xnu-3247.10.11.tar.gz

[apple/xnu.git] / bsd / hfs / hfs_cprotect.c

/*
 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
#if CONFIG_PROTECT

#include <sys/mount.h>
#include <sys/random.h>
#include <sys/xattr.h>
#include <sys/uio_internal.h>
#include <sys/ubc_internal.h>
#include <sys/vnode_if.h>
#include <sys/vnode_internal.h>
#include <sys/fcntl.h>
#include <libkern/OSByteOrder.h>
#include <libkern/crypto/sha1.h>
#include <sys/proc.h>
#include <sys/kauth.h>

#include "hfs.h"
#include "hfs_cnode.h"
#include "hfs_fsctl.h"
#include "hfs_cprotect.h"


#define PTR_ADD(type, base, offset)		(type)((uintptr_t)(base) + (offset))

/*
 * The wrap function pointers and the variable to indicate if they
 * are initialized are system-wide, and hence are defined globally.
 */ 
static struct cp_wrap_func g_cp_wrap_func = {};
static int are_wraps_initialized = false;

extern int (**hfs_vnodeop_p) (void *);

/*
 * CP private functions
 */
static int cp_root_major_vers(mount_t mp);
static int cp_getxattr(cnode_t *, struct hfsmount *hfsmp, struct cprotect **);
static void cp_entry_dealloc(hfsmount_t *hfsmp, struct cprotect *entry);
static int cp_restore_keys(struct cprotect *, struct hfsmount *hfsmp, struct cnode *);
static int cp_lock_vfs_callback(mount_t, void *);
static int cp_lock_vnode_callback(vnode_t, void *);
static int cp_vnode_is_eligible (vnode_t);
static int cp_check_access (cnode_t *cp, struct hfsmount *hfsmp, int vnop);
static int cp_unwrap(struct hfsmount *, struct cprotect *, struct cnode *);
static void cp_init_access(cp_cred_t access, struct cnode *cp);


#if DEVELOPMENT || DEBUG
#define CP_ASSERT(x)		\
	if ((x) == 0) {			\
		panic("Content Protection: failed assertion in %s", __FUNCTION__); 	\
	}
#else
#define CP_ASSERT(x)
#endif

// -- cpx_t accessors --

size_t cpx_size(size_t key_size)
{
	size_t size = sizeof(struct cpx) + key_size;

#if DEBUG
	size += 4; // Extra for magic
#endif

	return size;
}

static size_t cpx_sizex(const struct cpx *cpx)
{
	return cpx_size(cpx->cpx_max_key_len);
}

cpx_t cpx_alloc(size_t key_len)
{
	cpx_t cpx;

	MALLOC(cpx, cpx_t, cpx_size(key_len), M_TEMP, M_WAITOK);

	cpx_init(cpx, key_len);

	return cpx;
}

#if DEBUG
static const uint32_t cpx_magic1 = 0x7b787063;		// cpx{
static const uint32_t cpx_magic2 = 0x7870637d;		// }cpx
#endif

void cpx_free(cpx_t cpx)
{
#if DEBUG
	assert(cpx->cpx_magic1 == cpx_magic1);
	assert(*PTR_ADD(uint32_t *, cpx, cpx_sizex(cpx) - 4) == cpx_magic2);
#endif
	bzero(cpx->cpx_cached_key, cpx->cpx_max_key_len);
	FREE(cpx, M_TEMP);
}

void cpx_init(cpx_t cpx, size_t key_len)
{
#if DEBUG
	cpx->cpx_magic1 = cpx_magic1;
	*PTR_ADD(uint32_t *, cpx, cpx_size(key_len) - 4) = cpx_magic2;
#endif
	cpx->cpx_flags = 0;
	cpx->cpx_key_len = 0;
	cpx->cpx_max_key_len = key_len;
}

bool cpx_is_sep_wrapped_key(const struct cpx *cpx)
{
	return ISSET(cpx->cpx_flags, CPX_SEP_WRAPPEDKEY);
}

void cpx_set_is_sep_wrapped_key(struct cpx *cpx, bool v)
{
	if (v)
		SET(cpx->cpx_flags, CPX_SEP_WRAPPEDKEY);
	else
		CLR(cpx->cpx_flags, CPX_SEP_WRAPPEDKEY);
}

bool cpx_use_offset_for_iv(const struct cpx *cpx)
{
	return ISSET(cpx->cpx_flags, CPX_USE_OFFSET_FOR_IV);
}

void cpx_set_use_offset_for_iv(struct cpx *cpx, bool v)
{
	if (v)
		SET(cpx->cpx_flags, CPX_USE_OFFSET_FOR_IV);
	else
		CLR(cpx->cpx_flags, CPX_USE_OFFSET_FOR_IV);
}

uint16_t cpx_max_key_len(const struct cpx *cpx)
{
	return cpx->cpx_max_key_len;
}

uint16_t cpx_key_len(const struct cpx *cpx)
{
	return cpx->cpx_key_len;
}

void cpx_set_key_len(struct cpx *cpx, uint16_t key_len)
{
	cpx->cpx_key_len = key_len;

