata_idx] + BITLK_FVE_METADATA_HEADERS_LEN);
 
-	if (read_lseek_blockwise(devfd, device_block_size(cd, device),
-		device_alignment(device), fve_entries, fve_entries_size,
-		params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN) != (ssize_t)fve_entries_size) {
-		log_err(cd, _("Failed to read BITLK metadata entries from %s."), device_path(device));
+	if (BITLK_FVE_METADATA_HEADERS_LEN + fve_entries_size > fve_size_real) {
+		log_err(cd, _("Failed to check BITLK metadata entries previously read from %s."), device_path(device));
 		r = -EINVAL;
 		goto out;
 	}
 
+	/* fetch these entries from validated buffer to avoid double-fetch */
+	memcpy(fve_entries, fve_validated_block + BITLK_FVE_METADATA_HEADERS_LEN, fve_entries_size);
+
 	while ((fve_entries_size - start) >= (sizeof(entry_size) + sizeof(entry_type))) {
 
 		/* size of this entry */
@@ -724,10 +861,10 @@ int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params)
 
 		start += entry_size;
 	}
-
 out:
-	if (fve_entries)
-		free(fve_entries);
+	free(fve_entries);
+	free(fve_validated_block);
+
 	return r;
 }
 
@@ -735,6 +872,7 @@ int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_meta
 {
 	struct volume_key *vk_p;
 	struct bitlk_vmk *vmk_p;
+	char time[32];
 	int next_id = 0;
 	int i = 0;
 
@@ -743,11 +881,12 @@ int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_meta
 	log_std(cd, "GUID:         \t%s\n", params->guid);
 	log_std(cd, "Sector size:  \t%u [bytes]\n", params->sector_size);
 	log_std(cd, "Volume size:  \t%" PRIu64 " [bytes]\n", params->volume_size);
-	log_std(cd, "Created:      \t%s", ctime((time_t *)&(params->creation_time)));
+	if (ctime_r((time_t *)&params->creation_time, time))
+		log_std(cd, "Created:      \t%s", time);
 	log_std(cd, "Description:  \t%s\n", params->description);
 	log_std(cd, "Cipher name:  \t%s\n", params->cipher);
 	log_std(cd, "Cipher mode:  \t%s\n", params->cipher_mode);
-	log_std(cd, "Cipher key:   \t%u bits\n", params->key_size);
+	log_std(cd, "Cipher key:   \t%u [bits]\n", params->key_size);
 
 	log_std(cd, "\n");
 
@@ -766,15 +905,15 @@ int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_meta
 
 		vk_p = vmk_p->vk;
 		while (vk_p) {
-			log_std(cd, "\tKey data size:\t%zu [bytes]\n", vk_p->keylength);
-			vk_p = vk_p->next;
+			log_std(cd, "\tKey data size:\t%zu [bytes]\n", crypt_volume_key_length(vk_p));
+			vk_p = crypt_volume_key_next(vk_p);
 		}
 		vmk_p = vmk_p->next;
 		next_id++;
 	}
 
 	log_std(cd, " %d: FVEK\n", next_id);
-	log_std(cd, "\tKey data size:\t%zu [bytes]\n", params->fvek->vk->keylength);
+	log_std(cd, "\tKey data size:\t%zu [bytes]\n", crypt_volume_key_length(params->fvek->vk));
 
 	log_std(cd, "\n");
 
@@ -982,8 +1121,7 @@ static int get_startup_key(struct crypt_device *cd,
 	}
 }
 
-static int bitlk_kdf(struct crypt_device *cd,
-		     const char *password,
+static int bitlk_kdf(const char *password,
 		     size_t passwordLen,
 		     bool recovery,
 		     const uint8_t *salt,
@@ -993,6 +1131,7 @@ static int bitlk_kdf(struct crypt_device *cd,
 	struct crypt_hash *hd = NULL;
 	int len = 0;
 	char16_t *utf16Password = NULL;
+	size_t utf16Len = 0;
 	int i = 0;
 	int r = 0;
 
@@ -1018,7 +1157,8 @@ static int bitlk_kdf(struct crypt_device *cd,
 		if (r < 0)
 			goto out;
 
-		crypt_hash_write(hd, (char*)utf16Password, passwordLen * 2);
+		utf16Len = crypt_char16_strlen(utf16Password);
+		crypt_hash_write(hd, (char*)utf16Password, utf16Len * 2);
 		r = crypt_hash_final(hd, kdf.initial_sha256, len);
 		if (r < 0)
 			goto out;
@@ -1064,11 +1204,14 @@ static int decrypt_key(struct crypt_device *cd,
 	int r;
 	uint16_t key_size = 0;
 
-	outbuf = crypt_safe_alloc(enc_key->keylength);
+	outbuf = crypt_safe_alloc(crypt_volume_key_length(enc_key));
 	if (!outbuf)
 		return -ENOMEM;
 
-	r = crypt_bitlk_decrypt_key(key->key, key->keylength, enc_key->key, outbuf, enc_key->keylength,
+	r = crypt_bitlk_decrypt_key(crypt_volume_key_get_key(key),
+				crypt_volume_key_length(key),
+				crypt_volume_key_get_key(enc_key), outbuf,
+				crypt_volume_key_length(enc_key),
 				(const char*)iv, iv_size, (const char*)tag, tag_size);
 	if (r < 0) {
 		if (r == -ENOTSUP)
@@ -1079,9 +1222,10 @@ static int decrypt_key(struct crypt_device *cd,
 	/* key_data has it's size as part of the metadata */
 	memcpy(&key_size, outbuf, 2);
 	key_size = le16_to_cpu(key_size);
-	if (enc_key->keylength != key_size) {
+	if (crypt_volume_key_length(enc_key) != key_size) {
 		log_err(cd, _("Unexpected key data size."));
-		log_dbg(cd, "Expected key data size: %zu, got %" PRIu16 "", enc_key->keylength, key_size);
+		log_dbg(cd, "Expected key data size: %zu, got %" PRIu16 "",
+			    crypt_volume_key_length(enc_key), key_size);
 
 		r = -EINVAL;
 		goto out;
@@ -1091,7 +1235,7 @@ static int decrypt_key(struct crypt_device *cd,
 		crypt_get_volume_key_size(cd) == 32) {
 		/* 128bit AES-CBC with Elephant -- key size is 256 bit (2 keys) but key data is 512 bits,
 		   data: 16B CBC key, 16B empty, 16B elephant key, 16B empty */
-		memcpy(outbuf + 16 + BITLK_OPEN_KEY_METADATA_LEN,
+		crypt_safe_memcpy(outbuf + 16 + BITLK_OPEN_KEY_METADATA_LEN,
 			outbuf + 2 * 16 + BITLK_OPEN_KEY_METADATA_LEN, 16);
 		key_size = 32 + BITLK_OPEN_KEY_METADATA_LEN;
 	}
@@ -1115,12 +1259,13 @@ int BITLK_get_volume_key(struct crypt_device *cd,
 	struct volume_key *open_vmk_key = NULL;
 	struct volume_key *vmk_dec_key = NULL;
 	struct volume_key *recovery_key = NULL;
+	struct bitlk_validation_hash dec_hash = {};
 	const struct bitlk_vmk *next_vmk = NULL;
 
 	next_vmk = params->vmks;
 	while (next_vmk) {
 		if (next_vmk->protection == BITLK_PROTECTION_PASSPHRASE) {
-			r = bitlk_kdf(cd, password, passwordLen, false, next_vmk->salt, &vmk_dec_key);
+			r = bitlk_kdf(password, passwordLen, false, next_vmk->salt, &vmk_dec_key);
 			if (r) {
 				/* something wrong happened, but we still want to check other key slots */
 				next_vmk = next_vmk->next;
@@ -1140,7 +1285,8 @@ int BITLK_get_volume_key(struct crypt_device *cd,
 				continue;
 			}
 			log_dbg(cd, "Trying to use given password as a recovery key.");
-			r = bitlk_kdf(cd, recovery_key->key, recovery_key->keylength,
+			r = bitlk_kdf(crypt_volume_key_get_key(recovery_key),
+				      crypt_volume_key_length(recovery_key),
 				      true, next_vmk->salt, &vmk_dec_key);
 			crypt_free_volume_key(recovery_key);
 			if (r)
@@ -1176,6 +1322,36 @@ int BITLK_get_volume_key(struct crypt_device *cd,
 		}
 		crypt_free_volume_key(vmk_dec_key);
 
+		log_dbg(cd, "Trying to decrypt validation metadata using VMK.");
+		r = crypt_bitlk_decrypt_key(crypt_volume_key_get_key(open_vmk_key),
+			crypt_volume_key_length(open_vmk_key),
+			(const char*)params->validation->enc_datum,
+			(char *)&dec_hash,
+			BITLK_VALIDATION_VMK_DATA_SIZE - BITLK_NONCE_SIZE - BITLK_VMK_MAC_TAG_SIZE,
+			(const char*)params->validation->nonce, BITLK_NONCE_SIZE,
+			(const char*)params->validation->mac_tag, BITLK_VMK_MAC_TAG_SIZE);
+		if (r < 0) {
+			log_dbg(cd, "Failed to decrypt validation metadata using VMK.");
+			crypt_free_volume_key(open_vmk_key);
+			if (r == -ENOTSUP)
+				return r;
+			break;
+		}
+
+		/* now, do the MAC validation */
+		if (le16_to_cpu(dec_hash.role) != 0 ||le16_to_cpu(dec_hash.type) != 1 ||
+			(le16_to_cpu(dec_hash.hash_type) != 0x2005)) {
+			log_dbg(cd, "Failed to parse decrypted validation metadata.");
+			crypt_free_volume_key(open_vmk_key);
+			return -ENOTSUP;
+		}
+
+		if (memcmp(dec_hash.hash, params->sha256_fve, sizeof(dec_hash.hash)) != 0) {
+			log_dbg(cd, "Failed MAC validation of BITLK FVE metadata.");
+			crypt_free_volume_key(open_vmk_key);
+			return -EINVAL;
+		}
+
 		r = decrypt_key(cd, open_fvek_key, params->fvek->vk, open_vmk_key,
 				params->fvek->mac_tag, BITLK_VMK_MAC_TAG_SIZE,
 				params->fvek->nonce, BITLK_NONCE_SIZE, true);
@@ -1218,7 +1394,7 @@ static int _activate_check(struct crypt_device *cd,
 	next_vmk = params->vmks;
 	while (next_vmk) {
 		if (next_vmk->protection == BITLK_PROTECTION_CLEAR_KEY) {
-			log_err(cd, _("Activation of partially decrypted BITLK device is not supported."));
+			log_err(cd, _("Activation of BITLK device with clear key protection is not supported."));
 			return -ENOTSUP;
 		}
 		next_vmk = next_vmk->next;
@@ -1247,7 +1423,7 @@ static int _activate(struct crypt_device *cd,
 	uint64_t next_start = 0;
 	uint64_t next_end = 0;
 	uint64_t last_segment = 0;
-	uint32_t dmt_flags = 0;
+	uint64_t dmt_flags = 0;
 
 	r = _activate_check(cd, params);
 	if (r)
@@ -1371,7 +1547,7 @@ static int _activate(struct crypt_device *cd,
 						crypt_get_cipher_spec(cd),
 						segments[i].iv_offset,
 						segments[i].iv_offset,
-						NULL, 0,
+						NULL, 0, 0,
 						params->sector_size);
 		if (r)
 			goto out;
@@ -1407,54 +1583,17 @@ out:
 	return r;
 }
 
-int BITLK_activate_by_passphrase(struct crypt_device *cd,
-				 const char *name,
-				 const char *password,
-				 size_t passwordLen,
-				 const struct bitlk_metadata *params,
-				 uint32_t flags)
-{
-	int r = 0;
-	struct volume_key *open_fvek_key = NULL;
-
-	r = _activate_check(cd, params);
-	if (r)
-		return r;
-
-	r = BITLK_get_volume_key(cd, password, passwordLen, params, &open_fvek_key);
-	if (r < 0)
-		goto out;
-
-	/* Password verify only */
-	if (!name)
-		goto out;
-
-	r = _activate(cd, name, open_fvek_key, params, flags);
-out:
-	crypt_free_volume_key(open_fvek_key);
-	return r;
-}
-
 int BITLK_activate_by_volume_key(struct crypt_device *cd,
 				 const char *name,
-				 const char *volume_key,
-				 size_t volume_key_size,
+				 struct volume_key *vk,
 				 const struct bitlk_metadata *params,
 				 uint32_t flags)
 {
-	int r = 0;
-	struct volume_key *open_fvek_key = NULL;
+	int r;
 
 	r = _activate_check(cd, params);
 	if (r)
 		return r;
 
-	open_fvek_key = crypt_alloc_volume_key(volume_key_size, volume_key);
-	if (!open_fvek_key)
-		return -ENOMEM;
-
-	r = _activate(cd, name, open_fvek_key, params, flags);
-
-	crypt_free_volume_key(open_fvek_key);
-	return r;
+	return _activate(cd, name, vk, params, flags);
 }

lib/bitlk/bitlk.h

@@ -1,23 +1,10 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * BITLK (BitLocker-compatible) header definition
  *
- * Copyright (C) 2019-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2019-2023 Milan Broz
- * Copyright (C) 2019-2023 Vojtech Trefny
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2019-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2019-2025 Milan Broz
+ * Copyright (C) 2019-2025 Vojtech Trefny
  */
 
 #ifndef _CRYPTSETUP_BITLK_H
@@ -34,6 +21,8 @@ struct volume_key;
 #define BITLK_NONCE_SIZE 12
 #define BITLK_SALT_SIZE 16
 #define BITLK_VMK_MAC_TAG_SIZE 16
+#define BITLK_VALIDATION_VMK_HEADER_SIZE 8
+#define BITLK_VALIDATION_VMK_DATA_SIZE 72
 
 #define BITLK_STATE_NORMAL 0x0004
 
@@ -78,6 +67,7 @@ typedef enum {
 	BITLK_ENTRY_VALUE_OFFSET_SIZE = 0x000f,
 	BITLK_ENTRY_VALUE_RECOVERY_TIME = 0x015,
 	BITLK_ENTRY_VALUE_GUID = 0x0017,
+	BITLK_ENTRY_VALUE_HINT = 0x0018,
 } BITLKFVEEntryValue;
 
 struct bitlk_vmk {
@@ -97,6 +87,13 @@ struct bitlk_fvek {
 	struct volume_key *vk;
 };
 
+struct bitlk_validation {
+	uint8_t mac_tag[BITLK_VMK_MAC_TAG_SIZE];
+	uint8_t nonce[BITLK_NONCE_SIZE];
+	/* technically, this is not "VMK", but some sources call it this way */
+	uint8_t enc_datum[BITLK_VALIDATION_VMK_DATA_SIZE];
+};
+
 struct bitlk_metadata {
 	uint16_t sector_size;
 	uint64_t volume_size;
@@ -113,8 +110,10 @@ struct bitlk_metadata {
 	uint32_t metadata_version;
 	uint64_t volume_header_offset;
 	uint64_t volume_header_size;
+	const char *sha256_fve[32];
 	struct bitlk_vmk *vmks;
 	struct bitlk_fvek *fvek;
+	struct bitlk_validation *validation;
 };
 
 int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params);
@@ -127,17 +126,9 @@ int BITLK_get_volume_key(struct crypt_device *cd,
 			 const struct bitlk_metadata *params,
 			 struct volume_key **open_fvek_key);
 
-int BITLK_activate_by_passphrase(struct crypt_device *cd,
-				 const char *name,
-				 const char *password,
-				 size_t passwordLen,
-				 const struct bitlk_metadata *params,
-				 uint32_t flags);
-
 int BITLK_activate_by_volume_key(struct crypt_device *cd,
 				 const char *name,
-				 const char *volume_key,
-				 size_t volume_key_size,
+				 struct volume_key *vk,
 				 const struct bitlk_metadata *params,
 				 uint32_t flags);
 

lib/bitops.h

@@ -10,13 +10,13 @@
 #include <stdint.h>
 #include <sys/param.h>
 
-#if defined(HAVE_BYTESWAP_H)
+#if HAVE_BYTESWAP_H
 # include <byteswap.h>
 #endif
 
-#if defined(HAVE_ENDIAN_H)
+#if HAVE_ENDIAN_H
 #  include <endian.h>
-#elif defined(HAVE_SYS_ENDIAN_H)	/* BSDs have them here */
+#elif HAVE_SYS_ENDIAN_H /* BSDs have them here */
 #  include <sys/endian.h>
 #endif
 

lib/crypt_plain.c

@@ -1,23 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * cryptsetup plain device helper functions
  *
  * Copyright (C) 2004 Jana Saout <jana@saout.de>
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
 
 #include <string.h>
@@ -105,7 +92,7 @@ int crypt_plain_hash(struct crypt_device *cd,
 			log_dbg(cd, "Too short plain passphrase.");
 			return -EINVAL;
 		}
-		memcpy(key, passphrase, hash_size);
+		crypt_safe_memcpy(key, passphrase, hash_size);
 		r = 0;
 	} else
 		r = hash(hash_name_buf, hash_size, key, passphrase_size, passphrase);

lib/crypto_backend/Makemodule.am

@@ -13,7 +13,8 @@ libcrypto_backend_la_SOURCES = \
 	lib/crypto_backend/utf8.c \
 	lib/crypto_backend/argon2_generic.c \
 	lib/crypto_backend/cipher_generic.c \
-	lib/crypto_backend/cipher_check.c
+	lib/crypto_backend/cipher_check.c \
+	lib/crypto_backend/memutils.c
 
 if CRYPTO_BACKEND_GCRYPT
 libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_gcrypt.c
@@ -30,6 +31,9 @@ endif
 if CRYPTO_BACKEND_NETTLE
 libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_nettle.c
 endif
+if CRYPTO_BACKEND_MBEDTLS
+libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_mbedtls.c
+endif
 
 if CRYPTO_INTERNAL_PBKDF2
 libcrypto_backend_la_SOURCES += lib/crypto_backend/pbkdf2_generic.c

lib/crypto_backend/argon2/blake2/blake2b.c

@@ -360,7 +360,7 @@ int blake2b_long(void *pout, size_t outlen, const void *in, size_t inlen) {
         TRY(blake2b_final(&blake_state, out, outlen));
     } else {
         uint32_t toproduce;
-        uint8_t out_buffer[BLAKE2B_OUTBYTES];
+        uint8_t out_buffer[BLAKE2B_OUTBYTES] = {0};
         uint8_t in_buffer[BLAKE2B_OUTBYTES];
         TRY(blake2b_init(&blake_state, BLAKE2B_OUTBYTES));
         TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));

lib/crypto_backend/argon2/core.c

@@ -128,7 +128,7 @@ void secure_wipe_memory(void *v, size_t n) {
 void secure_wipe_memory(void *v, size_t n) {
     memset_s(v, n, 0, n);
 }
-#elif defined(HAVE_EXPLICIT_BZERO)
+#elif HAVE_EXPLICIT_BZERO
 void secure_wipe_memory(void *v, size_t n) {
     explicit_bzero(v, n);
 }
@@ -356,12 +356,9 @@ static int fill_memory_blocks_mt(argon2_instance_t *instance) {
     }
 
 fail:
-    if (thread != NULL) {
-        free(thread);
-    }
-    if (thr_data != NULL) {
-        free(thr_data);
-    }
+    free(thread);
+    free(thr_data);
+
     return rc;
 }
 

lib/crypto_backend/argon2/encoding.c

@@ -83,7 +83,7 @@
 static int b64_byte_to_char(unsigned x) {
     return (LT(x, 26) & (x + 'A')) |
            (GE(x, 26) & LT(x, 52) & (x + ('a' - 26))) |
-           (GE(x, 52) & LT(x, 62) & (x + ('0' - 52))) | (EQ(x, 62) & '+') |
+           (GE(x, 52) & LT(x, 62) & (x - (52 - '0'))) | (EQ(x, 62) & '+') |
            (EQ(x, 63) & '/');
 }
 

lib/crypto_backend/argon2/meson.build

@@ -0,0 +1,28 @@
+libargon2_sources = files(
+    'blake2/blake2b.c',
+    'argon2.c',
+    'core.c',
+    'encoding.c',
+    'thread.c',
+)
+
+if use_internal_sse_argon2
+    libargon2_sources += files(
+        'opt.c',
+    )
+else
+    libargon2_sources += files(
+        'ref.c',
+    )
+endif
+
+libargon2 = static_library('argon2',
+    libargon2_sources,
+    override_options : ['c_std=c89', 'optimization=3'],
+    build_by_default : false,
+    include_directories: include_directories(
+        'blake2',
+    ),
+    dependencies : [
+        threads,
+    ])

lib/crypto_backend/argon2_generic.c

@@ -1,42 +1,30 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Argon2 PBKDF2 library wrapper
  *
- * Copyright (C) 2016-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2016-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2016-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2016-2025 Milan Broz
  */
 
 #include <errno.h>
 #include "crypto_backend_internal.h"
+
+/* Check for HAVE_ARGON2_H is run only if libargon2 code is used */
+#if USE_INTERNAL_ARGON2 || HAVE_ARGON2_H
+
+#define CONST_CAST(x) (x)(uintptr_t)
+
 #if HAVE_ARGON2_H
 #include <argon2.h>
 #else
 #include "argon2/argon2.h"
 #endif
 