	if (ISSET(cpx->cpx_flags, CPX_IV_AES_CTX_HFS)) {
		/*
		 * We assume that if the key length is being modified, the key
		 * has changed.  As a result, un-set any bits related to the
		 * AES context, if needed. They should be re-generated
		 * on-demand.
		 */ 
		CLR(cpx->cpx_flags, CPX_IV_AES_CTX_INITIALIZED | CPX_IV_AES_CTX_HFS);
	}
}

bool cpx_has_key(const struct cpx *cpx)
{
	return cpx->cpx_key_len > 0;
}

#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wcast-qual"
void *cpx_key(const struct cpx *cpx)
{
	return (void *)cpx->cpx_cached_key;
}
#pragma clang diagnostic pop

static void cpx_set_aes_iv_key(struct cpx *cpx, void *iv_key)
{
	aes_encrypt_key128(iv_key, &cpx->cpx_iv_aes_ctx);
	SET(cpx->cpx_flags, CPX_IV_AES_CTX_INITIALIZED | CPX_USE_OFFSET_FOR_IV);
	CLR(cpx->cpx_flags, CPX_IV_AES_CTX_HFS);
}

aes_encrypt_ctx *cpx_iv_aes_ctx(struct cpx *cpx)
{
	if (ISSET(cpx->cpx_flags, CPX_IV_AES_CTX_INITIALIZED))
		return &cpx->cpx_iv_aes_ctx;
 
 	SHA1_CTX sha1ctxt;
	uint8_t digest[SHA_DIGEST_LENGTH]; /* Kiv */

	/* First init the cp_cache_iv_key[] */
	SHA1Init(&sha1ctxt);
 
	/*
	 * We can only use this when the keys are generated in the AP; As a result
	 * we only use the first 32 bytes of key length in the cache key 
	 */
	SHA1Update(&sha1ctxt, cpx->cpx_cached_key, cpx->cpx_key_len);
	SHA1Final(digest, &sha1ctxt);

	cpx_set_aes_iv_key(cpx, digest);
	SET(cpx->cpx_flags, CPX_IV_AES_CTX_HFS);

	return &cpx->cpx_iv_aes_ctx;
}

static void cpx_flush(cpx_t cpx)
{
	bzero(cpx->cpx_cached_key, cpx->cpx_max_key_len);
	bzero(&cpx->cpx_iv_aes_ctx, sizeof(cpx->cpx_iv_aes_ctx));
	cpx->cpx_flags = 0;
	cpx->cpx_key_len = 0;
}

static bool cpx_can_copy(const struct cpx *src, const struct cpx *dst)
{
	return src->cpx_key_len <= dst->cpx_max_key_len;
}

void cpx_copy(const struct cpx *src, cpx_t dst)
{
	uint16_t key_len = cpx_key_len(src);
	cpx_set_key_len(dst, key_len);
	memcpy(cpx_key(dst), cpx_key(src), key_len);
	dst->cpx_flags = src->cpx_flags;
	if (ISSET(dst->cpx_flags, CPX_IV_AES_CTX_INITIALIZED))
		dst->cpx_iv_aes_ctx = src->cpx_iv_aes_ctx;
}

// -- cp_key_pair accessors --

void cpkp_init(cp_key_pair_t *cpkp, uint16_t max_pers_key_len,
			   uint16_t max_cached_key_len)
{
	cpkp->cpkp_max_pers_key_len = max_pers_key_len;
	cpkp->cpkp_pers_key_len = 0;
	cpx_init(&cpkp->cpkp_cpx, max_cached_key_len);

	// Default to using offsets
	cpx_set_use_offset_for_iv(&cpkp->cpkp_cpx, true);
}

uint16_t cpkp_max_pers_key_len(const cp_key_pair_t *cpkp)
{
	return cpkp->cpkp_max_pers_key_len;
}

uint16_t cpkp_pers_key_len(const cp_key_pair_t *cpkp)
{
	return cpkp->cpkp_pers_key_len;
}

static bool cpkp_has_pers_key(const cp_key_pair_t *cpkp)
{
	return cpkp->cpkp_pers_key_len > 0;
}

static void *cpkp_pers_key(const cp_key_pair_t *cpkp)
{
	return PTR_ADD(void *, &cpkp->cpkp_cpx, cpx_sizex(&cpkp->cpkp_cpx));
}

static void cpkp_set_pers_key_len(cp_key_pair_t *cpkp, uint16_t key_len)
{
	if (key_len > cpkp->cpkp_max_pers_key_len)
		panic("hfs_cprotect: key too big!");
	cpkp->cpkp_pers_key_len = key_len;
}