-#define CONST_CAST(x) (x)(uintptr_t)
-
 int argon2(const char *type, const char *password, size_t password_length,
 	   const char *salt, size_t salt_length,
 	   char *key, size_t key_length,
 	   uint32_t iterations, uint32_t memory, uint32_t parallel)
 {
-#if !USE_INTERNAL_ARGON2 && !HAVE_ARGON2_H
-	return -EINVAL;
-#else
 	argon2_type atype;
 	argon2_context context = {
 		.flags = ARGON2_DEFAULT_FLAGS,
@@ -54,6 +42,9 @@ int argon2(const char *type, const char *password, size_t password_length,
 	};
 	int r;
 
+	/* This code must not be run if crypt backend library natively supports Argon2 */
+	assert(!(crypt_backend_flags() & CRYPT_BACKEND_ARGON2));
+
 	if (!strcmp(type, "argon2i"))
 		atype = Argon2_i;
 	else if(!strcmp(type, "argon2id"))
@@ -75,5 +66,33 @@ int argon2(const char *type, const char *password, size_t password_length,
 	}
 
 	return r;
-#endif
+}
+
+#else /* USE_INTERNAL_ARGON2 || HAVE_ARGON2_H */
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+
+int argon2(const char *type, const char *password, size_t password_length,
+	   const char *salt, size_t salt_length,
+	   char *key, size_t key_length,
+	   uint32_t iterations, uint32_t memory, uint32_t parallel)
+{
+	return -EINVAL;
+}
+
+#endif
+
+/* Additional string for crypt backend version */
+const char *crypt_argon2_version(void)
+{
+	const char *version = "";
+
+	if (crypt_backend_flags() & CRYPT_BACKEND_ARGON2)
+		return version;
+
+#if HAVE_ARGON2_H /* this has priority over internal argon2 */
+	version = " [external libargon2]";
+#elif USE_INTERNAL_ARGON2
+	version = " [cryptsetup libargon2]";
+#endif
+	return version;
 }

lib/crypto_backend/base64.c

@@ -1,24 +1,11 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Base64 "Not encryption" helpers, copied and adapted from systemd project.
  *
  * Copyright (C) 2010 Lennart Poettering
  *
  * cryptsetup related changes
- * Copyright (C) 2021-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2021-2025 Milan Broz
  */
 
 #include <errno.h>
@@ -32,7 +19,7 @@
 /* https://tools.ietf.org/html/rfc4648#section-4 */
 static char base64char(int x)
 {
-	static const char table[64] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	static const char table[65] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 				      "abcdefghijklmnopqrstuvwxyz"
 				      "0123456789+/";
 	return table[x & 63];

lib/crypto_backend/cipher_check.c

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Cipher performance check
  *
- * Copyright (C) 2018-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2018-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2018-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2018-2025 Milan Broz
  */
 
 #include <errno.h>
@@ -55,43 +42,36 @@ static int time_ms(struct timespec *start, struct timespec *end, double *ms)
 	return 0;
 }
 
-static int cipher_perf_one(const char *name, const char *mode, char *buffer, size_t buffer_size,
-			  const char *key, size_t key_size, const char *iv, size_t iv_size, int enc)
+static int cipher_perf_one(struct crypt_cipher_kernel *cipher, char *buffer, size_t buffer_size,
+			   const char *iv, size_t iv_size, int enc)
 {
-	struct crypt_cipher_kernel cipher;
 	size_t done = 0, block = CIPHER_BLOCK_BYTES;
 	int r;
 
 	if (buffer_size < block)
 		block = buffer_size;
 
-	r = crypt_cipher_init_kernel(&cipher, name, mode, key, key_size);
-	if (r < 0)
-		return r;
-
 	while (done < buffer_size) {
 		if ((done + block) > buffer_size)
 			block = buffer_size - done;
 
 		if (enc)
-			r = crypt_cipher_encrypt_kernel(&cipher, &buffer[done], &buffer[done],
+			r = crypt_cipher_encrypt_kernel(cipher, &buffer[done], &buffer[done],
 						 block, iv, iv_size);
 		else
-			r = crypt_cipher_decrypt_kernel(&cipher, &buffer[done], &buffer[done],
+			r = crypt_cipher_decrypt_kernel(cipher, &buffer[done], &buffer[done],
 						 block, iv, iv_size);
 		if (r < 0)
-			break;
+			return r;
 
 		done += block;
 	}
 
-	crypt_cipher_destroy_kernel(&cipher);
-
-	return r;
+	return 0;
 }
-static int cipher_measure(const char *name, const char *mode, char *buffer, size_t buffer_size,
-			  const char *key, size_t key_size, const char *iv, size_t iv_size,
-			  int encrypt, double *ms)
+
+static int cipher_measure(struct crypt_cipher_kernel *cipher, char *buffer, size_t buffer_size,
+			  const char *iv, size_t iv_size, int encrypt, double *ms)
 {
 	struct timespec start, end;
 	int r;
@@ -103,7 +83,7 @@ static int cipher_measure(const char *name, const char *mode, char *buffer, size
 	if (clock_gettime(CLOCK_MONOTONIC_RAW, &start) < 0)
 		return -EINVAL;
 
-	r = cipher_perf_one(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, encrypt);
+	r = cipher_perf_one(cipher, buffer, buffer_size, iv, iv_size, encrypt);
 	if (r < 0)
 		return r;
 
@@ -131,15 +111,20 @@ int crypt_cipher_perf_kernel(const char *name, const char *mode, char *buffer, s
 			     const char *key, size_t key_size, const char *iv, size_t iv_size,
 			     double *encryption_mbs, double *decryption_mbs)
 {
+	struct crypt_cipher_kernel cipher;
 	double ms_enc, ms_dec, ms;
 	int r, repeat_enc, repeat_dec;
 
+	r = crypt_cipher_init_kernel(&cipher, name, mode, key, key_size);
+	if (r < 0)
+		return r;
+
 	ms_enc = 0.0;
 	repeat_enc = 1;
 	while (ms_enc < 1000.0) {
-		r = cipher_measure(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, 1, &ms);
+		r = cipher_measure(&cipher, buffer, buffer_size, iv, iv_size, 1, &ms);
 		if (r < 0)
-			return r;
+			goto out;
 		ms_enc += ms;
 		repeat_enc++;
 	}
@@ -147,9 +132,9 @@ int crypt_cipher_perf_kernel(const char *name, const char *mode, char *buffer, s
 	ms_dec = 0.0;
 	repeat_dec = 1;
 	while (ms_dec < 1000.0) {
-		r = cipher_measure(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, 0, &ms);
+		r = cipher_measure(&cipher, buffer, buffer_size, iv, iv_size, 0, &ms);
 		if (r < 0)
-			return r;
+			goto out;
 		ms_dec += ms;
 		repeat_dec++;
 	}
@@ -157,5 +142,8 @@ int crypt_cipher_perf_kernel(const char *name, const char *mode, char *buffer, s
 	*encryption_mbs = speed_mbs(buffer_size * repeat_enc, ms_enc);
 	*decryption_mbs = speed_mbs(buffer_size * repeat_dec, ms_dec);
 
-	return  0;
+	r = 0;
+out:
+	crypt_cipher_destroy_kernel(&cipher);
+	return r;
 }

lib/crypto_backend/cipher_generic.c

@@ -1,27 +1,13 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Linux kernel cipher generic utilities
  *
- * Copyright (C) 2018-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2018-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2018-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2018-2025 Milan Broz
  */
 
-#include <string.h>
-#include <stdbool.h>
 #include <errno.h>
+#include <strings.h>
 #include "crypto_backend.h"
 
 struct cipher_alg {
@@ -51,6 +37,7 @@ static const struct cipher_alg cipher_algs[] = {
 	{ "xchacha12,aes", "adiantum", 32, false },
 	{ "xchacha20,aes", "adiantum", 32, false },
 	{ "sm4",         NULL, 16, false },
+	{ "aria",        NULL, 16, false },
 	{ NULL,          NULL,  0, false }
 };
 
@@ -75,6 +62,9 @@ int crypt_cipher_ivsize(const char *name, const char *mode)
 	if (!ca)
 		return -EINVAL;
 
+	if (mode && !strcasecmp(mode, "hctr2"))
+		return 32;
+
 	if (mode && !strcasecmp(mode, "ecb"))
 		return 0;
 

lib/crypto_backend/crc32.c

@@ -38,8 +38,6 @@
  *
  */
 
-#include <stdio.h>
-
 #include "crypto_backend.h"
 
 static const uint32_t crc32_tab[] = {
@@ -158,7 +156,7 @@ static const uint32_t crc32c_tab[] = {
  * whatever they need.
  */
 static uint32_t compute_crc32(
-	const uint32_t *crc32_tab,
+	const uint32_t *crc32_table,
 	uint32_t seed,
 	const unsigned char *buf,
 	size_t len)
@@ -167,7 +165,7 @@ static uint32_t compute_crc32(
 	const unsigned char *p = buf;
 
 	while(len-- > 0)
-		crc = crc32_tab[(crc ^ *p++) & 0xff] ^ (crc >> 8);
+		crc = crc32_table[(crc ^ *p++) & 0xff] ^ (crc >> 8);
 
 	return crc;
 }

lib/crypto_backend/crypto_backend.h

@@ -1,23 +1,11 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
+
 #ifndef _CRYPTO_BACKEND_H
 #define _CRYPTO_BACKEND_H
 
@@ -26,13 +14,17 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <string.h>
-#ifdef HAVE_UCHAR_H
+#if HAVE_UCHAR_H
 #include <uchar.h>
 #else
 #define char32_t uint32_t
 #define char16_t uint16_t
 #endif
 
+# ifdef __cplusplus
+extern "C" {
+# endif
+
 struct crypt_hash;
 struct crypt_hmac;
 struct crypt_cipher;
@@ -43,9 +35,11 @@ void crypt_backend_destroy(void);
 
 #define CRYPT_BACKEND_KERNEL     (1 << 0) /* Crypto uses kernel part, for benchmark */
 #define CRYPT_BACKEND_PBKDF2_INT (1 << 1) /* Iteration in PBKDF2 is signed int and can overflow */
+#define CRYPT_BACKEND_ARGON2     (1 << 2) /* Backend provides native Argon2 implementation */
 
 uint32_t crypt_backend_flags(void);
 const char *crypt_backend_version(void);
+const char *crypt_argon2_version(void);
 
 /* HASH */
 int crypt_hash_size(const char *name);
@@ -99,6 +93,7 @@ int crypt_base64_decode(char **out, size_t *out_length, const char *in, size_t i
 /* UTF8/16 */
 int crypt_utf16_to_utf8(char **out, const char16_t *s, size_t length /* bytes! */);
 int crypt_utf8_to_utf16(char16_t **out, const char *s, size_t length);
+size_t crypt_char16_strlen(const char16_t *s);
 
 /* Block ciphers */
 int crypt_cipher_ivsize(const char *name, const char *mode);
@@ -142,15 +137,10 @@ int crypt_bitlk_decrypt_key(const void *key, size_t key_length,
 			    const char *tag, size_t tag_length);
 
 /* Memzero helper (memset on stack can be optimized out) */
-static inline void crypt_backend_memzero(void *s, size_t n)
-{
-#ifdef HAVE_EXPLICIT_BZERO
-	explicit_bzero(s, n);
-#else
-	volatile uint8_t *p = (volatile uint8_t *)s;
-	while(n--) *p++ = 0;
-#endif
-}
+void crypt_backend_memzero(void *s, size_t n);
+
+/* Memcpy helper to avoid spilling sensitive data through additional registers */
+void *crypt_backend_memcpy(void *dst, const void *src, size_t n);
 
 /* Memcmp helper (memcmp in constant time) */
 int crypt_backend_memeq(const void *m1, const void *m2, size_t n);
@@ -158,4 +148,8 @@ int crypt_backend_memeq(const void *m1, const void *m2, size_t n);
 /* crypto backend running in FIPS mode */
 bool crypt_fips_mode(void);
 
+# ifdef __cplusplus
+}
+# endif
+
 #endif /* _CRYPTO_BACKEND_H */

lib/crypto_backend/crypto_backend_internal.h

@@ -1,29 +1,17 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
+
 #ifndef _CRYPTO_BACKEND_INTERNAL_H
 #define _CRYPTO_BACKEND_INTERNAL_H
 
 #include "crypto_backend.h"
 
-/* internal PBKDF2 implementation */
+/* Internal PBKDF2 implementation */
 int pkcs5_pbkdf2(const char *hash,
 		 const char *P, size_t Plen,
 		 const char *S, size_t Slen,
@@ -59,17 +47,6 @@ int crypt_bitlk_decrypt_key_kernel(const void *key, size_t key_length,
 				   const char *tag, size_t tag_length);
 
 /* Internal implementation for constant time memory comparison */
-static inline int crypt_internal_memeq(const void *m1, const void *m2, size_t n)
-{
-	const unsigned char *_m1 = (const unsigned char *) m1;
-	const unsigned char *_m2 = (const unsigned char *) m2;
-	unsigned char result = 0;
-	size_t i;
-
-	for (i = 0; i < n; i++)
-		result |= _m1[i] ^ _m2[i];
-
-	return result;
-}
+int crypt_internal_memeq(const void *m1, const void *m2, size_t n);
 
 #endif /* _CRYPTO_BACKEND_INTERNAL_H */

lib/crypto_backend/crypto_cipher_kernel.c

@@ -1,35 +1,20 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Linux kernel userspace API crypto backend implementation (skcipher)
  *
- * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2012-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2012-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2025 Milan Broz
  */
 
-#include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
-#include <stdbool.h>
 #include <errno.h>
 #include <unistd.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include "crypto_backend_internal.h"
 
-#ifdef ENABLE_AF_ALG
+#if ENABLE_AF_ALG
 
 #include <linux/if_alg.h>
 
@@ -55,6 +40,8 @@ static int _crypt_cipher_init(struct crypt_cipher_kernel *ctx,
 			      const void *key, size_t key_length,
 			      size_t tag_length, struct sockaddr_alg *sa)
 {
+	void *optval = NULL;
+
 	if (!ctx)
 		return -EINVAL;
 
@@ -75,7 +62,7 @@ static int _crypt_cipher_init(struct crypt_cipher_kernel *ctx,
 		return -EINVAL;
 	}
 
-	if (tag_length && setsockopt(ctx->tfmfd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, tag_length) < 0) {
+	if (tag_length && setsockopt(ctx->tfmfd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, &optval, tag_length) < 0) {
 		crypt_cipher_destroy_kernel(ctx);
 		return -EINVAL;
 	}
@@ -101,14 +88,33 @@ int crypt_cipher_init_kernel(struct crypt_cipher_kernel *ctx, const char *name,
 	if (!strcmp(name, "cipher_null"))
 		key_length = 0;
 
-	r = snprintf((char *)sa.salg_name, sizeof(sa.salg_name), "%s(%s)", mode, name);
-	if (r < 0 || (size_t)r >= sizeof(sa.salg_name))
-		return -EINVAL;
+	if (!strncmp(name, "capi:", 5))
+		strncpy((char *)sa.salg_name, &name[5], sizeof(sa.salg_name) - 1);
+	else {
+		r = snprintf((char *)sa.salg_name, sizeof(sa.salg_name), "%s(%s)", mode, name);
+		if (r < 0 || (size_t)r >= sizeof(sa.salg_name))
+			return -EINVAL;
+	}
 
 	return _crypt_cipher_init(ctx, key, key_length, 0, &sa);
 }
 
+/* musl has broken CMSG_NXTHDR macro in system headers */
+static inline struct cmsghdr *_CMSG_NXTHDR(struct msghdr* mhdr, struct cmsghdr* cmsg)
+{
+#if !defined(__GLIBC__) && defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wcast-align"
+#pragma clang diagnostic ignored "-Wsign-compare"
+	return CMSG_NXTHDR(mhdr, cmsg);
+#pragma clang diagnostic pop
+#else
+	return CMSG_NXTHDR(mhdr, cmsg);
+#endif
+}
+
 /* The in/out should be aligned to page boundary */
+/* coverity[ -taint_source : arg-3 ] */
 static int _crypt_cipher_crypt(struct crypt_cipher_kernel *ctx,
 			       const char *in, size_t in_length,
 			       char *out, size_t out_length,
@@ -154,7 +160,7 @@ static int _crypt_cipher_crypt(struct crypt_cipher_kernel *ctx,
 
 	/* Set IV */
 	if (iv) {
-		header = CMSG_NXTHDR(&msg, header);
+		header = _CMSG_NXTHDR(&msg, header);
 		if (!header)
 			return -EINVAL;
 
@@ -163,7 +169,7 @@ static int _crypt_cipher_crypt(struct crypt_cipher_kernel *ctx,
 		header->cmsg_len = iv_msg_size;
 		alg_iv = (void*)CMSG_DATA(header);
 		alg_iv->ivlen = iv_length;
-		memcpy(alg_iv->iv, iv, iv_length);
+		crypt_backend_memcpy(alg_iv->iv, iv, iv_length);
 	}
 
 	len = sendmsg(ctx->opfd, &msg, 0);
@@ -210,8 +216,8 @@ int crypt_cipher_check_kernel(const char *name, const char *mode,
 			      const char *integrity, size_t key_length)
 {
 	struct crypt_cipher_kernel c;
-	char mode_name[64], tmp_salg_name[180], *real_mode = NULL, *cipher_iv = NULL, *key;
-	const char *salg_type;
+	char mode_name[64], tmp_salg_name[180], *cipher_iv = NULL, *key;
+	const char *salg_type, *real_mode;
 	bool aead;
 	int r;
 	struct sockaddr_alg sa = {
@@ -219,6 +225,7 @@ int crypt_cipher_check_kernel(const char *name, const char *mode,
 	};
 
 	aead = integrity && strcmp(integrity, "none");
+	real_mode = NULL;
 
 	/* Remove IV if present */
 	if (mode) {
@@ -239,14 +246,22 @@ int crypt_cipher_check_kernel(const char *name, const char *mode,
 	memset(tmp_salg_name, 0, sizeof(tmp_salg_name));
 
 	/* FIXME: this is duplicating a part of devmapper backend */
-	if (aead && !strcmp(integrity, "poly1305"))
-		r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc7539(%s,%s)", name, integrity);
-	else if (!real_mode)
-		r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s", name);
-	else if (aead && !strcmp(real_mode, "ccm"))
-		r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc4309(%s(%s))", real_mode, name);
-	else
-		r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s(%s)", real_mode, name);
+	if (aead) {
+		/* In AEAD, mode parameter can be just IV like "random" */
+		if (!strcmp(integrity, "poly1305"))
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc7539(%s,%s)", name, integrity);
+		else if (!real_mode)
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s", name);
+		else if (!strcmp(real_mode, "ccm"))
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc4309(%s(%s))", real_mode, name);
+		else
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s(%s)", real_mode, name);
+	} else {
+		if (!mode)
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s", name);
+		else
+			r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s(%s)", real_mode ?: mode_name, name);
+	}
 
 	if (r < 0 || (size_t)r >= sizeof(tmp_salg_name))
 		return -EINVAL;
@@ -312,6 +327,8 @@ int crypt_bitlk_decrypt_key_kernel(const void *key, size_t key_length,
 }
 
 #else /* ENABLE_AF_ALG */
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+
 int crypt_cipher_init_kernel(struct crypt_cipher_kernel *ctx, const char *name,
 			     const char *mode, const void *key, size_t key_length)
 {

lib/crypto_backend/crypto_gcrypt.c

@@ -1,28 +1,16 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * GCRYPT crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
 
-#include <string.h>
 #include <stdio.h>
 #include <errno.h>
+#include <strings.h>
 #include <gcrypt.h>
+#include <pthread.h>
 #include "crypto_backend_internal.h"
 
 static int crypto_backend_initialised = 0;
@@ -63,7 +51,6 @@ static void crypt_hash_test_whirlpool_bug(void)
 {
 	struct crypt_hash *h;
 	char buf[2] = "\0\0", hash_out1[64], hash_out2[64];
-	int r;
 
 	if (crypto_backend_whirlpool_bug >= 0)
 		return;
@@ -73,16 +60,16 @@ static void crypt_hash_test_whirlpool_bug(void)
 		return;
 
 	/* One shot */
-	if ((r = crypt_hash_write(h, &buf[0], 2)) ||
-	    (r = crypt_hash_final(h, hash_out1, 64))) {
+	if (crypt_hash_write(h, &buf[0], 2) ||
+	    crypt_hash_final(h, hash_out1, 64)) {
 		crypt_hash_destroy(h);
 		return;
 	}
 
 	/* Split buf (crypt_hash_final resets hash state) */
-	if ((r = crypt_hash_write(h, &buf[0], 1)) ||
-	    (r = crypt_hash_write(h, &buf[1], 1)) ||
-	    (r = crypt_hash_final(h, hash_out2, 64))) {
+	if (crypt_hash_write(h, &buf[0], 1) ||
+	    crypt_hash_write(h, &buf[1], 1) ||
+	    crypt_hash_final(h, hash_out2, 64)) {
 		crypt_hash_destroy(h);
 		return;
 	}
@@ -126,10 +113,11 @@ int crypt_backend_init(bool fips __attribute__((unused)))
 	crypto_backend_initialised = 1;
 	crypt_hash_test_whirlpool_bug();
 
-	r = snprintf(version, sizeof(version), "gcrypt %s%s%s",
+	r = snprintf(version, sizeof(version), "gcrypt %s%s%s%s",
 		 gcry_check_version(NULL),
 		 crypto_backend_secmem ? "" : ", secmem disabled",
-		 crypto_backend_whirlpool_bug > 0 ? ", flawed whirlpool" : "");
+		 crypto_backend_whirlpool_bug > 0 ? ", flawed whirlpool" : "",
+		 crypt_backend_flags() & CRYPT_BACKEND_ARGON2 ? ", argon2" : "");
 	if (r < 0 || (size_t)r >= sizeof(version))
 		return -EINVAL;
 
@@ -151,7 +139,11 @@ const char *crypt_backend_version(void)
 
 uint32_t crypt_backend_flags(void)
 {
-	return 0;
+	uint32_t flags = 0;
+#if HAVE_DECL_GCRY_KDF_ARGON2 && !USE_INTERNAL_ARGON2
+	flags |= CRYPT_BACKEND_ARGON2;
+#endif
+	return flags;
 }
 
 static const char *crypt_hash_compat_name(const char *name, unsigned int *flags)
@@ -257,7 +249,7 @@ int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length)
 	if (!hash)
 		return -EINVAL;
 
-	memcpy(buffer, hash, length);
+	crypt_backend_memcpy(buffer, hash, length);
 	crypt_hash_restart(ctx);
 
 	return 0;
@@ -266,7 +258,6 @@ int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length)
 void crypt_hash_destroy(struct crypt_hash *ctx)
 {
 	gcry_md_close(ctx->hd);
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 
@@ -332,7 +323,7 @@ int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length)
 	if (!hash)
 		return -EINVAL;
 
-	memcpy(buffer, hash, length);
+	crypt_backend_memcpy(buffer, hash, length);
 	crypt_hmac_restart(ctx);
 
 	return 0;
@@ -341,7 +332,6 @@ int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length)
 void crypt_hmac_destroy(struct crypt_hmac *ctx)
 {
 	gcry_md_close(ctx->hd);
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 
@@ -386,6 +376,130 @@ static int pbkdf2(const char *hash,
 #endif /* USE_INTERNAL_PBKDF2 */
 }
 
+#if HAVE_DECL_GCRY_KDF_ARGON2 && !USE_INTERNAL_ARGON2
+struct gcrypt_thread_job
+{
+	pthread_t thread;
+	struct job_thread_param {
+		gcry_kdf_job_fn_t job;
+		void *p;
+	} work;
+};
+
+struct gcrypt_threads
+{
+	pthread_attr_t attr;
+	unsigned int num_threads;
+	unsigned int max_threads;
+	struct gcrypt_thread_job *jobs_ctx;
+};
+
+static void *gcrypt_job_thread(void *p)
+{
+	struct job_thread_param *param = p;
+	param->job(param->p);
+	pthread_exit(NULL);
+}
+
+static int gcrypt_wait_all_jobs(void *ctx)
+{
+	unsigned int i;
+	struct gcrypt_threads *threads = ctx;
+
+	for (i = 0; i < threads->num_threads; i++) {
+		pthread_join(threads->jobs_ctx[i].thread, NULL);
+		threads->jobs_ctx[i].thread = 0;
+	}
+
+	threads->num_threads = 0;
+	return 0;
+}
+
+static int gcrypt_dispatch_job(void *ctx, gcry_kdf_job_fn_t job, void *p)
+{
+	struct gcrypt_threads *threads = ctx;
+
+	if (threads->num_threads >= threads->max_threads)
+		return -1;
+
+	threads->jobs_ctx[threads->num_threads].work.job = job;
+	threads->jobs_ctx[threads->num_threads].work.p = p;
+
+	if (pthread_create(&threads->jobs_ctx[threads->num_threads].thread, &threads->attr,
+			   gcrypt_job_thread, &threads->jobs_ctx[threads->num_threads].work))
+		return -1;
+
+	threads->num_threads++;
+	return 0;
+}
+
+static int gcrypt_argon2(const char *type,
+	const char *password, size_t password_length,
+	const char *salt, size_t salt_length,
+	char *key, size_t key_length,
+	uint32_t iterations, uint32_t memory, uint32_t parallel)
+{
+	gcry_kdf_hd_t hd;
+	int atype, r = -EINVAL;
+	unsigned long param[4];
+	struct gcrypt_threads threads = {
+		.max_threads = parallel,
+		.num_threads = 0
+	};
+	const gcry_kdf_thread_ops_t ops = {
+		.jobs_context = &threads,
+		.dispatch_job = gcrypt_dispatch_job,
+		.wait_all_jobs = gcrypt_wait_all_jobs
+	};
+	gpg_error_t err;
+
+	if (!strcmp(type, "argon2i"))
+		atype = GCRY_KDF_ARGON2I;
+	else if (!strcmp(type, "argon2id"))
+		atype = GCRY_KDF_ARGON2ID;
+	else
+		return -EINVAL;
+
+	param[0] = key_length;
+	param[1] = iterations;
+	param[2] = memory;
+	param[3] = parallel;
+
+	err = gcry_kdf_open(&hd, GCRY_KDF_ARGON2, atype, param, 4,
+			password, password_length, salt, salt_length,
+			NULL, 0, NULL, 0);
+	if (err)
+		return ((err & GPG_ERR_CODE_MASK) == GPG_ERR_ENOMEM) ? -ENOMEM : -EINVAL;
+
+	if (parallel == 1) {
+		/* Do not use threads here */
+		if (gcry_kdf_compute(hd, NULL))
+			goto out;
+	} else {
+		threads.jobs_ctx = calloc(threads.max_threads,
+				      sizeof(struct gcrypt_thread_job));
+		if (!threads.jobs_ctx)
+			goto out;
+
+		if (pthread_attr_init(&threads.attr))
+			goto out;
+
+		if (gcry_kdf_compute(hd, &ops))
+			goto out;
+	}
+
+	if (gcry_kdf_final(hd, key_length, key))
+		goto out;
+	r = 0;
+out:
+	gcry_kdf_close(hd);
+	pthread_attr_destroy(&threads.attr);
+	free(threads.jobs_ctx);
+
+	return r;
+}
+#endif
+
 /* PBKDF */
 int crypt_pbkdf(const char *kdf, const char *hash,
 		const char *password, size_t password_length,
@@ -400,8 +514,13 @@ int crypt_pbkdf(const char *kdf, const char *hash,
 		return pbkdf2(hash, password, password_length, salt, salt_length,
 			      key, key_length, iterations);
 	else if (!strncmp(kdf, "argon2", 6))
+#if HAVE_DECL_GCRY_KDF_ARGON2 && !USE_INTERNAL_ARGON2
+		return gcrypt_argon2(kdf, password, password_length, salt, salt_length,
+				     key, key_length, iterations, memory, parallel);
+#else
 		return argon2(kdf, password, password_length, salt, salt_length,
 			      key, key_length, iterations, memory, parallel);
+#endif
 	return -EINVAL;
 }
 
@@ -565,6 +684,9 @@ bool crypt_fips_mode(void)
 	if (fips_checked)
 		return fips_mode;
 
+	if (crypt_backend_init(false /* ignored */))
+		return false;
+
 	fips_mode = gcry_fips_mode_active();
 	fips_checked = true;
 

lib/crypto_backend/crypto_kernel.c

@@ -1,25 +1,11 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Linux kernel userspace API crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
 
-#include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
@@ -245,7 +231,6 @@ void crypt_hash_destroy(struct crypt_hash *ctx)
 		close(ctx->tfmfd);
 	if (ctx->opfd >= 0)
 		close(ctx->opfd);
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 
@@ -324,7 +309,6 @@ void crypt_hmac_destroy(struct crypt_hmac *ctx)
 		close(ctx->tfmfd);
 	if (ctx->opfd >= 0)
 		close(ctx->opfd);
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 

lib/crypto_backend/crypto_mbedtls.c

@@ -0,0 +1,535 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
+/*
+ * Mbed TLS crypto backend implementation
+ *
+ * Copyright (C) 2024-2025 Yiyuan Zhong
+ */
+
+#include "crypto_backend.h"
+
+#include <errno.h>
+#include <stdlib.h>
+
+#include <mbedtls/ccm.h>
+#include <mbedtls/constant_time.h>
+#include <mbedtls/cipher.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/md.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/version.h>
+
+#include "crypto_backend_internal.h"
+
+struct crypt_hash {
+	const mbedtls_md_info_t *info;
+	mbedtls_md_context_t md;
+};
+
+struct crypt_hmac {
+	const mbedtls_md_info_t *info;
+	mbedtls_md_context_t md;
+};
+
+struct crypt_cipher {
+	const mbedtls_cipher_info_t *info;
+	mbedtls_cipher_context_t enc;
+	mbedtls_cipher_context_t dec;
+	int ecb;
+};
+
+static bool g_initialized = false;
+static char g_backend_version[32];
+static mbedtls_entropy_context g_entropy;
+static mbedtls_ctr_drbg_context g_ctr_drbg;
+
+static const mbedtls_md_info_t *crypt_get_hash(const char *name)
+{
+	static const struct hash_alg {
+		const char *name;
+		mbedtls_md_type_t type;
+	} kHash[] = {
+		{"sha1",      MBEDTLS_MD_SHA1     },
+		{"sha224",    MBEDTLS_MD_SHA224   },
+		{"sha256",    MBEDTLS_MD_SHA256   },
+		{"sha384",    MBEDTLS_MD_SHA384   },
+		{"sha512",    MBEDTLS_MD_SHA512   },
+		{"ripemd160", MBEDTLS_MD_RIPEMD160},
+		{NULL,        0,                  }
+	};
+
+	size_t i = 0;
+
+	while (name && kHash[i].name) {
+		if (strcmp(kHash[i].name, name) == 0)
+			return mbedtls_md_info_from_type(kHash[i].type);
+		i++;
+	}
+
+	return NULL;
+}
+
+int crypt_backend_init(bool fips)
+{
+	int ret;
+
+	if (g_initialized)
+		return 0;
+
+	if (fips)
+		return -ENOTSUP;
+
+	mbedtls_version_get_string_full(g_backend_version);
+
+	mbedtls_entropy_init(&g_entropy);
+	mbedtls_ctr_drbg_init(&g_ctr_drbg);
+
+	ret = mbedtls_ctr_drbg_seed(
+		&g_ctr_drbg, mbedtls_entropy_func,
+		&g_entropy, NULL, MBEDTLS_CTR_DRBG_ENTROPY_LEN);
+
+	if (ret)
+		return -EINVAL;
+
+	g_initialized = true;
+	return 0;
+}
+
+void crypt_backend_destroy(void)
+{
+	if (!g_initialized)
+		return;
+
+	mbedtls_ctr_drbg_free(&g_ctr_drbg);
+	mbedtls_entropy_free(&g_entropy);
+	g_initialized = false;
+}
+
+uint32_t crypt_backend_flags(void)
+{
+	return 0;
+}
+
+const char *crypt_backend_version(void)
+{
+	return g_backend_version;
+}
+
+bool crypt_fips_mode(void)
+{
+	return false;
+}
+
+int crypt_backend_memeq(const void *m1, const void *m2, size_t n)
+{
+	return mbedtls_ct_memcmp(m1, m2, n);
+}
+
+/* HASH */
+int crypt_hash_size(const char *name)
+{
+	const mbedtls_md_info_t *info;
+	info = crypt_get_hash(name);
+	return info ? mbedtls_md_get_size(info) : -ENOENT;
+}
+
+int crypt_hash_init(struct crypt_hash **ctx, const char *name)
+{
+	struct crypt_hash *h;
+
+	h = malloc(sizeof(*h));
+	if (!h)
+		return -ENOMEM;
+
+	h->info = crypt_get_hash(name);
+	if (!h->info) {
+		free(h);
+		return -ENOENT;
+	}
+
+	mbedtls_md_init(&h->md);
+
+	if (mbedtls_md_setup(&h->md, h->info, 0)) {
+		mbedtls_md_free(&h->md);
+		free(h);
+		return -EINVAL;
+	}
+
+	if (mbedtls_md_starts(&h->md)) {
+		mbedtls_md_free(&h->md);
+		free(h);
+		return -EINVAL;
+	}
+
+	*ctx = h;
+	return 0;
+}
+
+int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length)
+{
+	if (mbedtls_md_update(&ctx->md, (const unsigned char *)buffer, length))
+		return -EINVAL;
+
+	return 0;
+}
+
+int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length)
+{
+	unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
+
+	if (length > mbedtls_md_get_size(ctx->info))
+		return -EINVAL;
+
+	if (mbedtls_md_finish(&ctx->md, tmp))
+		return -EINVAL;
+
+	crypt_backend_memcpy(buffer, tmp, length);
+	crypt_backend_memzero(tmp, sizeof(tmp));
+
+	if (mbedtls_md_starts(&ctx->md))
+		return -EINVAL;
+
+	return 0;
+}
+
+void crypt_hash_destroy(struct crypt_hash *ctx)
+{
+	mbedtls_md_free(&ctx->md);
+	crypt_backend_memzero(ctx, sizeof(*ctx));
+	free(ctx);
+}
+
+/* HMAC */
+int crypt_hmac_size(const char *name)
+{
+	return crypt_hash_size(name);
+}
+
+int crypt_hmac_init(struct crypt_hmac **ctx, const char *name,
+		    const void *key, size_t key_length)
+{
+	struct crypt_hmac *h;
+
+	h = malloc(sizeof(*h));
+	if (!h)
+		return -ENOMEM;
+
+	h->info = crypt_get_hash(name);
+	if (!h->info) {
+		free(h);
+		return -ENOENT;
+	}
+
+	mbedtls_md_init(&h->md);
+
+	if (mbedtls_md_setup(&h->md, h->info, 1)) {
+		mbedtls_md_free(&h->md);
+		free(h);
+		return -EINVAL;
+	}
+
+	if (mbedtls_md_hmac_starts(&h->md, key, key_length)) {
+		mbedtls_md_free(&h->md);
+		free(h);
+		return -EINVAL;
+	}
+
+	*ctx = h;
+	return 0;
+}
+
+int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length)
+{
+	if (mbedtls_md_hmac_update(&ctx->md, (const unsigned char *)buffer, length))
+		return -EINVAL;
+
+	return 0;
+}
+
+int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length)
+{
+	unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
+
+	if (length > mbedtls_md_get_size(ctx->info))
+		return -EINVAL;
+
+	if (mbedtls_md_hmac_finish(&ctx->md, tmp))
+		return -EINVAL;
+
+	crypt_backend_memcpy(buffer, tmp, length);
+	crypt_backend_memzero(tmp, sizeof(tmp));
+
+	if (mbedtls_md_hmac_reset(&ctx->md))
+		return -EINVAL;
+
+	return 0;
+}
+
+void crypt_hmac_destroy(struct crypt_hmac *ctx)
+{
+	mbedtls_md_free(&ctx->md);
+	crypt_backend_memzero(ctx, sizeof(*ctx));
+	free(ctx);
+}
+
+/* RNG */
+int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
+{
+	if (fips)
+		return -ENOTSUP;
+
+	/* Allow skipping reseeding for non-cryptographic strong random numbers */
+	if (quality == CRYPT_RND_NORMAL || quality == CRYPT_RND_SALT)
+		mbedtls_ctr_drbg_set_prediction_resistance(&g_ctr_drbg, MBEDTLS_CTR_DRBG_PR_OFF);
+	else
+		mbedtls_ctr_drbg_set_prediction_resistance(&g_ctr_drbg, MBEDTLS_CTR_DRBG_PR_ON);
+
+	if (mbedtls_ctr_drbg_random(&g_ctr_drbg, (unsigned char *)buffer, length))
+		return -EINVAL;
+
+	return 0;
+}
+
+/* CIPHER */
+int crypt_cipher_init(struct crypt_cipher **ctx, const char *name,
+		      const char *mode, const void *key, size_t key_length)
+{
+	static const struct {
+		const char *name;
+		mbedtls_cipher_id_t id;
+	} kCipher[] = {
+		{ "aes",      MBEDTLS_CIPHER_ID_AES      },
+		{ "aria",     MBEDTLS_CIPHER_ID_ARIA     },
+		{ "camellia", MBEDTLS_CIPHER_ID_CAMELLIA },
+		{ NULL,       0                          }
+	};
+
+	static const struct {
+		const char *name;
+		mbedtls_cipher_mode_t mode;
+	} kMode[] = {
+		{ "ecb", MBEDTLS_MODE_ECB },
+		{ "cbc", MBEDTLS_MODE_CBC },
+		{ "cfb", MBEDTLS_MODE_CFB },
+		{ "ofb", MBEDTLS_MODE_OFB },
+		{ "ctr", MBEDTLS_MODE_CTR },
+		{ "xts", MBEDTLS_MODE_XTS },
+		{ NULL,  0                }
+	};
+
+	mbedtls_cipher_id_t cid = MBEDTLS_CIPHER_ID_NONE;
+	mbedtls_cipher_mode_t cmode = MBEDTLS_MODE_NONE;
+	struct crypt_cipher *h;
+	size_t i;
+	int bits;
+
+	for (i = 0; kCipher[i].name; i++) {
+		if (strcmp(kCipher[i].name, name) == 0) {
+			cid = kCipher[i].id;
+			break;
+		}
+	}
+
+	for (i = 0; kMode[i].name; i++) {
+		if (strcmp(kMode[i].name, mode) == 0) {
+			cmode = kMode[i].mode;
+			break;
+		}
+	}
+
+	if (cid == MBEDTLS_CIPHER_ID_NONE || cmode == MBEDTLS_MODE_NONE)
+		return -ENOENT;
+
+	h = malloc(sizeof(*h));
+	if (!h)
+		return -ENOMEM;
+
+	bits = key_length * 8;
+	h->info = mbedtls_cipher_info_from_values(cid, bits, cmode);
+	if (!h->info) {
+		free(h);
+		return -ENOENT;
+	}
+
+	mbedtls_cipher_init(&h->enc);
+	mbedtls_cipher_init(&h->dec);
+	if (mbedtls_cipher_setup(&h->enc, h->info)                     ||
+	    mbedtls_cipher_setup(&h->dec, h->info)                     ||
+	    mbedtls_cipher_setkey(&h->enc, key, bits, MBEDTLS_ENCRYPT) ||
+	    mbedtls_cipher_setkey(&h->dec, key, bits, MBEDTLS_DECRYPT)) {
+
+		mbedtls_cipher_free(&h->dec);
+		mbedtls_cipher_free(&h->enc);
+		free(h);
+		return -EINVAL;
+	}
+
+	if (cmode == MBEDTLS_MODE_CBC) {
+		if (mbedtls_cipher_set_padding_mode(&h->enc, MBEDTLS_PADDING_NONE) ||
+		    mbedtls_cipher_set_padding_mode(&h->dec, MBEDTLS_PADDING_NONE)) {
+
+			mbedtls_cipher_free(&h->dec);
+			mbedtls_cipher_free(&h->enc);
+			free(h);
+			return -EINVAL;
+		}
+	}
+
+	h->ecb = cmode == MBEDTLS_MODE_ECB;
+	*ctx = h;
+	return 0;
+}
+
+void crypt_cipher_destroy(struct crypt_cipher *ctx)
+{
+	mbedtls_cipher_free(&ctx->dec);
+	mbedtls_cipher_free(&ctx->enc);
+	free(ctx);
+}
+
+static int crypt_cipher_crypt(
+	mbedtls_cipher_context_t *ctx,
+	const char *in, char *out, size_t length,
+	const char *iv, size_t iv_length,
+	int ecb)
+{
+	const unsigned char *input;
+	unsigned char *output;
+	size_t outlen;
+	size_t block;
+	size_t len;
+
+	if (ecb) /* ECB requires exactly block length input */
+		block = mbedtls_cipher_get_block_size(ctx);
+	else
+		block = length;
+
+	input = (const unsigned char *)in;
+	output = (unsigned char *)out;
+
+	if (mbedtls_cipher_set_iv(ctx, (const unsigned char *)iv, iv_length))
+		return -EINVAL;
+
+	if (mbedtls_cipher_reset(ctx))
+		return -EINVAL;
+
+	while (length) {
+		len = length < block ? length : block;
+		if (mbedtls_cipher_update(ctx, input, len, output, &outlen))
+			return -EINVAL;
+
+		output += outlen;
+		length -= len;
+		input += len;
+	}
+
+	if (mbedtls_cipher_finish(ctx, output, &outlen))
+		return -EINVAL;
+
+	return 0;
+}
+
+int crypt_cipher_encrypt(struct crypt_cipher *ctx,
+                         const char *in, char *out, size_t length,
+                         const char *iv, size_t iv_length)
+{
+	return crypt_cipher_crypt(&ctx->enc, in, out, length, iv, iv_length, ctx->ecb);
+}
+
+int crypt_cipher_decrypt(struct crypt_cipher *ctx,
+                         const char *in, char *out, size_t length,
+                         const char *iv, size_t iv_length)
+{
+	return crypt_cipher_crypt(&ctx->dec, in, out, length, iv, iv_length, ctx->ecb);
+}
+
+bool crypt_cipher_kernel_only(struct crypt_cipher *ctx __attribute__((unused)))
+{
+	return false;
+}
+
+int crypt_pbkdf(const char *kdf, const char *hash,
+                const char *password, size_t password_length,
+                const char *salt, size_t salt_length,
+                char *key, size_t key_length,
+                uint32_t iterations, uint32_t memory, uint32_t parallel)
+{
+	const mbedtls_md_info_t *info;
+#if !HAVE_MBEDTLS_PKCS5_PBKDF2_HMAC_EXT
+	mbedtls_md_context_t md;
+#endif
+
+	if (!kdf)
+		return -EINVAL;
+
+	if (strcmp(kdf, "pbkdf2") == 0) {
+		info = crypt_get_hash(hash);
+		if (!info)
+			return -EINVAL;
+
+#if HAVE_MBEDTLS_PKCS5_PBKDF2_HMAC_EXT
+		if (mbedtls_pkcs5_pbkdf2_hmac_ext(mbedtls_md_get_type(info),
+						  (const unsigned char *)password, password_length,
+						  (const unsigned char *)salt, salt_length,
+						  iterations, key_length, (unsigned char *)key)) {
+
+			return -EINVAL;
+		}
+#else
+		mbedtls_md_init(&md);
+		if (mbedtls_md_setup(&md, info, 1))
+			return -EINVAL;
+
+		if (mbedtls_pkcs5_pbkdf2_hmac(&md,
+					      (const unsigned char *)password, password_length,
+					      (const unsigned char *)salt, salt_length,
+					      iterations, key_length, (unsigned char *)key)) {
+
+			mbedtls_md_free(&md);
+			return -EINVAL;
+		}
+
+		mbedtls_md_free(&md);
+#endif
+		return 0;
+
+	} else if (strncmp(kdf, "argon2", 6) == 0) {
+		return argon2(kdf, password, password_length, salt, salt_length,
+			      key, key_length, iterations, memory, parallel);
+	}
+
+	return -EINVAL;
+}
+
+int crypt_bitlk_decrypt_key(const void *key, size_t key_length,
+                            const char *in, char *out, size_t length,
+                            const char *iv, size_t iv_length,
+                            const char *tag, size_t tag_length)
+{
+	const unsigned char *tagptr;
+	const unsigned char *input;
+	const unsigned char *ivptr;
+	mbedtls_ccm_context ctx;
+	unsigned char *output;
+
+	tagptr = (const unsigned char *)tag;
+	ivptr = (const unsigned char *)iv;
+	input = (const unsigned char *)in;
+	output = (unsigned char *)out;
+	mbedtls_ccm_init(&ctx);
+
+	if (mbedtls_ccm_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, key, key_length * 8)) {
+		mbedtls_ccm_free(&ctx);
+		return -EINVAL;
+	}
+
+	if (mbedtls_ccm_auth_decrypt(&ctx, length, ivptr, iv_length, NULL, 0,
+				     input, output, tagptr, tag_length)) {
+
+		mbedtls_ccm_free(&ctx);
+		return -EINVAL;
+	}
+
+	mbedtls_ccm_free(&ctx);
+	return 0;
+}

lib/crypto_backend/crypto_nettle.c

@@ -1,26 +1,12 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Nettle crypto backend implementation
  *
- * Copyright (C) 2011-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2011-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2011-2025 Milan Broz
  */
 
 #include <stdlib.h>
-#include <string.h>
 #include <errno.h>
 #include <nettle/sha.h>
 #include <nettle/sha3.h>
@@ -298,8 +284,7 @@ int crypt_hmac_init(struct crypt_hmac **ctx, const char *name,
 	h = malloc(sizeof(*h));
 	if (!h)
 		return -ENOMEM;
-	memset(ctx, 0, sizeof(*ctx));
-
+	memset(h, 0, sizeof(*h));
 
 	h->hash = _get_alg(name);
 	if (!h->hash) {
@@ -313,7 +298,7 @@ int crypt_hmac_init(struct crypt_hmac **ctx, const char *name,
 		return -ENOMEM;
 	}
 
-	memcpy(h->key, key, key_length);
+	crypt_backend_memcpy(h->key, key, key_length);
 	h->key_length = key_length;
 
 	h->hash->init(&h->nettle_ctx);

lib/crypto_backend/crypto_nss.c

@@ -1,25 +1,12 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * NSS crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
 
-#include <string.h>
+#include <stdio.h>
 #include <errno.h>
 #include <nss.h>
 #include <pk11pub.h>
@@ -177,7 +164,7 @@ int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length)
 	if (PK11_DigestFinal(ctx->md, tmp, &tmp_len, length) != SECSuccess)
 		return -EINVAL;
 
-	memcpy(buffer, tmp, length);
+	crypt_backend_memcpy(buffer, tmp, length);
 	crypt_backend_memzero(tmp, sizeof(tmp));
 
 	if (tmp_len < length)
@@ -220,8 +207,7 @@ int crypt_hmac_init(struct crypt_hmac **ctx, const char *name,
 	h = malloc(sizeof(*h));
 	if (!h)
 		return -ENOMEM;
-	memset(ctx, 0, sizeof(*ctx));
-
+	memset(h, 0, sizeof(*h));
 
 	h->hash = _get_alg(name);
 	if (!h->hash)
@@ -278,7 +264,7 @@ int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length)
 	if (PK11_DigestFinal(ctx->md, tmp, &tmp_len, length) != SECSuccess)
 		return -EINVAL;
 
-	memcpy(buffer, tmp, length);
+	crypt_backend_memcpy(buffer, tmp, length);
 	crypt_backend_memzero(tmp, sizeof(tmp));
 
 	if (tmp_len < length)

lib/crypto_backend/crypto_openssl.c

@@ -1,36 +1,15 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later WITH cryptsetup-OpenSSL-exception
 /*
  * OPENSSL crypto backend implementation
  *
- * Copyright (C) 2010-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2010-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * In addition, as a special exception, the copyright holders give
- * permission to link the code of portions of this program with the
- * OpenSSL library under certain conditions as described in each
- * individual source file, and distribute linked combinations
- * including the two.
- *
- * You must obey the GNU Lesser General Public License in all respects
- * for all of the code used other than OpenSSL.
+ * Copyright (C) 2010-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2010-2025 Milan Broz
  */
 
-#include <string.h>
+#include <stdio.h>
 #include <errno.h>
 #include <limits.h>
+#include <strings.h>
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
@@ -40,13 +19,25 @@
 #include <openssl/provider.h>
 #include <openssl/kdf.h>
 #include <openssl/core_names.h>
+#include <openssl/err.h>
 static OSSL_PROVIDER *ossl_legacy = NULL;
 static OSSL_PROVIDER *ossl_default = NULL;
 static OSSL_LIB_CTX  *ossl_ctx = NULL;
 static char backend_version[256] = "OpenSSL";
+
+#define MAX_THREADS 8
+#if !HAVE_DECL_OSSL_GET_MAX_THREADS
+static int OSSL_set_max_threads(OSSL_LIB_CTX *ctx __attribute__((unused)),
+				uint64_t max_threads __attribute__((unused))) { return 0; }
+static uint64_t OSSL_get_max_threads(OSSL_LIB_CTX *ctx __attribute__((unused))) { return 0; }
+#else
+#include <openssl/thread.h>
+#endif
+
 #endif
 
 #define CONST_CAST(x) (x)(uintptr_t)
+#define UNUSED(x) (void)(x)
 
 static int crypto_backend_initialised = 0;
 
@@ -162,6 +153,7 @@ static int openssl_backend_init(bool fips)
  */
 #if OPENSSL_VERSION_MAJOR >= 3
 	int r;
+	bool ossl_threads = false;
 
 	/*
 	 * In FIPS mode we keep default OpenSSL context & global config
@@ -181,16 +173,24 @@ static int openssl_backend_init(bool fips)
 		ossl_legacy = OSSL_PROVIDER_try_load(ossl_ctx, "legacy", 0);
 	}
 
-	r = snprintf(backend_version, sizeof(backend_version), "%s %s%s%s",
+	if (OSSL_set_max_threads(ossl_ctx, MAX_THREADS) == 1 &&
+	    OSSL_get_max_threads(ossl_ctx) == MAX_THREADS)
+		ossl_threads = true;
+
+	r = snprintf(backend_version, sizeof(backend_version), "%s %s%s%s%s%s",
 		OpenSSL_version(OPENSSL_VERSION),
 		ossl_default ? "[default]" : "",
 		ossl_legacy  ? "[legacy]" : "",
-		fips  ? "[fips]" : "");
+		fips  ? "[fips]" : "",
+		ossl_threads ? "[threads]" : "",
+		crypt_backend_flags() & CRYPT_BACKEND_ARGON2 ? "[argon2]" : "");
 
 	if (r < 0 || (size_t)r >= sizeof(backend_version)) {
 		openssl_backend_exit();
 		return -EINVAL;
 	}
+#else
+	UNUSED(fips);
 #endif
 	return 0;
 }
@@ -232,11 +232,14 @@ void crypt_backend_destroy(void)
 
 uint32_t crypt_backend_flags(void)
 {
-#if OPENSSL_VERSION_MAJOR >= 3
-	return 0;
-#else
-	return CRYPT_BACKEND_PBKDF2_INT;
+	uint32_t flags = 0;
+#if OPENSSL_VERSION_MAJOR < 3
+	flags |= CRYPT_BACKEND_PBKDF2_INT;
 #endif
+#if HAVE_DECL_OSSL_KDF_PARAM_ARGON2_VERSION
+	flags |= CRYPT_BACKEND_ARGON2;
+#endif
+	return flags;
 }
 
 const char *crypt_backend_version(void)
@@ -281,6 +284,8 @@ static void hash_id_free(const EVP_MD *hash_id)
 {
 #if OPENSSL_VERSION_MAJOR >= 3
 	EVP_MD_free(CONST_CAST(EVP_MD*)hash_id);
+#else
+	UNUSED(hash_id);
 #endif
 }
 
@@ -297,6 +302,8 @@ static void cipher_type_free(const EVP_CIPHER *cipher_type)
 {
 #if OPENSSL_VERSION_MAJOR >= 3
 	EVP_CIPHER_free(CONST_CAST(EVP_CIPHER*)cipher_type);
+#else
+	UNUSED(cipher_type);
 #endif
 }
 
@@ -375,7 +382,7 @@ int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length)
 	if (EVP_DigestFinal_ex(ctx->md, tmp, &tmp_len) != 1)
 		return -EINVAL;
 
-	memcpy(buffer, tmp, length);
+	crypt_backend_memcpy(buffer, tmp, length);
 	crypt_backend_memzero(tmp, sizeof(tmp));
 
 	if (tmp_len < length)
@@ -391,7 +398,6 @@ void crypt_hash_destroy(struct crypt_hash *ctx)
 {
 	hash_id_free(ctx->hash_id);
 	EVP_MD_CTX_free(ctx->md);
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 
@@ -505,7 +511,7 @@ int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length)
 
 	HMAC_Final(ctx->md, tmp, &tmp_len);
 #endif
-	memcpy(buffer, tmp, length);
+	crypt_backend_memcpy(buffer, tmp, length);
 	crypt_backend_memzero(tmp, sizeof(tmp));
 
 	if (tmp_len < length)
@@ -527,7 +533,6 @@ void crypt_hmac_destroy(struct crypt_hmac *ctx)
 	hash_id_free(ctx->hash_id);
 	HMAC_CTX_free(ctx->md);
 #endif
-	memset(ctx, 0, sizeof(*ctx));
 	free(ctx);
 }
 
@@ -593,8 +598,57 @@ static int openssl_argon2(const char *type, const char *password, size_t passwor
 	const char *salt, size_t salt_length, char *key, size_t key_length,
 	uint32_t iterations, uint32_t memory, uint32_t parallel)
 {
+#if HAVE_DECL_OSSL_KDF_PARAM_ARGON2_VERSION
+	EVP_KDF_CTX *ctx;
+	EVP_KDF *argon2;
+	unsigned int threads = parallel;
+	int r;
+	OSSL_PARAM params[] = {
+		OSSL_PARAM_octet_string(OSSL_KDF_PARAM_PASSWORD,
+			CONST_CAST(void*)password, password_length),
+		OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT,
+			CONST_CAST(void*)salt, salt_length),
+		OSSL_PARAM_uint32(OSSL_KDF_PARAM_ITER, &iterations),
+		OSSL_PARAM_uint(OSSL_KDF_PARAM_THREADS, &threads),
+		OSSL_PARAM_uint32(OSSL_KDF_PARAM_ARGON2_LANES, &parallel),
+		OSSL_PARAM_uint32(OSSL_KDF_PARAM_ARGON2_MEMCOST, &memory),
+		OSSL_PARAM_END
+	};
+
+	if (OSSL_get_max_threads(ossl_ctx) == 0)
+		threads = 1;
+
+	argon2 = EVP_KDF_fetch(ossl_ctx, type, NULL);
+	if (!argon2)
+		return -EINVAL;
+
+	ctx = EVP_KDF_CTX_new(argon2);
+	if (!ctx) {
+		EVP_KDF_free(argon2);
+		return -EINVAL;
+	}
+
+	if (EVP_KDF_CTX_set_params(ctx, params) != 1) {
+		EVP_KDF_CTX_free(ctx);
+		EVP_KDF_free(argon2);
+		return -EINVAL;
+	}
+
+	r = EVP_KDF_derive(ctx, (unsigned char*)key, key_length, NULL /*params*/);
+
+	EVP_KDF_CTX_free(ctx);
+	EVP_KDF_free(argon2);
+
+	/* Memory allocation is common issue with memory-hard Argon2 */
+	if (r == 0 && ERR_GET_REASON(ERR_get_error()) == ERR_R_MALLOC_FAILURE)
+		return -ENOMEM;
+
+	/* _derive() returns 0 or negative value on error, 1 on success */
+	return r == 1 ? 0 : -EINVAL;
+#else
 	return argon2(type, password, password_length, salt, salt_length,
 		      key, key_length, iterations, memory, parallel);
+#endif
 }
 
 /* PBKDF */

lib/crypto_backend/crypto_storage.c

@@ -1,31 +1,21 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Generic wrapper for storage encryption modes and Initial Vectors
  * (reimplementation of some functions from Linux dm-crypt kernel)
  *
- * Copyright (C) 2014-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2014-2025 Milan Broz
  */
 
+#include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
 #include <strings.h>
 #include "bitops.h"
 #include "crypto_backend.h"
 
-#define SECTOR_SHIFT	9
+#define SECTOR_SHIFT       9
+#define MAX_CAPI_LEN      64
+#define MAX_CAPI_LEN_STR "63"
 
 /*
  * Internal IV helper
@@ -225,43 +215,56 @@ int crypt_storage_init(struct crypt_storage **ctx,
 		       bool large_iv)
 {
 	struct crypt_storage *s;
-	char mode_name[64];
+	char cipher_name[MAX_CAPI_LEN], mode_name[MAX_CAPI_LEN], mode_tmp[MAX_CAPI_LEN];
 	char *cipher_iv = NULL;
-	int r = -EIO;
+	int r;
 
 	if (sector_size < (1 << SECTOR_SHIFT) ||
 	    sector_size > (1 << (SECTOR_SHIFT + 3)) ||
 	    sector_size & (sector_size - 1))
 		return -EINVAL;
 
-	s = malloc(sizeof(*s));
-	if (!s)
-		return -ENOMEM;
-	memset(s, 0, sizeof(*s));
+	/* Convert from capi mode */
+	if (!strncmp(cipher, "capi:", 5)) {
+		r = sscanf(cipher, "capi:%" MAX_CAPI_LEN_STR "[^(](%" MAX_CAPI_LEN_STR "[^)])", mode_tmp, cipher_name);
+		if (r != 2)
+			return -EINVAL;
+		r = snprintf(mode_name, sizeof(mode_name), "%s-%s", mode_tmp, cipher_mode);
+		if (r < 0 || (size_t)r >= sizeof(mode_name))
+			return -EINVAL;
+	} else {
+		strncpy(cipher_name, cipher, sizeof(cipher_name));
+		cipher_name[sizeof(cipher_name) - 1] = 0;
+		strncpy(mode_name, cipher_mode, sizeof(mode_name));
+		mode_name[sizeof(mode_name) - 1] = 0;
+	}
 
 	/* Remove IV if present */
-	strncpy(mode_name, cipher_mode, sizeof(mode_name));
-	mode_name[sizeof(mode_name) - 1] = 0;
 	cipher_iv = strchr(mode_name, '-');
 	if (cipher_iv) {
 		*cipher_iv = '\0';
 		cipher_iv++;
 	}
 
-	r = crypt_cipher_init(&s->cipher, cipher, mode_name, key, key_length);
+	s = malloc(sizeof(*s));
+	if (!s)
+		return -ENOMEM;
+	memset(s, 0, sizeof(*s));
+
+	r = crypt_cipher_init(&s->cipher, cipher_name, mode_name, key, key_length);
 	if (r) {
 		crypt_storage_destroy(s);
 		return r;
 	}
 
-	r = crypt_sector_iv_init(&s->cipher_iv, cipher, mode_name, cipher_iv, key, key_length, sector_size);
+	r = crypt_sector_iv_init(&s->cipher_iv, cipher_name, mode_name, cipher_iv, key, key_length, sector_size);
 	if (r) {
 		crypt_storage_destroy(s);
 		return r;
 	}
 
 	s->sector_size = sector_size;
-	s->iv_shift = large_iv ? int_log2(sector_size) - SECTOR_SHIFT : 0;
+	s->iv_shift = large_iv ? (unsigned)int_log2(sector_size) - SECTOR_SHIFT : 0;
 
 	*ctx = s;
 	return 0;

lib/crypto_backend/memutils.c

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
+/*
+ * Safe memory utilities
+ *
+ * Copyright (C) 2024-2025 Milan Broz
+ */
+
+#include "crypto_backend_internal.h"
+
+#define ATTR_NOINLINE __attribute__ ((noinline))
+#define ATTR_ZERO_REGS
+#if HAVE_ATTRIBUTE_ZEROCALLUSEDREGS
+#    undef ATTR_ZERO_REGS
+#    define ATTR_ZERO_REGS __attribute__ ((zero_call_used_regs("used")))
+#endif
+
+/* Workaround for https://github.com/google/sanitizers/issues/1507 */
+#if defined __has_feature
+# if __has_feature (memory_sanitizer)
+#   undef HAVE_EXPLICIT_BZERO
+# endif
+#endif
+
+/* Memzero helper (memset on stack can be optimized out) */
+ATTR_NOINLINE ATTR_ZERO_REGS
+void crypt_backend_memzero(void *s, size_t n)
+{
+#if HAVE_EXPLICIT_BZERO
+	explicit_bzero(s, n);
+#else
+	volatile uint8_t *p = (volatile uint8_t *)s;
+	while(n--) *p++ = 0;
+#endif
+}
+
+/* Memcpy helper to avoid spilling sensitive data through additional registers */
+ATTR_NOINLINE ATTR_ZERO_REGS
+void *crypt_backend_memcpy(void *dst, const void *src, size_t n)
+{
+	volatile uint8_t *d = (volatile uint8_t *)dst;
+	const volatile uint8_t *s = (const volatile uint8_t *)src;
+
+	while(n--) *d++ = *s++;
+
+	return dst;
+}
+
+/* Internal implementation for constant time memory comparison */
+ATTR_NOINLINE ATTR_ZERO_REGS
+int crypt_internal_memeq(const void *m1, const void *m2, size_t n)
+{
+	const unsigned char *_m1 = (const unsigned char *) m1;
+	const unsigned char *_m2 = (const unsigned char *) m2;
+	unsigned char result = 0;
+	size_t i;
+
+	for (i = 0; i < n; i++)
+		result |= _m1[i] ^ _m2[i];
+
+	return result;
+}

lib/crypto_backend/meson.build

@@ -0,0 +1,41 @@
+if use_internal_argon2
+    subdir('argon2')
+endif
+
+libcrypto_backend_dependencies = [
+    crypto_backend_library,
+    clock_gettime,
+]
+libcrypto_backend_link_with = []
+
+libcrypto_backend_sources = files(
+    'argon2_generic.c',
+    'base64.c',
+    'memutils.c',
+    'cipher_check.c',
+    'cipher_generic.c',
+    'crc32.c',
+    'crypto_cipher_kernel.c',
+    'crypto_storage.c',
+    'pbkdf_check.c',
+    'utf8.c',
+)
+
+crypto_backend = get_option('crypto-backend')
+libcrypto_backend_sources += files('crypto_@0@.c'.format(crypto_backend))
+
+if use_internal_pbkdf2
+    libcrypto_backend_sources += files('pbkdf2_generic.c')
+endif
+
+if use_internal_argon2 and get_option('argon-implementation') == 'internal'
+    libcrypto_backend_link_with += libargon2
+elif get_option('argon-implementation') == 'libargon2'
+    libcrypto_backend_dependencies += libargon2_external
+endif
+
+libcrypto_backend = static_library('crypto_backend',
+    libcrypto_backend_sources,
+    include_directories: includes_lib,
+    dependencies: libcrypto_backend_dependencies,
+    link_with: libcrypto_backend_link_with)

lib/crypto_backend/pbkdf2_generic.c

@@ -1,26 +1,12 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Implementation of Password-Based Cryptography as per PKCS#5
  * Copyright (C) 2002,2003 Simon Josefsson
  * Copyright (C) 2004 Free Software Foundation
  *
  * cryptsetup related changes
- * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2012-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
+ * Copyright (C) 2012-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2025 Milan Broz
  */
 
 #include <errno.h>

lib/crypto_backend/pbkdf_check.c

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * PBKDF performance check
- * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2012-2023 Milan Broz
+ * Copyright (C) 2012-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2025 Milan Broz
  * Copyright (C) 2016-2020 Ondrej Mosnacek
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #include <stdlib.h>
@@ -313,6 +300,7 @@ static int crypt_argon2_check(const char *kdf, const char *password,
 	} while (ms < ms_atleast || ms > ms_atmost);
 out:
 	if (key) {
+		/* Key can be derived from a real provided password */
 		crypt_backend_memzero(key, key_length);
 		free(key);
 	}
@@ -394,6 +382,7 @@ static int crypt_pbkdf_check(const char *kdf, const char *hash,
 	}
 out:
 	if (key) {
+		/* Key can be derived from a real provided password */
 		crypt_backend_memzero(key, key_length);
 		free(key);
 	}
@@ -419,6 +408,9 @@ int crypt_pbkdf_perf(const char *kdf, const char *hash,
 	if (r < 0)
 		return r;
 
+	if (parallel_threads > pbkdf_limits.max_parallel)
+		return -EINVAL;
+
 	min_memory = pbkdf_limits.min_bench_memory;
 	if (min_memory > max_memory_kb)
 		min_memory = max_memory_kb;

lib/crypto_backend/utf8.c

@@ -1,10 +1,11 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * UTF8/16 helpers, copied and adapted from systemd project.
  *
  * Copyright (C) 2010 Lennart Poettering
  *
  * cryptsetup related changes
- * Copyright (C) 2021-2023 Vojtech Trefny
+ * Copyright (C) 2021-2025 Vojtech Trefny
 
  * Parts of the original systemd implementation are based on the GLIB utf8
  * validation functions.
@@ -12,20 +13,6 @@
  *
  * Copyright (C) 1999 Tom Tromey
  * Copyright (C) 2000 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include <errno.h>
@@ -230,6 +217,7 @@ static size_t utf16_encode_unichar(char16_t *out, char32_t c)
 		return 1;
 
 	case 0x10000U ... 0x10ffffU:
+		/* coverity[overflow_const:FALSE] */
 		c -= 0x10000U;
 		out[0] = htole16((c >> 10) + 0xd800U);
 		out[1] = htole16((c & 0x3ffU) + 0xdc00U);
@@ -286,3 +274,20 @@ int crypt_utf8_to_utf16(char16_t **out, const char *s, size_t length)
 	*p = 0;
 	return 0;
 }
+
+/**
+ * crypt_char16_strlen()
+ * @s: string to get length of
+ *
+ * Returns: number of 16-bit words in the string
+ */
+size_t crypt_char16_strlen(const char16_t *s) {
+	size_t n = 0;
+
+	assert(s);
+
+	while (*s != 0)
+		n++, s++;
+
+	return n;
+}

lib/fvault2/fvault2.c

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * FVAULT2 (FileVault2-compatible) volume handling
  *
  * Copyright (C) 2021-2022 Pavel Tobias
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #include <errno.h>
@@ -526,6 +513,7 @@ static int _read_volume_header(
 	int r = 0;
 	struct device *dev = crypt_metadata_device(cd);
 	struct volume_header *vol_header = NULL;
+	void *enc_key = NULL;
 
 	assert(sizeof(*vol_header) == FVAULT2_VOL_HEADER_SIZE);
 
@@ -570,8 +558,8 @@ static int _read_volume_header(
 		goto out;
 	}
 
-	*enc_md_key = crypt_alloc_volume_key(FVAULT2_XTS_KEY_SIZE, NULL);
-	if (*enc_md_key == NULL) {
+	enc_key = crypt_safe_alloc(FVAULT2_XTS_KEY_SIZE);
+	if (!enc_key) {
 		r = -ENOMEM;
 		goto out;
 	}
@@ -579,9 +567,15 @@ static int _read_volume_header(
 	*block_size = le32_to_cpu(vol_header->block_size);
 	*disklbl_blkoff = le64_to_cpu(vol_header->disklbl_blkoff);
 	uuid_unparse(vol_header->ph_vol_uuid, ph_vol_uuid);
-	memcpy((*enc_md_key)->key, vol_header->key_data, FVAULT2_AES_KEY_SIZE);
-	memcpy((*enc_md_key)->key + FVAULT2_AES_KEY_SIZE,
+	crypt_safe_memcpy(enc_key, vol_header->key_data, FVAULT2_AES_KEY_SIZE);
+	crypt_safe_memcpy((char *)enc_key + FVAULT2_AES_KEY_SIZE,
 		vol_header->ph_vol_uuid, FVAULT2_AES_KEY_SIZE);
+
+	*enc_md_key = crypt_alloc_volume_key_by_safe_alloc(&enc_key);
+	if (*enc_md_key == NULL) {
+		crypt_safe_free(enc_key);
+		r = -ENOMEM;
+	}
 out:
 	free(vol_header);
 	return r;
@@ -717,7 +711,7 @@ static int _read_encrypted_metadata(
 		goto out;
 	}
 
-	r = crypt_cipher_init(&cipher, "aes", "xts", key->key, FVAULT2_XTS_KEY_SIZE);
+	r = crypt_cipher_init(&cipher, "aes", "xts", crypt_volume_key_get_key(key), FVAULT2_XTS_KEY_SIZE);
 	if (r < 0)
 		goto out;
 
@@ -848,8 +842,7 @@ static int _activate(
 	r = dm_crypt_target_set(&dm_dev.segment, 0, dm_dev.size,
 		crypt_data_device(cd), vol_key, cipher,
 		crypt_get_iv_offset(cd), crypt_get_data_offset(cd),
-		crypt_get_integrity(cd), crypt_get_integrity_tag_size(cd),
-		crypt_get_sector_size(cd));
+		NULL, 0, 0, crypt_get_sector_size(cd));
 
 	if (!r)
 		r = dm_create_device(cd, name, CRYPT_FVAULT2, &dm_dev);
@@ -906,15 +899,14 @@ int FVAULT2_get_volume_key(
 	const char *passphrase,
 	size_t passphrase_len,
 	const struct fvault2_params *params,
-	struct volume_key **vol_key)
+	struct volume_key **r_vol_key)
 {
 	int r = 0;
 	uint8_t family_uuid_bin[FVAULT2_UUID_BIN_SIZE];
-	struct volume_key *passphrase_key = NULL;
-	struct volume_key *kek = NULL;
 	struct crypt_hash *hash = NULL;
+	void *passphrase_key = NULL, *kek = NULL, *vol_key= NULL;
 
-	*vol_key = NULL;
+	*r_vol_key = NULL;
 
 	if (uuid_parse(params->family_uuid, family_uuid_bin) < 0) {
 		log_dbg(cd, "Could not parse logical volume family UUID: %s.",
@@ -923,61 +915,62 @@ int FVAULT2_get_volume_key(
 		goto out;
 	}
 
-	passphrase_key = crypt_alloc_volume_key(FVAULT2_AES_KEY_SIZE, NULL);
+	passphrase_key = crypt_safe_alloc(FVAULT2_AES_KEY_SIZE);
 	if (passphrase_key == NULL) {
 		r = -ENOMEM;
 		goto out;
 	}
 
 	r = crypt_pbkdf("pbkdf2", "sha256", passphrase, passphrase_len,
-		params->pbkdf2_salt, FVAULT2_PBKDF2_SALT_SIZE, passphrase_key->key,
+		params->pbkdf2_salt, FVAULT2_PBKDF2_SALT_SIZE, passphrase_key,
 		FVAULT2_AES_KEY_SIZE, params->pbkdf2_iters, 0, 0);
 	if (r < 0)
 		goto out;
 
-	kek = crypt_alloc_volume_key(FVAULT2_AES_KEY_SIZE, NULL);
+	kek = crypt_safe_alloc(FVAULT2_AES_KEY_SIZE);
 	if (kek == NULL) {
 		r = -ENOMEM;
 		goto out;
 	}
 
-	r = _unwrap_key(passphrase_key->key, FVAULT2_AES_KEY_SIZE, params->wrapped_kek,
-			FVAULT2_WRAPPED_KEY_SIZE, kek->key, FVAULT2_AES_KEY_SIZE);
+	r = _unwrap_key(passphrase_key, FVAULT2_AES_KEY_SIZE, params->wrapped_kek,
+			FVAULT2_WRAPPED_KEY_SIZE, kek, FVAULT2_AES_KEY_SIZE);
 	if (r < 0)
 		goto out;
 
-	*vol_key = crypt_alloc_volume_key(FVAULT2_XTS_KEY_SIZE, NULL);
-	if (*vol_key == NULL) {
+	vol_key = crypt_safe_alloc(FVAULT2_XTS_KEY_SIZE);
+	if (vol_key == NULL) {
 		r = -ENOMEM;
 		goto out;
 	}
 
-	r = _unwrap_key(kek->key, FVAULT2_AES_KEY_SIZE, params->wrapped_vk,
-		FVAULT2_WRAPPED_KEY_SIZE, (*vol_key)->key, FVAULT2_AES_KEY_SIZE);
+	r = _unwrap_key(kek, FVAULT2_AES_KEY_SIZE, params->wrapped_vk,
+		FVAULT2_WRAPPED_KEY_SIZE, vol_key, FVAULT2_AES_KEY_SIZE);
 	if (r < 0)
 		goto out;
 
 	r = crypt_hash_init(&hash, "sha256");
 	if (r < 0)
 		goto out;
-	r = crypt_hash_write(hash, (*vol_key)->key, FVAULT2_AES_KEY_SIZE);
+	r = crypt_hash_write(hash, vol_key, FVAULT2_AES_KEY_SIZE);
 	if (r < 0)
 		goto out;
 	r = crypt_hash_write(hash, (char *)family_uuid_bin,
 		FVAULT2_UUID_BIN_SIZE);
 	if (r < 0)
 		goto out;
-	r = crypt_hash_final(hash, (*vol_key)->key + FVAULT2_AES_KEY_SIZE,
+	r = crypt_hash_final(hash, (char *)vol_key + FVAULT2_AES_KEY_SIZE,
 		FVAULT2_AES_KEY_SIZE);
 	if (r < 0)
 		goto out;
+
+	*r_vol_key = crypt_alloc_volume_key_by_safe_alloc(&vol_key);
+	if (!*r_vol_key)
+		r = -ENOMEM;
 out:
-	crypt_free_volume_key(passphrase_key);
-	crypt_free_volume_key(kek);
-	if (r < 0) {
-		crypt_free_volume_key(*vol_key);
-		*vol_key = NULL;
-	}
+	crypt_safe_free(passphrase_key);
+	crypt_safe_free(kek);
+	crypt_safe_free(vol_key);
 	if (hash != NULL)
 		crypt_hash_destroy(hash);
 	return r;
@@ -1010,48 +1003,19 @@ int FVAULT2_dump(
 	return 0;
 }
 
-int FVAULT2_activate_by_passphrase(
-	struct crypt_device *cd,
-	const char *name,
-	const char *passphrase,
-	size_t passphrase_len,
-	const struct fvault2_params *params,
-	uint32_t flags)
-{
-	int r;
-	struct volume_key *vol_key = NULL;
-
-	r = FVAULT2_get_volume_key(cd, passphrase, passphrase_len, params, &vol_key);
-	if (r < 0)
-		return r;
-
-	if (name)
-	    r = _activate(cd, name, vol_key, params, flags);
-
-	crypt_free_volume_key(vol_key);
-	return r;
-}
-
 int FVAULT2_activate_by_volume_key(
 	struct crypt_device *cd,
 	const char *name,
-	const char *key,
-	size_t key_size,
+	struct volume_key *vk,
 	const struct fvault2_params *params,
 	uint32_t flags)
 {
-	int r = 0;
-	struct volume_key *vol_key = NULL;
+	assert(crypt_volume_key_length(vk) == FVAULT2_XTS_KEY_SIZE);
 
-	if (key_size != FVAULT2_XTS_KEY_SIZE)
-		return -EINVAL;
-
-	vol_key = crypt_alloc_volume_key(FVAULT2_XTS_KEY_SIZE, key);
-	if (vol_key == NULL)
-		return -ENOMEM;
-
-	r = _activate(cd, name, vol_key, params, flags);
-
-	crypt_free_volume_key(vol_key);
-	return r;
+	return _activate(cd, name, vk, params, flags);
+}
+
+size_t FVAULT2_volume_key_size(void)
+{
+	return FVAULT2_XTS_KEY_SIZE;
 }

lib/fvault2/fvault2.h

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * FVAULT2 (FileVault2-compatible) volume handling
  *
  * Copyright (C) 2021-2022 Pavel Tobias
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #ifndef _CRYPTSETUP_FVAULT2_H
@@ -54,27 +41,20 @@ int FVAULT2_get_volume_key(
 	const char *passphrase,
 	size_t passphrase_len,
 	const struct fvault2_params *params,
-	struct volume_key **vol_key);
+	struct volume_key **r_vol_key);
 
 int FVAULT2_dump(
 	struct crypt_device *cd,
 	struct device *device,
 	const struct fvault2_params *params);
 
-int FVAULT2_activate_by_passphrase(
-	struct crypt_device *cd,
-	const char *name,
-	const char *passphrase,
-	size_t passphrase_len,
-	const struct fvault2_params *params,
-	uint32_t flags);
-
 int FVAULT2_activate_by_volume_key(
 	struct crypt_device *cd,
 	const char *name,
-	const char *key,
-	size_t key_size,
+	struct volume_key *vk,
 	const struct fvault2_params *params,
 	uint32_t flags);
 
+size_t FVAULT2_volume_key_size(void);
+
 #endif

lib/integrity/integrity.c

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Integrity volume handling
  *
- * Copyright (C) 2016-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2016-2025 Milan Broz
  */
 
 #include <errno.h>
@@ -44,16 +31,22 @@ static int INTEGRITY_read_superblock(struct crypt_device *cd,
 {
 	int devfd, r;
 
+	log_dbg(cd, "Reading kernel dm-integrity metadata on %s.", device_path(device));
+
 	devfd = device_open(cd, device, O_RDONLY);
 	if(devfd < 0)
 		return -EINVAL;
 
 	if (read_lseek_blockwise(devfd, device_block_size(cd, device),
-	    device_alignment(device), sb, sizeof(*sb), offset) != sizeof(*sb) ||
-	    memcmp(sb->magic, SB_MAGIC, sizeof(sb->magic))) {
+	    device_alignment(device), sb, sizeof(*sb), offset) != sizeof(*sb)) {
+		log_dbg(cd, "Cannot read kernel dm-integrity metadata on %s.", device_path(device));
+		return -EINVAL;
+	}
+
+	if (memcmp(sb->magic, SB_MAGIC, sizeof(sb->magic))) {
 		log_dbg(cd, "No kernel dm-integrity metadata detected on %s.", device_path(device));
 		r = -EINVAL;
-	} else if (sb->version < SB_VERSION_1 || sb->version > SB_VERSION_5) {
+	} else if (sb->version < SB_VERSION_1 || sb->version > SB_VERSION_6) {
 		log_err(cd, _("Incompatible kernel dm-integrity metadata (version %u) detected on %s."),
 			sb->version, device_path(device));
 		r = -EINVAL;
@@ -80,8 +73,10 @@ int INTEGRITY_read_sb(struct crypt_device *cd,
 	if (r)
 		return r;
 
-	params->sector_size = SECTOR_SIZE << sb.log2_sectors_per_block;
-	params->tag_size = sb.integrity_tag_size;
+	if (params) {
+		params->sector_size = SECTOR_SIZE << sb.log2_sectors_per_block;
+		params->tag_size = sb.integrity_tag_size;
+	}
 
 	if (flags)
 		*flags = sb.flags;
@@ -92,28 +87,32 @@ int INTEGRITY_read_sb(struct crypt_device *cd,
 int INTEGRITY_dump(struct crypt_device *cd, struct device *device, uint64_t offset)
 {
 	struct superblock sb;
+	uint64_t sector_size;
 	int r;
 
 	r = INTEGRITY_read_superblock(cd, device, offset, &sb);
 	if (r)
 		return r;
 
-	log_std(cd, "Info for integrity device %s.\n", device_path(device));
-	log_std(cd, "superblock_version %d\n", (unsigned)sb.version);
-	log_std(cd, "log2_interleave_sectors %d\n", sb.log2_interleave_sectors);
-	log_std(cd, "integrity_tag_size %u\n", sb.integrity_tag_size);
-	log_std(cd, "journal_sections %u\n", sb.journal_sections);
-	log_std(cd, "provided_data_sectors %" PRIu64 "\n", sb.provided_data_sectors);
-	log_std(cd, "sector_size %u\n", SECTOR_SIZE << sb.log2_sectors_per_block);
+	sector_size = (uint64_t)SECTOR_SIZE << sb.log2_sectors_per_block;
+	log_std(cd, "INTEGRITY header information for %s.\n", device_path(device));
+	log_std(cd, "version: %d\n", (unsigned)sb.version);
+	log_std(cd, "tag size: %u [bytes]\n", sb.integrity_tag_size);
+	log_std(cd, "sector size: %" PRIu64 " [bytes]\n", sector_size);
+	log_std(cd, "data size: %" PRIu64 " [512-byte units] (%" PRIu64 " [bytes])\n",
+		sb.provided_data_sectors, sb.provided_data_sectors * SECTOR_SIZE);
 	if (sb.version >= SB_VERSION_2 && (sb.flags & SB_FLAG_RECALCULATING))
-		log_std(cd, "recalc_sector %" PRIu64 "\n", sb.recalc_sector);
-	log_std(cd, "log2_blocks_per_bitmap %u\n", sb.log2_blocks_per_bitmap_bit);
-	log_std(cd, "flags %s%s%s%s%s\n",
+		log_std(cd, "recalculate sector: %" PRIu64 "\n", sb.recalc_sector);
+	log_std(cd, "journal sections: %u\n", sb.journal_sections);
+	log_std(cd, "log2 interleave sectors: %d\n", sb.log2_interleave_sectors);
+	log_std(cd, "log2 blocks per bitmap: %u\n", sb.log2_blocks_per_bitmap_bit);
+	log_std(cd, "flags: %s%s%s%s%s%s\n",
 		sb.flags & SB_FLAG_HAVE_JOURNAL_MAC ? "have_journal_mac " : "",
 		sb.flags & SB_FLAG_RECALCULATING ? "recalculating " : "",
 		sb.flags & SB_FLAG_DIRTY_BITMAP ? "dirty_bitmap " : "",
 		sb.flags & SB_FLAG_FIXED_PADDING ? "fix_padding " : "",
-		sb.flags & SB_FLAG_FIXED_HMAC ? "fix_hmac " : "");
+		sb.flags & SB_FLAG_FIXED_HMAC ? "fix_hmac " : "",
+		sb.flags & SB_FLAG_INLINE ? "inline " : "");
 
 	return 0;
 }
@@ -133,26 +132,36 @@ int INTEGRITY_data_sectors(struct crypt_device *cd,
 	return 0;
 }
 
-int INTEGRITY_key_size(const char *integrity)
+int INTEGRITY_key_size(const char *integrity, int required_key_size)
 {
+	int ks = 0;
+
+	if (!integrity && required_key_size)
+		return -EINVAL;
+
 	if (!integrity)
 		return 0;
 
 	//FIXME: use crypto backend hash size
 	if (!strcmp(integrity, "aead"))
-		return 0;
+		ks = 0;
 	else if (!strcmp(integrity, "hmac(sha1)"))
-		return 20;
+		ks = required_key_size ?: 20;
 	else if (!strcmp(integrity, "hmac(sha256)"))
-		return 32;
+		ks = required_key_size ?: 32;
 	else if (!strcmp(integrity, "hmac(sha512)"))
-		return 64;
+		ks = required_key_size ?: 64;
 	else if (!strcmp(integrity, "poly1305"))
-		return 0;
+		ks = 0;
 	else if (!strcmp(integrity, "none"))
-		return 0;
+		ks = 0;
+	else
+		return -EINVAL;
 
-	return -EINVAL;
+	if (required_key_size && ks != required_key_size)
+		return -EINVAL;
+
+	return ks;
 }
 
 /* Return hash or hmac(hash) size, if known */
@@ -243,6 +252,9 @@ int INTEGRITY_create_dmd_device(struct crypt_device *cd,
 	if (sb_flags & SB_FLAG_RECALCULATING)
 		dmd->flags |= CRYPT_ACTIVATE_RECALCULATE;
 
+	if (sb_flags & SB_FLAG_INLINE)
+		dmd->flags |= (CRYPT_ACTIVATE_NO_JOURNAL | CRYPT_ACTIVATE_INLINE_MODE);
+
 	r = INTEGRITY_data_sectors(cd, INTEGRITY_metadata_device(cd),
 				   crypt_get_data_offset(cd) * SECTOR_SIZE, &dmd->size);
 	if (r < 0)
@@ -262,14 +274,15 @@ int INTEGRITY_activate_dmd_device(struct crypt_device *cd,
 		       uint32_t sb_flags)
 {
 	int r;
-	uint32_t dmi_flags;
+	uint64_t dmi_flags;
 	struct dm_target *tgt = &dmd->segment;
 
 	if (!single_segment(dmd) || tgt->type != DM_INTEGRITY)
 		return -EINVAL;
 
-	log_dbg(cd, "Trying to activate INTEGRITY device on top of %s, using name %s, tag size %d, provided sectors %" PRIu64".",
-		device_path(tgt->data_device), name, tgt->u.integrity.tag_size, dmd->size);
+	log_dbg(cd, "Trying to activate INTEGRITY device on top of %s, using name %s, tag size %d%s, provided sectors %" PRIu64".",
+		device_path(tgt->data_device), name, tgt->u.integrity.tag_size,
+		(sb_flags & SB_FLAG_INLINE) ? " (inline)" :"", dmd->size);
 
 	r = create_or_reload_device(cd, name, type, dmd);
 
@@ -293,6 +306,12 @@ int INTEGRITY_activate_dmd_device(struct crypt_device *cd,
 		return -ENOTSUP;
 	}
 
+	if (r < 0 && (sb_flags & SB_FLAG_INLINE) && !dm_flags(cd, DM_INTEGRITY, &dmi_flags) &&
+	    !(dmi_flags & DM_INTEGRITY_INLINE_MODE_SUPPORTED)) {
+		log_err(cd, _("Kernel does not support dm-integrity inline mode."));
+		return -ENOTSUP;
+	}
+
 	return r;
 }
 
@@ -335,13 +354,65 @@ int INTEGRITY_activate(struct crypt_device *cd,
 	return r;
 }
 
+static int _create_reduced_device(struct crypt_device *cd,
+				  const char *name,
+				  uint64_t device_size_sectors,
+				  struct device **ret_device)
+{
+	int r;
+	char path[PATH_MAX];
+	struct device *dev;
+
+	struct crypt_dm_active_device dmd = {
+		.size = device_size_sectors,
+		.flags = CRYPT_ACTIVATE_PRIVATE,
+	};
+
+	assert(cd);
+	assert(name);
+	assert(device_size_sectors);
+	assert(ret_device);
+
+	r = snprintf(path, sizeof(path), "%s/%s", dm_get_dir(), name);
+	if (r < 0 || (size_t)r >= sizeof(path))
+		return -EINVAL;
+
+	r = device_block_adjust(cd, crypt_data_device(cd), DEV_OK,
+				crypt_get_data_offset(cd), &device_size_sectors, &dmd.flags);
+	if (r)
+		return r;
+
+	log_dbg(cd, "Activating reduced helper device %s.", name);
+
+	r = dm_linear_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), crypt_get_data_offset(cd));
+	if (!r)
+		r = dm_create_device(cd, name, CRYPT_SUBDEV, &dmd);
+	dm_targets_free(cd, &dmd);
+	if (r < 0)
+		return r;
+
+	r = device_alloc(cd, &dev, path);
+	if (!r) {
+		*ret_device = dev;
+		return 0;
+	}
+
+	dm_remove_device(cd, name, CRYPT_DEACTIVATE_FORCE);
+
+	return r;
+}
+
 int INTEGRITY_format(struct crypt_device *cd,
 		     const struct crypt_params_integrity *params,
+		     struct volume_key *integrity_key,
 		     struct volume_key *journal_crypt_key,
-		     struct volume_key *journal_mac_key)
+		     struct volume_key *journal_mac_key,
+		     uint64_t backing_device_sectors,
+		     uint32_t *sb_flags,
+		     bool integrity_inline)
 {
-	uint32_t dmi_flags;
-	char tmp_name[64], tmp_uuid[40];
+	uint64_t dmi_flags;
+	char reduced_device_name[70], tmp_name[64], tmp_uuid[40];
 	struct crypt_dm_active_device dmdi = {
 		.size = 8,
 		.flags = CRYPT_ACTIVATE_PRIVATE, /* We always create journal but it can be unused later */
@@ -349,7 +420,8 @@ int INTEGRITY_format(struct crypt_device *cd,
 	struct dm_target *tgt = &dmdi.segment;
 	int r;
 	uuid_t tmp_uuid_bin;
-	struct volume_key *vk = NULL;
+	uint64_t data_offset_sectors;
+	struct device *p_metadata_device, *p_data_device, *reduced_device = NULL;
 
 	uuid_generate(tmp_uuid_bin);
 	uuid_unparse(tmp_uuid_bin, tmp_uuid);
@@ -358,45 +430,75 @@ int INTEGRITY_format(struct crypt_device *cd,
 	if (r < 0 || (size_t)r >= sizeof(tmp_name))
 		return -EINVAL;
 
-	/* There is no data area, we can actually use fake zeroed key */
-	if (params && params->integrity_key_size)
-		vk = crypt_alloc_volume_key(params->integrity_key_size, NULL);
+	p_metadata_device = INTEGRITY_metadata_device(cd);
 
-	r = dm_integrity_target_set(cd, tgt, 0, dmdi.size, INTEGRITY_metadata_device(cd),
-			crypt_data_device(cd), crypt_get_integrity_tag_size(cd),
-			crypt_get_data_offset(cd), crypt_get_sector_size(cd), vk,
-			journal_crypt_key, journal_mac_key, params);
-	if (r < 0) {
-		crypt_free_volume_key(vk);
-		return r;
+	if (backing_device_sectors) {
+		r = snprintf(reduced_device_name, sizeof(reduced_device_name),
+			     "temporary-cryptsetup-reduced-%s", tmp_uuid);
+		if (r < 0 || (size_t)r >= sizeof(reduced_device_name))
+			return -EINVAL;
+
+		/*
+		 * Creates reduced dm-linear mapping over data device starting at
+		 * crypt_data_offset(cd) and backing_device_sectors in size.
+		 */
+		r = _create_reduced_device(cd, reduced_device_name,
+					   backing_device_sectors, &reduced_device);
+		if (r < 0)
+			return r;
+
+		data_offset_sectors = 0;
+		p_data_device = reduced_device;
+		if (p_metadata_device == crypt_data_device(cd))
+			p_metadata_device = reduced_device;
+	} else {
+		data_offset_sectors = crypt_get_data_offset(cd);
+		p_data_device = crypt_data_device(cd);
 	}
 
-	log_dbg(cd, "Trying to format INTEGRITY device on top of %s, tmp name %s, tag size %d.",
-		device_path(tgt->data_device), tmp_name, tgt->u.integrity.tag_size);
+	if (integrity_inline)
+		dmdi.flags |= (CRYPT_ACTIVATE_NO_JOURNAL | CRYPT_ACTIVATE_INLINE_MODE);
+
+	r = dm_integrity_target_set(cd, tgt, 0, dmdi.size, p_metadata_device,
+			p_data_device, crypt_get_integrity_tag_size(cd),
+			data_offset_sectors, crypt_get_sector_size(cd), integrity_key,
+			journal_crypt_key, journal_mac_key, params);
+	if (r < 0)
+		goto err;
+
+	log_dbg(cd, "Trying to format INTEGRITY device on top of %s, tmp name %s, tag size %d%s.",
+		device_path(tgt->data_device), tmp_name, tgt->u.integrity.tag_size, integrity_inline ? " (inline)" : "");
 
 	r = device_block_adjust(cd, tgt->data_device, DEV_EXCL, tgt->u.integrity.offset, NULL, NULL);
 	if (r < 0 && (dm_flags(cd, DM_INTEGRITY, &dmi_flags) || !(dmi_flags & DM_INTEGRITY_SUPPORTED))) {
 		log_err(cd, _("Kernel does not support dm-integrity mapping."));
 		r = -ENOTSUP;
 	}
-	if (r) {
-		dm_targets_free(cd, &dmdi);
-		return r;
-	}
+	if (r)
+		goto err;
 
 	if (tgt->u.integrity.meta_device) {
 		r = device_block_adjust(cd, tgt->u.integrity.meta_device, DEV_EXCL, 0, NULL, NULL);
-		if (r) {
-			dm_targets_free(cd, &dmdi);
-			return r;
-		}
+		if (r)
+			goto err;
 	}
 
 	r = dm_create_device(cd, tmp_name, CRYPT_INTEGRITY, &dmdi);
-	crypt_free_volume_key(vk);
-	dm_targets_free(cd, &dmdi);
 	if (r)
-		return r;
+		goto err;
 
-	return dm_remove_device(cd, tmp_name, CRYPT_DEACTIVATE_FORCE);
+	r = dm_remove_device(cd, tmp_name, CRYPT_DEACTIVATE_FORCE);
+	if (r)
+		goto err;
+
+	/* reload sb_flags from superblock (important for SB_FLAG_INLINE) */
+	if (sb_flags)
+		r = INTEGRITY_read_sb(cd, NULL, sb_flags);
+err:
+	dm_targets_free(cd, &dmdi);
+	if (reduced_device) {
+		dm_remove_device(cd, reduced_device_name, CRYPT_DEACTIVATE_FORCE);
+		device_free(cd, reduced_device);
+	}
+	return r;
 }

lib/integrity/integrity.h

@@ -1,27 +1,15 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * Integrity header definition
  *
- * Copyright (C) 2016-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2016-2025 Milan Broz
  */
 
 #ifndef _CRYPTSETUP_INTEGRITY_H
 #define _CRYPTSETUP_INTEGRITY_H
 
 #include <stdint.h>
+#include <stdbool.h>
 
 struct crypt_device;
 struct device;
@@ -36,12 +24,14 @@ struct crypt_dm_active_device;
 #define SB_VERSION_3	3
 #define SB_VERSION_4	4
 #define SB_VERSION_5	5
+#define SB_VERSION_6	6
 
 #define SB_FLAG_HAVE_JOURNAL_MAC	(1 << 0)
 #define SB_FLAG_RECALCULATING		(1 << 1) /* V2 only */
 #define SB_FLAG_DIRTY_BITMAP		(1 << 2) /* V3 only */
 #define SB_FLAG_FIXED_PADDING		(1 << 3) /* V4 only */
 #define SB_FLAG_FIXED_HMAC		(1 << 4) /* V5 only */
+#define SB_FLAG_INLINE			(1 << 5) /* V6 only */
 
 struct superblock {
 	uint8_t magic[8];
@@ -53,8 +43,10 @@ struct superblock {
 	uint32_t flags;
 	uint8_t log2_sectors_per_block;
 	uint8_t log2_blocks_per_bitmap_bit; /* V3 only */
-	uint8_t pad[2];
+	uint8_t pad[2]; /* (padding) */
 	uint64_t recalc_sector; /* V2 only */
+	uint8_t pad2[8]; /* (padding) */
+	uint8_t salt[16]; /* for fixed hmac, V5 only */
 } __attribute__ ((packed));
 
 int INTEGRITY_read_sb(struct crypt_device *cd,
@@ -66,7 +58,7 @@ int INTEGRITY_dump(struct crypt_device *cd, struct device *device, uint64_t offs
 int INTEGRITY_data_sectors(struct crypt_device *cd,
 			   struct device *device, uint64_t offset,
 			   uint64_t *data_sectors);
-int INTEGRITY_key_size(const char *integrity);
+int INTEGRITY_key_size(const char *integrity, int required_key_size);
 int INTEGRITY_tag_size(const char *integrity,
 		       const char *cipher,
 		       const char *cipher_mode);
@@ -74,8 +66,12 @@ int INTEGRITY_hash_tag_size(const char *integrity);
 
 int INTEGRITY_format(struct crypt_device *cd,
 		     const struct crypt_params_integrity *params,
+		     struct volume_key *integrity_key,
 		     struct volume_key *journal_crypt_key,
-		     struct volume_key *journal_mac_key);
+		     struct volume_key *journal_mac_key,
+		     uint64_t backing_device_sectors,
+		     uint32_t *sb_flags,
+		     bool integrity_inline);
 
 int INTEGRITY_activate(struct crypt_device *cd,
 		       const char *name,

lib/internal.h

@@ -1,24 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * libcryptsetup - cryptsetup library internal
  *
  * Copyright (C) 2004 Jana Saout <jana@saout.de>
  * Copyright (C) 2004-2007 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2009-2023 Milan Broz
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2009-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2009-2025 Milan Broz
  */
 
 #ifndef INTERNAL_H
@@ -53,6 +40,7 @@
 #define MAX_DM_DEPS		32
 
 #define CRYPT_SUBDEV           "SUBDEV" /* prefix for sublayered devices underneath public crypt types */
+#define CRYPT_LUKS2_HW_OPAL    "LUKS2-OPAL" /* dm uuid prefix used for any HW OPAL enabled LUKS2 device */
 
 #ifndef O_CLOEXEC
 #define O_CLOEXEC 0
@@ -60,24 +48,36 @@
 
 struct crypt_device;
 struct luks2_reencrypt;
+struct volume_key;
 
-struct volume_key {
-	int id;
-	size_t keylength;
-	const char *key_description;
-	struct volume_key *next;
-	char key[];
-};
+typedef enum {
+	KEY_QUALITY_KEY = 0,
+	KEY_QUALITY_NORMAL,
+	KEY_QUALITY_EMPTY
+} key_quality_info;
 
 struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key);
-struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, size_t keylength);
+struct volume_key *crypt_alloc_volume_key_by_safe_alloc(void **safe_alloc);
+struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, size_t keylength,
+					     key_quality_info quality);
 void crypt_free_volume_key(struct volume_key *vk);
-int crypt_volume_key_set_description(struct volume_key *key, const char *key_description);
+const char *crypt_volume_key_get_key(const struct volume_key *vk);
+size_t crypt_volume_key_length(const struct volume_key *vk);
+int crypt_volume_key_set_description(struct volume_key *key,
+				     const char *key_description, key_type_t keyring_key_type);
+int crypt_volume_key_set_description_by_name(struct volume_key *vk, const char *key_name);
+key_type_t crypt_volume_key_kernel_key_type(const struct volume_key *vk);
+const char *crypt_volume_key_description(const struct volume_key *vk);
 void crypt_volume_key_set_id(struct volume_key *vk, int id);
 int crypt_volume_key_get_id(const struct volume_key *vk);
 void crypt_volume_key_add_next(struct volume_key **vks, struct volume_key *vk);
 struct volume_key *crypt_volume_key_next(struct volume_key *vk);
 struct volume_key *crypt_volume_key_by_id(struct volume_key *vk, int id);
+void crypt_volume_key_pass_safe_alloc(struct volume_key *vk, void **safe_alloc);
+bool crypt_volume_key_is_set(const struct volume_key *vk);
+bool crypt_volume_key_upload_kernel_key(struct volume_key *vk);
+void crypt_volume_key_drop_uploaded_kernel_key(struct crypt_device *cd, struct volume_key *vk);
+void crypt_volume_key_drop_kernel_key(struct crypt_device *cd, struct volume_key *vk);
 
 struct crypt_pbkdf_type *crypt_get_pbkdf(struct crypt_device *cd);
 int init_pbkdf_type(struct crypt_device *cd,
@@ -89,6 +89,7 @@ int crypt_benchmark_pbkdf_internal(struct crypt_device *cd,
 				   struct crypt_pbkdf_type *pbkdf,
 				   size_t volume_key_size);
 const char *crypt_get_cipher_spec(struct crypt_device *cd);
+uint32_t pbkdf_adjusted_phys_memory_kb(void);
 
 /* Device backend */
 struct device;
@@ -97,7 +98,6 @@ int device_alloc_no_check(struct device **device, const char *path);
 void device_close(struct crypt_device *cd, struct device *device);
 void device_free(struct crypt_device *cd, struct device *device);
 const char *device_path(const struct device *device);
-const char *device_dm_name(const struct device *device);
 const char *device_block_path(const struct device *device);
 void device_topology_alignment(struct crypt_device *cd,
 			       struct device *device,
@@ -113,6 +113,9 @@ void device_release_excl(struct crypt_device *cd, struct device *device);
 void device_disable_direct_io(struct device *device);
 int device_is_identical(struct device *device1, struct device *device2);
 int device_is_rotational(struct device *device);
+int device_is_dax(struct device *device);
+int device_is_zoned(struct device *device);
+int device_is_nop_dif(struct device *device, uint32_t *tag_size);
 size_t device_alignment(struct device *device);
 int device_direct_io(const struct device *device);
 int device_fallocate(struct device *device, uint64_t size);
@@ -153,21 +156,31 @@ int create_or_reload_device_with_integrity(struct crypt_device *cd, const char *
 struct device *crypt_metadata_device(struct crypt_device *cd);
 struct device *crypt_data_device(struct crypt_device *cd);
 
+uint64_t crypt_get_metadata_size_bytes(struct crypt_device *cd);
+uint64_t crypt_get_keyslots_size_bytes(struct crypt_device *cd);
+uint64_t crypt_get_data_offset_sectors(struct crypt_device *cd);
+int crypt_opal_supported(struct crypt_device *cd, struct device *opal_device);
+
 int crypt_confirm(struct crypt_device *cd, const char *msg);
 
 char *crypt_lookup_dev(const char *dev_id);
 int crypt_dev_is_rotational(int major, int minor);
+int crypt_dev_is_dax(int major, int minor);
+int crypt_dev_is_zoned(int major, int minor);
+int crypt_dev_is_nop_dif(int major, int minor, uint32_t *tag_size);
 int crypt_dev_is_partition(const char *dev_path);
 char *crypt_get_partition_device(const char *dev_path, uint64_t offset, uint64_t size);
+int crypt_dev_get_partition_number(const char *dev_path);
 char *crypt_get_base_device(const char *dev_path);
 uint64_t crypt_dev_partition_offset(const char *dev_path);
 int lookup_by_disk_id(const char *dm_uuid);
 int lookup_by_sysfs_uuid_field(const char *dm_uuid);
-int crypt_uuid_cmp(const char *dm_uuid, const char *hdr_uuid);
 
 size_t crypt_getpagesize(void);
 unsigned crypt_cpusonline(void);
 uint64_t crypt_getphysmemory_kb(void);
+uint64_t crypt_getphysmemoryfree_kb(void);
+bool crypt_swapavailable(void);
 
 int init_crypto(struct crypt_device *ctx);
 
@@ -202,7 +215,7 @@ void crypt_set_luks2_reencrypt(struct crypt_device *cd, struct luks2_reencrypt *
 struct luks2_reencrypt *crypt_get_luks2_reencrypt(struct crypt_device *cd);
 
 int onlyLUKS2(struct crypt_device *cd);
-int onlyLUKS2mask(struct crypt_device *cd, uint32_t mask);
+int onlyLUKS2reencrypt(struct crypt_device *cd);
 
 int crypt_wipe_device(struct crypt_device *cd,
 	struct device *device,
@@ -215,15 +228,32 @@ int crypt_wipe_device(struct crypt_device *cd,
 
 /* Internal integrity helpers */
 const char *crypt_get_integrity(struct crypt_device *cd);
-int crypt_get_integrity_key_size(struct crypt_device *cd);
+int crypt_get_integrity_key_size(struct crypt_device *cd, bool dm_compat);
 int crypt_get_integrity_tag_size(struct crypt_device *cd);
 
 int crypt_key_in_keyring(struct crypt_device *cd);
 void crypt_set_key_in_keyring(struct crypt_device *cd, unsigned key_in_keyring);
 int crypt_volume_key_load_in_keyring(struct crypt_device *cd, struct volume_key *vk);
+int crypt_keyring_get_user_key(struct crypt_device *cd,
+		const char *key_description,
+		char **key,
+		size_t *key_size);
+int crypt_keyring_get_key_by_name(struct crypt_device *cd,
+		const char *key_description,
+		char **key,
+		size_t *key_size);
+
+int crypt_keyring_get_keysize_by_name(struct crypt_device *cd,
+		const char *key_description,
+		size_t *r_key_size);
+
 int crypt_use_keyring_for_vk(struct crypt_device *cd);
-void crypt_drop_keyring_key_by_description(struct crypt_device *cd, const char *key_description, key_type_t ktype);
-void crypt_drop_keyring_key(struct crypt_device *cd, struct volume_key *vks);
+void crypt_unlink_key_from_thread_keyring(struct crypt_device *cd,
+		key_serial_t key_id);
+void crypt_unlink_key_by_description_from_thread_keyring(struct crypt_device *cd,
+		const char *key_description,
+		key_type_t ktype);
+void crypt_drop_uploaded_keyring_key(struct crypt_device *cd, struct volume_key *vks);
 
 static inline uint64_t compact_version(uint16_t major, uint16_t minor, uint16_t patch, uint16_t release)
 {
@@ -245,9 +275,17 @@ static inline void *crypt_zalloc(size_t size) { return calloc(1, size); }
 static inline bool uint64_mult_overflow(uint64_t *u, uint64_t b, size_t size)
 {
 	*u = (uint64_t)b * size;
+	if (size == 0)
+		return true;
 	if ((uint64_t)(*u / size) != b)
 		return true;
 	return false;
 }
 
+#define KEY_NOT_VERIFIED -2
+#define KEY_EXTERNAL_VERIFICATION -1
+#define KEY_VERIFIED 0
+
+size_t crypt_safe_alloc_size(const void *data);
+
 #endif /* INTERNAL_H */

lib/keyslot_context.h

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * LUKS - Linux Unified Key Setup, keyslot unlock helpers
  *
- * Copyright (C) 2022-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2022-2023 Ondrej Kozina
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2022-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2022-2025 Ondrej Kozina
  */
 
 #ifndef KEYSLOT_CONTEXT_H
@@ -27,6 +14,9 @@
 
 #include "internal.h"
 
+struct bitlk_metadata;
+struct fvault2_params;
+
 typedef int (*keyslot_context_get_key) (
 	struct crypt_device *cd,
 	struct crypt_keyslot_context *kc,
@@ -40,16 +30,58 @@ typedef int (*keyslot_context_get_volume_key) (
 	int keyslot,
 	struct volume_key **r_vk);
 
+typedef int (*keyslot_context_get_generic_volume_key) (
+	struct crypt_device *cd,
+	struct crypt_keyslot_context *kc,
+	struct volume_key **r_vk);
+
+typedef int (*keyslot_context_get_bitlk_volume_key) (
+	struct crypt_device *cd,
+	struct crypt_keyslot_context *kc,
+	const struct bitlk_metadata *params,
+	struct volume_key **r_vk);
+
+typedef int (*keyslot_context_get_fvault2_volume_key) (
+	struct crypt_device *cd,
+	struct crypt_keyslot_context *kc,
+	const struct fvault2_params *params,
+	struct volume_key **r_vk);
+
+
+typedef int (*keyslot_context_get_generic_signed_key) (
+	struct crypt_device *cd,
+	struct crypt_keyslot_context *kc,
+	struct volume_key **r_vk,
+	struct volume_key **r_signature);
+
 typedef int (*keyslot_context_get_passphrase) (
 	struct crypt_device *cd,
 	struct crypt_keyslot_context *kc,
 	const char **r_passphrase,
 	size_t *r_passphrase_size);
 
+typedef void (*keyslot_context_free) (
+	struct crypt_keyslot_context *kc);
+
+typedef int (*keyslot_context_get_key_size) (
+	struct crypt_device *cd,
+	struct crypt_keyslot_context *kc,
+	size_t *r_key_size);
+
+#define KC_VERSION_BASIC          UINT8_C(1)
+#define KC_VERSION_SELF_CONTAINED UINT8_C(2)
+
 /* crypt_keyslot_context */
 struct crypt_keyslot_context {
 	int type;
 
+	/* versions:
+	 * v1: All passed pointers (e.g.: type, passphrase, keyfile,...) must
+	 *     be valid after ctx initialization.
+	 * v2: Fully self-contained
+	 */
+	uint8_t version;
+
 	union {
 	struct {
 		const char *passphrase;
@@ -57,20 +89,41 @@ struct crypt_keyslot_context {
 	} p;
 	struct {
 		const char *keyfile;
+		char *i_keyfile;
 		uint64_t keyfile_offset;
 		size_t keyfile_size;
 	} kf;
 	struct {
 		int id;
 		const char *type;
+		char *i_type;
 		const char *pin;
+		char *i_pin;
 		size_t pin_size;
 		void *usrptr;
 	} t;
 	struct {
 		const char *volume_key;
 		size_t volume_key_size;
+		struct volume_key *i_vk;
 	} k;
+	struct {
+		const char *volume_key;
+		size_t volume_key_size;
+		struct volume_key *i_vk;
+		const char *signature;
+		size_t signature_size;
+		struct volume_key *i_vk_sig;
+	} ks;
+	struct {
+		const char *key_description;
+		char *i_key_description;
+	} kr;
+	struct {
+		const char *key_description;
+		char *i_key_description;
+		size_t i_key_size;
+	} vk_kr;
 	} u;
 
 	int error;
@@ -78,34 +131,50 @@ struct crypt_keyslot_context {
 	char *i_passphrase;
 	size_t i_passphrase_size;
 
-	keyslot_context_get_key		get_luks2_key;
-	keyslot_context_get_volume_key	get_luks1_volume_key;
-	keyslot_context_get_volume_key	get_luks2_volume_key;
-	keyslot_context_get_passphrase	get_passphrase;
+	keyslot_context_get_key			get_luks2_key;
+	keyslot_context_get_volume_key		get_luks1_volume_key;
+	keyslot_context_get_volume_key		get_luks2_volume_key;
+	keyslot_context_get_generic_volume_key	get_plain_volume_key;
+	keyslot_context_get_bitlk_volume_key	get_bitlk_volume_key;
+	keyslot_context_get_fvault2_volume_key	get_fvault2_volume_key;
+	keyslot_context_get_generic_signed_key	get_verity_volume_key;
+	keyslot_context_get_generic_volume_key	get_integrity_volume_key;
+	keyslot_context_get_passphrase		get_passphrase;
+	keyslot_context_get_key_size		get_key_size;
+	keyslot_context_free			context_free;
 };
 
 void crypt_keyslot_context_destroy_internal(struct crypt_keyslot_context *method);
 
-void crypt_keyslot_unlock_by_key_init_internal(struct crypt_keyslot_context *kc,
+void crypt_keyslot_context_init_by_key_internal(struct crypt_keyslot_context *kc,
 	const char *volume_key,
 	size_t volume_key_size);
 
-void crypt_keyslot_unlock_by_passphrase_init_internal(struct crypt_keyslot_context *kc,
+void crypt_keyslot_context_init_by_signed_key_internal(struct crypt_keyslot_context *kc,
+	const char *volume_key,
+	size_t volume_key_size,
+	const char *signature,
+	size_t signature_size);
+
+void crypt_keyslot_context_init_by_passphrase_internal(struct crypt_keyslot_context *kc,
 	const char *passphrase,
 	size_t passphrase_size);
 
-void crypt_keyslot_unlock_by_keyfile_init_internal(struct crypt_keyslot_context *kc,
+void crypt_keyslot_context_init_by_keyfile_internal(struct crypt_keyslot_context *kc,
 	const char *keyfile,
 	size_t keyfile_size,
 	uint64_t keyfile_offset);
 
-void crypt_keyslot_unlock_by_token_init_internal(struct crypt_keyslot_context *kc,
+void crypt_keyslot_context_init_by_token_internal(struct crypt_keyslot_context *kc,
 	int token,
 	const char *type,
 	const char *pin,
 	size_t pin_size,
 	void *usrptr);
 
+void crypt_keyslot_context_init_by_keyring_internal(struct crypt_keyslot_context *kc,
+	const char *key_description);
+
 const char *keyslot_context_type_string(const struct crypt_keyslot_context *kc);
 
 #endif /* KEYSLOT_CONTEXT_H */

lib/libcryptsetup.h

@@ -1,24 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 /*
  * libcryptsetup - cryptsetup library
  *
  * Copyright (C) 2004 Jana Saout <jana@saout.de>
  * Copyright (C) 2004-2007 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2009-2023 Milan Broz
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2009-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2009-2025 Milan Broz
  */
 
 /**
@@ -273,7 +260,7 @@ struct crypt_pbkdf_type {
 
 /** Iteration time set by crypt_set_iteration_time(), for compatibility only. */
 #define CRYPT_PBKDF_ITER_TIME_SET   (UINT32_C(1) << 0)
-/** Never run benchmarks, use pre-set value or defaults. */
+/** Never run benchmarks or limit by system resources, use pre-set values or defaults. */
 #define CRYPT_PBKDF_NO_BENCHMARK    (UINT32_C(1) << 1)
 
 /** PBKDF2 according to RFC2898, LUKS1 legacy */
@@ -450,6 +437,34 @@ const char *crypt_get_type(struct crypt_device *cd);
  */
 const char *crypt_get_default_type(void);
 
+/**
+ * @defgroup crypt-hw-encryption-types HW encryption type
+ * @addtogroup crypt-hw-encryption-types
+ * @{
+ */
+/** SW encryption, no OPAL encryption in place (default) */
+#define CRYPT_SW_ONLY        INT16_C(0)
+/** OPAL HW encryption only (no SW encryption!) */
+#define CRYPT_OPAL_HW_ONLY   INT16_C(1)
+/** SW encryption stacked over OPAL HW encryption  */
+#define CRYPT_SW_AND_OPAL_HW INT16_C(2)
+/** @} */
+
+/**
+ * Get HW encryption type
+ *
+ * @return HW encryption type (see @link crypt-hw-encryption-types @endlink)
+ *         or negative errno otherwise.
+ */
+int crypt_get_hw_encryption_type(struct crypt_device *cd);
+
+/**
+ * Get HW encryption (like OPAL) key size (in bytes)
+ *
+ * @return key size or 0 if no HW encryption is used.
+ */
+int crypt_get_hw_encryption_key_size(struct crypt_device *cd);
+
 /**
  *
  * Structure used as parameter for PLAIN device type.
@@ -579,7 +594,7 @@ struct crypt_params_integrity {
 	uint32_t sector_size;                /**< sector size in bytes */
 	uint32_t buffer_sectors;             /**< number of sectors in one buffer */
 	const char *integrity;               /**< integrity algorithm, NULL for LUKS2 */
-	uint32_t integrity_key_size;         /**< integrity key size in bytes, info only, 0 for LUKS2 */
+	uint32_t integrity_key_size;         /**< integrity key size in bytes, info only */
 
 	const char *journal_integrity;       /**< journal integrity algorithm */
 	const char *journal_integrity_key;   /**< journal integrity key, only for crypt_load */
@@ -609,6 +624,18 @@ struct crypt_params_luks2 {
 	const char *label;       /**< header label or @e NULL*/
 	const char *subsystem;   /**< header subsystem label or @e NULL*/
 };
+
+/**
+ * Structure used as parameter for OPAL (HW encrypted) device type.
+ *
+ * @see crypt_format_luks2_opal
+ *
+ */
+struct crypt_params_hw_opal {
+	const char *admin_key;   /**< admin key */
+	size_t admin_key_size;   /**< admin key size in bytes */
+	size_t user_key_size;    /**< user authority key size part in bytes */
+};
 /** @} */
 
 /**
@@ -648,6 +675,63 @@ int crypt_format(struct crypt_device *cd,
 	size_t volume_key_size,
 	void *params);
 
+/**
+ * Create (format) new LUKS2 crypt device over HW OPAL device but do not activate it.
+ *
+ * @pre @e cd contains initialized and not formatted device context (device type must @b not be set)
+ *
+ * @param cd crypt device handle
+ * @param cipher for SW encryption (e.g. "aes") or NULL for HW encryption only
+ * @param cipher_mode including IV specification (e.g. "xts-plain") or NULL for HW encryption only
+ * @param uuid requested UUID or @e NULL if it should be generated
+ * @param volume_keys pre-generated volume keys or @e NULL if it should be generated (only for LUKS2 SW encryption)
+ * @param volume_keys_size size of volume keys in bytes (only for SW encryption).
+ * @param params LUKS2 crypt type specific parameters (see @link crypt-type @endlink)
+ * @param opal_params OPAL specific parameters
+ *
+ * @returns @e 0 on success or negative errno value otherwise.
+ *
+ * @note Note that crypt_format_luks2_opal does not create LUKS keyslot.
+ *       To create keyslot call any crypt_keyslot_add_* function.
+ */
+int crypt_format_luks2_opal(struct crypt_device *cd,
+	const char *cipher,
+	const char *cipher_mode,
+	const char *uuid,
+	const char *volume_keys,
+	size_t volume_keys_size,
+	struct crypt_params_luks2 *params,
+	struct crypt_params_hw_opal *opal_params);
+
+/**
+ * Create (format) new integrity-protected device using integrity inline mode (HW sector tags).
+ * This can be used for @e INTEGRITY and @e LUKS2 with integrity protection
+ *
+ * @pre @e cd contains initialized and not formatted device context (device type must @b not be set)
+ *
+ * @param cd crypt device handle
+ * @param type type of device (optional params struct must be of this type)
+ * @param cipher (e.g. "aes") or @e NULL for @e INTEGRITY
+ * @param cipher_mode including IV specification (e.g. "xts-plain") or @e NULL for @e INTEGRITY
+ * @param uuid requested UUID or @e NULL if it should be generated
+ * @param volume_key pre-generated integrity/volume key (if needed) or @e NULL
+ * @param volume_key_size size of volume/integrity key in bytes.
+ * @param params crypt type specific parameters (see @link crypt-type @endlink)
+ *
+ * @returns @e 0 on success or negative errno value otherwise.
+ *
+ * @note Journal parameters must be set to zero in integrity part of @e params.
+ * 	Only tag_size, sector_size, buffer_sectors, integrity options should be set.
+ */
+int crypt_format_inline(struct crypt_device *cd,
+	const char *type,
+	const char *cipher,
+	const char *cipher_mode,
+	const char *uuid,
+	const char *volume_key,
+	size_t volume_key_size,
+	void *params);
+
 /**
  * Set format compatibility flags.
  *
@@ -941,6 +1025,23 @@ int crypt_resume_by_token_pin(struct crypt_device *cd,
 	const char *pin,
 	size_t pin_size,
 	void *usrptr);
+
+/**
+ * Resume crypt device using keyslot context.
+ *
+ * @param cd crypt device handle
+ * @param name name of device to resume
+ * @param keyslot requested keyslot to check or @e CRYPT_ANY_SLOT, keyslot is
+ *        ignored for unlock methods not based on passphrase
+ * @param kc keyslot context providing volume key or passphrase.
+ *
+ * @return unlocked key slot number for passphrase-based unlock, zero for other
+ *         unlock methods (e.g. volume key context) or negative errno on error.
+ */
+int crypt_resume_by_keyslot_context(struct crypt_device *cd,
+			       const char *name,
+			       int keyslot,
+			       struct crypt_keyslot_context *kc);
 /** @} */
 
 /**
@@ -1099,7 +1200,7 @@ int crypt_keyslot_add_by_volume_key(struct crypt_device *cd,
  * @warning CRYPT_VOLUME_KEY_SET flag force updates volume key. It is @b not @b reencryption!
  * 	    By doing so you will most probably destroy your ciphertext data device. It's supposed
  * 	    to be used only in wrapped keys scheme for key refresh process where real (inner) volume
- * 	    key stays untouched. It may be involed on active @e keyslot which makes the (previously
+ * 	    key stays untouched. It may be involved on active @e keyslot which makes the (previously
  * 	    unbound) keyslot new regular keyslot.
  */
 int crypt_keyslot_add_by_key(struct crypt_device *cd,
@@ -1132,6 +1233,10 @@ void crypt_keyslot_context_free(struct crypt_keyslot_context *kc);
  * @param kc returns crypt keyslot context handle type CRYPT_KC_TYPE_PASSPHRASE
  *
  * @return zero on success or negative errno otherwise.
+ *
+ * @note The original buffer containing passphrase passed in parameters does
+ * 	 not have to be valid after context initialization. The context
+ * 	 contains copy of the original before freed with @link crypt_keyslot_context_free @endlink.
  */
 int crypt_keyslot_context_init_by_passphrase(struct crypt_device *cd,
 	const char *passphrase,
@@ -1194,6 +1299,59 @@ int crypt_keyslot_context_init_by_volume_key(struct crypt_device *cd,
 	size_t volume_key_size,
 	struct crypt_keyslot_context **kc);
 
+/**
+ * Initialize keyslot context via signed key.
+ *
+ * @param cd crypt device handle initialized to device context
+ *
+ * @param volume_key provided volume key
+ * @param volume_key_size size of volume_key
+ * @param signature buffer with signature for the key
+ * @param signature_size bsize of signature buffer
+ * @param kc returns crypt keyslot context handle type CRYPT_KC_TYPE_SIGNED_KEY
+ *
+ * @return zero on success or negative errno otherwise.
+ *
+ * @note currently supported only with VERITY devices.
+ */
+int crypt_keyslot_context_init_by_signed_key(struct crypt_device *cd,
+	const char *volume_key,
+	size_t volume_key_size,
+	const char *signature,
+	size_t signature_size,
+	struct crypt_keyslot_context **kc);
+
+/**
+ * Initialize keyslot context via passphrase stored in a keyring.
+ *
+ * @param cd crypt device handle initialized to LUKS device context
+ *
+ * @param key_description kernel keyring key description library should look
+ *        for passphrase in
+ * @param kc returns crypt keyslot context handle type CRYPT_KC_TYPE_KEYRING
+ *
+ * @return zero on success or negative errno otherwise.
+ */
+int crypt_keyslot_context_init_by_keyring(struct crypt_device *cd,
+	const char *key_description,
+	struct crypt_keyslot_context **kc);
+
+/**
+ * Initialize keyslot context via volume key stored in a keyring.
+ *
+ * @param cd crypt device handle initialized to LUKS device context
+ *
+ * @param key_description kernel keyring key description library should look
+ *        for passphrase in. The key can be passed either as number in ASCII,
+ *        or a text representation in the form "%<key_type>:<key_name>"
+ * @param kc returns crypt keyslot context handle type CRYPT_KC_TYPE_KEYRING
+ *
+ * @return zero on success or negative errno otherwise.
+ */
+int crypt_keyslot_context_init_by_vk_in_keyring(struct crypt_device *cd,
+	const char *key_description,
+	struct crypt_keyslot_context **kc);
+
 /**
  * Get error code per keyslot context from last failed call.
  *
@@ -1225,7 +1383,7 @@ int crypt_keyslot_context_set_pin(struct crypt_device *cd,
 	struct crypt_keyslot_context *kc);
 
 /**
- * @defgroup crypt-keyslot-context-types Crypt keyslot context
+ * @defgroup crypt-keyslot-context-types Crypt keyslot context types
  * @addtogroup crypt-keyslot-context-types
  * @{
  */
@@ -1237,6 +1395,16 @@ int crypt_keyslot_context_set_pin(struct crypt_device *cd,
 #define CRYPT_KC_TYPE_TOKEN      INT16_C(3)
 /** keyslot context initialized by volume key or unbound key (@link crypt_keyslot_context_init_by_volume_key @endlink) */
 #define CRYPT_KC_TYPE_KEY        INT16_C(4)
+/** keyslot context initialized by description of a keyring key
+ * (@link crypt_keyslot_context_init_by_keyring @endlink)
+ */
+#define CRYPT_KC_TYPE_KEYRING    INT16_C(5)
+/** keyslot context initialized by description of a keyring key containing the volume key
+ * (@link crypt_keyslot_context_init_by_vk_in_keyring @endlink)
+ */
+#define CRYPT_KC_TYPE_VK_KEYRING    INT16_C(6)
+/** keyslot context initialized by signed key (@link crypt_keyslot_context_init_by_signed_key @endlink) */
+#define CRYPT_KC_TYPE_SIGNED_KEY    INT16_C(7)
 /** @} */
 
 /**
@@ -1281,7 +1449,7 @@ int crypt_keyslot_context_get_type(const struct crypt_keyslot_context *kc);
  * @warning CRYPT_VOLUME_KEY_SET flag force updates volume key. It is @b not @b reencryption!
  * 	    By doing so you will most probably destroy your ciphertext data device. It's supposed
  * 	    to be used only in wrapped keys scheme for key refresh process where real (inner) volume
- * 	    key stays untouched. It may be involed on active @e keyslot which makes the (previously
+ * 	    key stays untouched. It may be involved on active @e keyslot which makes the (previously
  * 	    unbound) keyslot new regular keyslot.
  */
 int crypt_keyslot_add_by_keyslot_context(struct crypt_device *cd,
@@ -1369,6 +1537,12 @@ int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot);
 #define CRYPT_ACTIVATE_RECALCULATE_RESET (UINT32_C(1) << 26)
 /** dm-verity: try to use tasklets */
 #define CRYPT_ACTIVATE_TASKLETS (UINT32_C(1) << 27)
+/** dm-crypt: use high-priority workqueues */
+#define CRYPT_ACTIVATE_HIGH_PRIORITY (UINT32_C(1) << 28)
+/** dm-verity: also restart/panic on error, use with RESTART_ON_CORRUPTION or PANIC_ON_CORRUPTION */
+#define CRYPT_ACTIVATE_ERROR_AS_CORRUPTION (UINT32_C(1) << 29)
+/** dm-integrity: inline mode for compatible hardware profile */
+#define CRYPT_ACTIVATE_INLINE_MODE (UINT32_C(1) << 30)
 
 /**
  * Active device runtime attributes
@@ -1420,6 +1594,10 @@ uint64_t crypt_get_active_integrity_failures(struct crypt_device *cd,
 #define CRYPT_REQUIREMENT_OFFLINE_REENCRYPT	(UINT32_C(1) << 0)
 /** Online reencryption in-progress */
 #define CRYPT_REQUIREMENT_ONLINE_REENCRYPT	(UINT32_C(1) << 1)
+/** Device configured with OPAL support */
+#define CRYPT_REQUIREMENT_OPAL			(UINT32_C(1) << 2)
+/** Device configured with inline HW tags */
+#define CRYPT_REQUIREMENT_INLINE_HW_TAGS	(UINT32_C(1) << 3)
 /** unknown requirement in header (output only) */
 #define CRYPT_REQUIREMENT_UNKNOWN		(UINT32_C(1) << 31)
 
@@ -1442,9 +1620,11 @@ typedef enum {
  *
  * @note Valid only for LUKS2.
  *
- * @note Not all activation flags can be stored. Only ALLOW_DISCARD,
- * 	 SAME_CPU_CRYPT, SUBMIT_FROM_CRYPT_CPU and NO_JOURNAL can be
- * 	 stored persistently.
+ * @note Not all activation flags can be stored. Only CRYPT_ACTIVATE_ALLOW_DISCARDS,
+ *       CRYPT_ACTIVATE_SAME_CPU_CRYPT, CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS,
+ *       CRYPT_ACTIVATE_NO_JOURNAL, CRYPT_ACTIVATE_NO_READ_WORKQUEUE,
+ *       CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE and CRYPT_ACTIVATE_HIGH_PRIORITY
+ *       can be stored persistently.
  *
  * @note Only requirements flags recognised by current library may be set.
  *	 CRYPT_REQUIREMENT_UNKNOWN is illegal (output only) in set operation.
@@ -1473,6 +1653,39 @@ int crypt_persistent_flags_get(struct crypt_device *cd,
  * @{
  */
 
+/**
+ * Activate device or check using keyslot context. In some cases (device under
+ * reencryption), more than one keyslot context is required (e.g. one for the old
+ * volume key and one for the new volume key). The order of the keyslot
+ * contexts does not matter. When less keyslot contexts are supplied than
+ * required to unlock the device an -ESRCH error code is returned and you
+ * should call the function again with an additional keyslot context specified.
+ *
+ * NOTE: the API at the moment fully works for single keyslot context only,
+ * the additional keyslot context currently works only with
+ * @e CRYPT_KC_TYPE_VK_KEYRING or @e CRYPT_KC_TYPE_KEY contexts.
+ *
+ * @param cd crypt device handle
+ * @param name name of device to create, if @e NULL only check passphrase
+ * @param keyslot requested keyslot to check or @e CRYPT_ANY_SLOT, keyslot is
+ *        ignored for unlock methods not based on passphrase
+ * @param kc keyslot context providing volume key or passphrase.
+ * @param additional_keyslot requested additional keyslot to check or @e CRYPT_ANY_SLOT
+ * @param additional_kc keyslot context providing additional volume key or
+ *        passphrase (e.g. old volume key for device under reencryption).
+ * @param flags activation flags
+ *
+ * @return unlocked key slot number for passphrase-based unlock, zero for other
+ *         unlock methods (e.g. volume key context) or negative errno on error.
+ */
+int crypt_activate_by_keyslot_context(struct crypt_device *cd,
+	const char *name,
+	int keyslot,
+	struct crypt_keyslot_context *kc,
+	int additional_keyslot,
+	struct crypt_keyslot_context *additional_kc,
+	uint32_t flags);
+
 /**
  * Activate device or check passphrase.
  *
@@ -1553,6 +1766,9 @@ int crypt_activate_by_keyfile(struct crypt_device *cd,
  * 	 CRYPT_ACTIVATE_READONLY flag always.
  * @note For TCRYPT the volume key should be always NULL
  * 	 the key from decrypted header is used instead.
+ * @note For BITLK the name cannot be @e NULL checking volume key is not
+ * 	 supported for BITLK, the device will be activated even if the
+ * 	 provided key is not correct.
  */
 int crypt_activate_by_volume_key(struct crypt_device *cd,
 	const char *name,
@@ -1851,6 +2067,19 @@ uint64_t crypt_get_iv_offset(struct crypt_device *cd);
  */
 int crypt_get_volume_key_size(struct crypt_device *cd);
 
+/**
+ * Get size (in bytes) of old volume key for LUKS2 device in reencryption.
+ *
+ * @param cd crypt LUKS2 device handle
+ *
+ * @return old volume key size when device is in reencryption state
+ *
+ * @note For LUKS2, this function can be used only if there is at least
+ *       one keyslot assigned to old data segment. Also with reencryption
+ *       mode 'encrypt' there's no old volume key.
+ */
+int crypt_get_old_volume_key_size(struct crypt_device *cd);
+
 /**
  * Get size (in bytes) of encryption sector for crypt device.
  *
@@ -2259,6 +2488,36 @@ int crypt_wipe(struct crypt_device *cd,
 
 /** Use direct-io */
 #define CRYPT_WIPE_NO_DIRECT_IO (UINT32_C(1) << 0)
+
+enum {
+	CRYPT_LUKS2_SEGMENT = -2,
+	CRYPT_NO_SEGMENT = -1,
+};
+
+/**
+ * Safe erase of a partition or an entire OPAL device. WARNING: ALL DATA ON
+ * PARTITION/DISK WILL BE LOST. If the CRYPT_NO_SEGMENT is passed as the segment
+ * parameter, the entire device will be wiped, not just what is included in the
+ * LUKS2 device/partition.
+ *
+ * @param cd crypt device handle
+ * @param segment the segment number to wipe (0..8), or CRYPT_LUKS2_SEGMENT
+ *        to wipe the segment configured in the LUKS2 header, or CRYPT_NO_SEGMENT
+ *        to wipe the entire device via a factory reset.
+ * @param password admin password/PSID (for factory reset) to wipe the
+ *        partition/device
+ * @param password_size length of password/PSID
+ * @param flags (currently unused)
+ *
+ * @return @e 0 on success or negative errno value otherwise.
+ */
+int crypt_wipe_hw_opal(struct crypt_device *cd,
+	int segment, /* 0..8, CRYPT_LUKS2_SEGMENT -2, CRYPT_NO_SEGMENT -1 */
+	const char *password, /* Admin1 PIN or PSID */
+	size_t password_size,
+	uint32_t flags /* currently unused */
+);
+
 /** @} */
 
 /**
@@ -2392,11 +2651,11 @@ int crypt_token_luks2_keyring_get(struct crypt_device *cd,
  * (There can be more keyslots assigned to one token id.)
  *
  * @param cd crypt device handle
- * @param token token id
+ * @param token specific token id
  * @param keyslot keyslot to be assigned to token (CRYPT_ANY SLOT
  * 	  assigns all active keyslots to token)
  *
- * @return allocated token id or negative errno otherwise.
+ * @return requested token id to be assigned or negative errno otherwise.
  */
 int crypt_token_assign_keyslot(struct crypt_device *cd,
 	int token,
@@ -2407,11 +2666,11 @@ int crypt_token_assign_keyslot(struct crypt_device *cd,
  * (There can be more keyslots assigned to one token id.)
  *
  * @param cd crypt device handle
- * @param token token id
+ * @param token specific token id
  * @param keyslot keyslot to be unassigned from token (CRYPT_ANY SLOT
  * 	  unassigns all active keyslots from token)
  *
- * @return allocated token id or negative errno otherwise.
+ * @return requested token id to be unassigned or negative errno otherwise.
  */
 int crypt_token_unassign_keyslot(struct crypt_device *cd,
 	int token,
@@ -2566,6 +2825,17 @@ int crypt_token_register(const crypt_token_handler *handler);
  */
 const char *crypt_token_external_path(void);
 
+/**
+ * Override configured external token handlers path for the library.
+ *
+ * @param path Absolute path (starts with '/') to new external token handlers directory or @e NULL.
+ *
+ * @note if @e path is @e NULL the external token path is reset to default path.
+ *
+ * @return @e 0 on success or negative errno value otherwise.
+ */
+int crypt_token_set_external_path(const char *path);
+
 /**
  * Disable external token handlers (plugins) support
  * If disabled, it cannot be enabled again.
@@ -2685,6 +2955,12 @@ int crypt_activate_by_token_pin(struct crypt_device *cd,
 #define CRYPT_REENCRYPT_RECOVERY           (UINT32_C(1) << 3)
 /** Reencryption requires metadata protection. (in/out) */
 #define CRYPT_REENCRYPT_REPAIR_NEEDED      (UINT32_C(1) << 4)
+/**
+ *  Calculate new (future) volume key digest directly during
+ *  reencryption initialization. The keyslot context for new
+ *  volume key must be CRYPT_KC_TYPE_KEY or
+ *  CRYPT_KC_TYPE_VK_KEYRING. (in) */
+#define CRYPT_REENCRYPT_CREATE_NEW_DIGEST  (UINT32_C(1) << 5)
 
 /**
  * Reencryption direction
@@ -2781,6 +3057,71 @@ int crypt_reencrypt_init_by_keyring(struct crypt_device *cd,
 	const char *cipher_mode,
 	const struct crypt_params_reencrypt *params);
 
+/**
+ *
+ * Initialize or reload LUKS2 reencryption operation using keyslot contexts.
+ *
+ * The function can initialize reencryption on-disk metadata or reload reencryption
+ * context from on-disk LUSK2 metadata to resume interrupted operation.
+ *
+ * If the device is not in reencryption state (@link crypt_reencrypt_status @endlink
+ * returns @link CRYPT_REENCRYPT_NONE @endlink) the function initializes on-disk
+ * metadata to include all necessary reencryption segments and new encryption
+ * parameters (cipher, cipher mode, encryption sector size) according to the
+ * provided parameters.
+ *
+ * If on-disk metadata already describes reencryption operation
+ * (@link crypt_reencrypt_status @endlink returns @link CRYPT_REENCRYPT_CLEAN @endlink),
+ * it loads these parameters and internally initializes reencryption context. It also verifies
+ * if the device is eligible to resume reencryption operation. Some reencryption parameters
+ * (@link crypt_params_reencrypt @endlink) may be modified depending on the original values in
+ * the initialization call. When resuming the operation, all parameters may be omitted except
+ * @e cd, @e name (offline/online),@e kc_old and @e kc_new.
+ *
+ * If on-disk metadata describes reencryption operation requiring recovery
+ * (@link crypt_reencrypt_status @endlink returns @link CRYPT_REENCRYPT_CRASH @endlink),
+ * it can be recovered by adding @link CRYPT_REENCRYPT_RECOVERY @endlink flag in @link
+ * crypt_params_reencrypt @endlink parameter.
+ *
+ * @param cd crypt device handle
+ * @param name name of the active device or @e NULL for offline reencryption
+ * @param kc_old keyslot context providing access to volume key in keyslot id @e keyslot_old.
+ * @param kc_new keyslot context providing access to volume key in keyslot id @e keyslot_new.
+ * @param keyslot_old keyslot id containing current volume key for the device or CRYPT_ANY_SLOT
+ * @param keyslot_new keyslot id containing (unbound) future volume key in encryption or reencryption
+ *        operation. It must be set in the initialization call except when initializing the decrypt
+ *        operation. In reencryption operation it may contain also the current volume key in case the
+ *        volume key change is not requested.
+ * @param cipher new cipher specification (e.g. "aes") or @e NULL in decryption. Relevant only
+ * 	  during metadata initialization.
+ * @param cipher_mode cipher mode and IV (e.g. "xts-plain64") or @e NULL in decryption.
+ * 	  Relevant only during metadata initialization.
+ * @param params reencryption parameters @link crypt_params_reencrypt @endlink.
+ *
+ * @return reencryption key slot number or negative errno otherwise.
+ *
+ * @note Only after successful reencryption initialization you may run the operation with
+ * 	 @link crypt_reencrypt_run @endlink.
+ *
+ * @note During @link CRYPT_REENCRYPT_REENCRYPT @endlink operation it is highly recommended
+ * 	 to use same keyslot context (same passphrase, token, keyfile, etc) in both @e kc_old
+ * 	 and @e kc_new parameters for at least one keyslot containing future volume key and one
+ * 	 keyslot containing current volume key. If the same keyslot context can not be used
+ * 	 to unlock any current or any future volume key it would be impossible to perform reencryption
+ * 	 crash recovery during device activation for example after system reboot. Any keyslot
+ * 	 passphrase may be changed in-before initializing reencryption operation via @link
+ * 	 crypt_keyslot_change_by_passphrase @endlink.
+ */
+int crypt_reencrypt_init_by_keyslot_context(struct crypt_device *cd,
+	const char *name,
+	struct crypt_keyslot_context *kc_old,
+	struct crypt_keyslot_context *kc_new,
+	int keyslot_old,
+	int keyslot_new,
+	const char *cipher,
+	const char *cipher_mode,
+	const struct crypt_params_reencrypt *params);
+
 /**
  * Legacy data reencryption function.
  *
@@ -2805,6 +3146,8 @@ __attribute__((deprecated));
  * @param usrptr progress specific data
  *
  * @return @e 0 on success or negative errno value otherwise.
+ *
+ * @note A @e progress callback can interrupt reencryption process by returning non-zero code.
  */
 int crypt_reencrypt_run(struct crypt_device *cd,
 		    int (*progress)(uint64_t size, uint64_t offset, void *usrptr),
@@ -2873,6 +3216,64 @@ void *crypt_safe_realloc(void *data, size_t size);
  */
 void crypt_safe_memzero(void *data, size_t size);
 
+/**
+ * Memcpy helper to avoid spilling sensitive data through additional registers
+ *
+ * @param dst pointer to memory to be written
+ * @param src pointer to memory to be copied
+ * @param size size of memory in bytes
+ */
+void *crypt_safe_memcpy(void *dst, const void *src, size_t size);
+
+/** @} */
+
+/**
+ * @defgroup crypt-keyring Kernel keyring manipulation
+ * @addtogroup crypt-keyring
+ * @{
+ */
+
+/**
+ * Link the volume key to the specified kernel keyring.
+ *
+ * The volume can have one or two keys. Normally, the device has one key.
+ * However if reencryption was started and not finished yet, the volume will
+ * have two volume keys (the new VK for the already reencrypted segment and old
+ * VK for the not yet reencrypted segment).
+ *
+ * The @e old_key_description argument is required only for
+ * devices that are in re-encryption and have two volume keys at the same time
+ * (old and new). You can set the @e old_key_description to NULL,
+ * but if you supply number of keys less than required, the function will
+ * return -ESRCH.  In that case you need to call the function again and set
+ * the missing key description. When supplying just one key description, make
+ * sure to supply it in the @e key_description.
+ *
+ * @param cd crypt device handle
+ * @param key_description the key description of the volume key linked in desired keyring.
+ * @param old_key_description the key description of the old volume key linked in desired keyring
+ *	  (for devices in re-encryption).
+ * @param key_type_desc the key type used for the volume key. Currently only "user" and "logon" types are
+ *	  supported. if @e NULL is specified the default "user" type is applied.
+ * @param keyring_to_link_vk the keyring description of the keyring in which volume key should
+ *	  be linked, if @e NULL is specified, linking will be disabled.
+ *
+ * @note keyring_to_link_vk may be passed in various string formats:
+ * 	 It can be kernel key numeric id of existing keyring written as a string,
+ * 	 keyring name prefixed by either "%:" or "%keyring:" substrings or keyctl
+ * 	 special values for keyrings "@t", "@p", "@s" and so on. See keyctl(1) man page,
+ * 	 section KEY IDENTIFIERS for more information. All other prefixes starting "%<type>:"
+ * 	 are ignored.
+ *
+ * @note key_description "%<type>:" prefixes are ignored. Type is applied based on key_type parameter
+ * 	 value.
+ */
+int crypt_set_keyring_to_link(struct crypt_device* cd,
+	const char* key_description,
+	const char* old_key_description,
+	const char* key_type_desc,
+	const char* keyring_to_link_vk);
+
 /** @} */
 
 #ifdef __cplusplus

lib/libcryptsetup.sym

@@ -165,3 +165,33 @@ CRYPTSETUP_2.6 {
 		crypt_keyslot_add_by_keyslot_context;
 		crypt_volume_key_get_by_keyslot_context;
 } CRYPTSETUP_2.5;
+
+CRYPTSETUP_2.7 {
+	global:
+		crypt_activate_by_keyslot_context;
+		crypt_format_luks2_opal;
+		crypt_get_hw_encryption_type;
+		crypt_get_hw_encryption_key_size;
+		crypt_keyslot_context_init_by_keyring;
+		crypt_keyslot_context_init_by_vk_in_keyring;
+		crypt_keyslot_context_init_by_signed_key;
+		crypt_resume_by_keyslot_context;
+		crypt_token_set_external_path;
+		crypt_set_keyring_to_link;
+		crypt_wipe_hw_opal;
+} CRYPTSETUP_2.6;
+
+CRYPTSETUP_2.8 {
+	global:
+		crypt_safe_memcpy;
+		crypt_keyslot_context_init_by_passphrase;
+		crypt_keyslot_context_init_by_keyfile;
+		crypt_keyslot_context_init_by_token;
+		crypt_keyslot_context_init_by_volume_key;
+		crypt_keyslot_context_init_by_signed_key;
+		crypt_keyslot_context_init_by_keyring;
+		crypt_keyslot_context_init_by_vk_in_keyring;
+		crypt_reencrypt_init_by_keyslot_context;
+		crypt_get_old_volume_key_size;
+		crypt_format_inline;
+} CRYPTSETUP_2.7;

lib/libcryptsetup_macros.h

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * Definitions of common constant and generic macros of libcryptsetup
  *
- * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2009-2023 Milan Broz
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2009-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2009-2025 Milan Broz
  */
 
 #ifndef _LIBCRYPTSETUP_MACROS_H
@@ -62,9 +49,17 @@
 #define DEFAULT_MEM_ALIGNMENT	4096
 
 #define DM_UUID_LEN		129
+#define DM_NAME_LEN		128
 #define DM_BY_ID_PREFIX		"dm-uuid-"
 #define DM_BY_ID_PREFIX_LEN	8
 #define DM_UUID_PREFIX		"CRYPT-"
 #define DM_UUID_PREFIX_LEN	6
 
+#define OPAL_PSID_LEN		32
+
+/* LUKS AF stripes, never set to any other value than 4000 */
+#ifndef LUKS_STRIPES
+# define LUKS_STRIPES 4000
+#endif
+
 #endif /* _LIBCRYPTSETUP_MACROS_H */

lib/libcryptsetup_symver.h

@@ -1,21 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * Helpers for defining versioned symbols
  *
- * Copyright (C) 2021-2023 Red Hat, Inc. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2021-2025 Red Hat, Inc. All rights reserved.
  */
 
 #ifndef _LIBCRYPTSETUP_SYMVER_H

lib/loopaes/loopaes.c

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * loop-AES compatible volume handling
  *
- * Copyright (C) 2011-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2011-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2011-2025 Milan Broz
  */
 
 #include <errno.h>
@@ -82,6 +69,7 @@ static int hash_keys(struct crypt_device *cd,
 	char tweak, *key_ptr;
 	unsigned int i;
 	int r = 0;
+	void *key = NULL;
 
 	hash_name = hash_override ?: get_hash(key_len_output);
 	tweak = get_tweak(keys_count);
@@ -92,24 +80,30 @@ static int hash_keys(struct crypt_device *cd,
 		return -EINVAL;
 	}
 
-	*vk = crypt_alloc_volume_key((size_t)key_len_output * keys_count, NULL);
-	if (!*vk)
+	key = crypt_safe_alloc((size_t)key_len_output * keys_count);
+	if (!key)
 		return -ENOMEM;
 
 	for (i = 0; i < keys_count; i++) {
-		key_ptr = &(*vk)->key[i * key_len_output];
+		key_ptr = &((char *)key)[i * key_len_output];
 		r = hash_key(input_keys[i], key_len_input, key_ptr,
 			     key_len_output, hash_name);
 		if (r < 0)
-			break;
+			goto err;
 
 		key_ptr[0] ^= tweak;
 	}
 
-	if (r < 0 && *vk) {
-		crypt_free_volume_key(*vk);
-		*vk = NULL;
+	*vk = crypt_alloc_volume_key_by_safe_alloc(&key);
+	if (!*vk) {
+		r = -ENOMEM;
+		goto err;
 	}
+
+	return 0;
+err:
+	crypt_safe_free(key);
+	*vk = NULL;
 	return r;
 }
 
@@ -158,7 +152,7 @@ int LOOPAES_parse_keyfile(struct crypt_device *cd,
 	key_lengths[0] = 0;
 	while (offset < buffer_len && key_index < LOOPAES_KEYS_MAX) {
 		keys[key_index] = &buffer[offset];
-		key_lengths[key_index] = 0;;
+		key_lengths[key_index] = 0;
 		while (offset < buffer_len && buffer[offset]) {
 			offset++;
 			key_lengths[key_index]++;
@@ -204,7 +198,7 @@ int LOOPAES_activate(struct crypt_device *cd,
 		     uint32_t flags)
 {
 	int r;
-	uint32_t req_flags, dmc_flags;
+	uint64_t req_flags, dmc_flags;
 	char *cipher = NULL;
 	struct crypt_dm_active_device dmd = {
 		.flags = flags,
@@ -226,9 +220,8 @@ int LOOPAES_activate(struct crypt_device *cd,
 		return -ENOMEM;
 
 	r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd),
-			vk, cipher, crypt_get_iv_offset(cd),
-			crypt_get_data_offset(cd), crypt_get_integrity(cd),
-			crypt_get_integrity_tag_size(cd), crypt_get_sector_size(cd));
+			vk, cipher, crypt_get_iv_offset(cd), crypt_get_data_offset(cd),
+			NULL, 0, 0, crypt_get_sector_size(cd));
 
 	if (r) {
 		free(cipher);

lib/loopaes/loopaes.h

@@ -1,22 +1,9 @@
+// SPDX-License-Identifier: LGPL-2.1-or-later
 /*
  * loop-AES compatible volume handling
  *
- * Copyright (C) 2011-2023 Red Hat, Inc. All rights reserved.
- * Copyright (C) 2011-2023 Milan Broz
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this file; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2011-2025 Milan Broz
  */
 
 #ifndef _LOOPAES_H

lib/luks1/af.c

@@ -1,25 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * AFsplitter - Anti forensic information splitter
  *
  * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2009-2025 Red Hat, Inc. All rights reserved.
  *
  * AFsplitter diffuses information over a large stripe of data,
  * therefore supporting secure data destruction.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Library General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
 #include <stddef.h>

lib/luks1/af.h

@@ -1,26 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
  * AFsplitter - Anti forensic information splitter
  *
  * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2009-2023 Red Hat, Inc. All rights reserved.
- *
- * AFsplitter diffuses information over a large stripe of data,
- * therefore supporting secure data destruction.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Library General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ * Copyright (C) 2009-2025 Red Hat, Inc. All rights reserved.
  */
+
 #ifndef INCLUDED_CRYPTSETUP_LUKS_AF_H
 #define INCLUDED_CRYPTSETUP_LUKS_AF_H