#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wcast-qual"
cpx_t cpkp_cpx(const cp_key_pair_t *cpkp)
{
	// Cast to remove const qualifier
	return (cpx_t)&cpkp->cpkp_cpx;
}
#pragma clang diagnostic pop

size_t cpkp_size(uint16_t pers_key_len, uint16_t cached_key_len)
{
	return (sizeof(cp_key_pair_t) - sizeof(struct cpx)
			+ pers_key_len + cpx_size(cached_key_len));
}

size_t cpkp_sizex(const cp_key_pair_t *cpkp)
{
	return cpkp_size(cpkp->cpkp_max_pers_key_len, cpkp->cpkp_cpx.cpx_max_key_len);
}

void cpkp_flush(cp_key_pair_t *cpkp)
{
	cpx_flush(&cpkp->cpkp_cpx);
	cpkp->cpkp_pers_key_len = 0;
	bzero(cpkp_pers_key(cpkp), cpkp->cpkp_max_pers_key_len);
}

bool cpkp_can_copy(const cp_key_pair_t *src, const cp_key_pair_t *dst)
{
	return (cpkp_pers_key_len(src) <= dst->cpkp_max_pers_key_len
			&& cpx_can_copy(&src->cpkp_cpx, &dst->cpkp_cpx));
}

void cpkp_copy(const cp_key_pair_t *src, cp_key_pair_t *dst)
{
	const uint16_t key_len = cpkp_pers_key_len(src);
	cpkp_set_pers_key_len(dst, key_len);
	memcpy(cpkp_pers_key(dst), cpkp_pers_key(src), key_len);
	cpx_copy(&src->cpkp_cpx, &dst->cpkp_cpx);
}

// --

bool cp_is_supported_version(uint16_t vers)
{
	return vers == CP_VERS_4 || vers == CP_VERS_5;
}

/*
 * Return the appropriate key and, if requested, the physical offset and
 * maximum length for a particular I/O operation.
 */
void cp_io_params(__unused hfsmount_t *hfsmp, cprotect_t cpr,
				  __unused off_rsrc_t off_rsrc,
				  __unused int direction, cp_io_params_t *io_params)
{

	io_params->max_len = INT64_MAX;
	io_params->phys_offset = -1;
	io_params->cpx = cpkp_cpx(&cpr->cp_keys);
}

static void cp_flush_cached_keys(cprotect_t cpr)
{
	cpx_flush(cpkp_cpx(&cpr->cp_keys));
}

static bool cp_needs_pers_key(cprotect_t cpr)
{
	if (CP_CLASS(cpr->cp_pclass) == PROTECTION_CLASS_F)
		return !cpx_has_key(cpkp_cpx(&cpr->cp_keys));
	else
		return !cpkp_has_pers_key(&cpr->cp_keys);
}

int
cp_key_store_action(int action)
{

	if (action < 0 || action > CP_MAX_STATE) {
		return -1;
	}
	
	/* 
	 * The lock state is kept locally to each data protected filesystem to 
	 * avoid using globals.  Pass along the lock request to each filesystem
	 * we iterate through.
	 */

	/*
	 * Upcast the value in 'action' to be a pointer-width unsigned integer.
	 * This avoids issues relating to pointer-width. 
	 */
	return vfs_iterate(0, cp_lock_vfs_callback, (void*)(uintptr_t)action);
}


int
cp_register_wraps(cp_wrap_func_t key_store_func)
{
	g_cp_wrap_func.new_key = key_store_func->new_key;
	g_cp_wrap_func.unwrapper = key_store_func->unwrapper;
	g_cp_wrap_func.rewrapper = key_store_func->rewrapper;
	/* do not use invalidater until rdar://12170050 goes in ! */
	g_cp_wrap_func.invalidater = key_store_func->invalidater;
	g_cp_wrap_func.backup_key = key_store_func->backup_key;

	/* Mark the functions as initialized in the function pointer container */
	are_wraps_initialized = true;

	return 0;
}

static cp_key_revision_t cp_initial_key_revision(__unused hfsmount_t *hfsmp)
{
	return 1;
}

cp_key_revision_t cp_next_key_revision(cp_key_revision_t rev)
{
	rev = (rev + 0x0100) ^ (mach_absolute_time() & 0xff);
	if (!rev)
		rev = 1;
	return rev;
}

/*
 * Allocate and initialize a cprotect blob for a new cnode.
 * Called from hfs_getnewvnode: cnode is locked exclusive.
 * 
 * Read xattr data off the cnode. Then, if conditions permit,
 * unwrap the file key and cache it in the cprotect blob.
 */
int
cp_entry_init(struct cnode *cp, struct mount *mp)
{
	struct cprotect *entry = NULL;
	int error = 0;
	struct hfsmount *hfsmp = VFSTOHFS(mp);

	/*
	 * The cnode should be locked at this point, regardless of whether or not
	 * we are creating a new item in the namespace or vending a vnode on behalf
	 * of lookup.  The only time we tell getnewvnode to skip the lock is when 
	 * constructing a resource fork vnode. But a resource fork vnode must come
	 * after the regular data fork cnode has already been constructed.
	 */
	if (!cp_fs_protected (mp)) {
		cp->c_cpentry = NULL;
		return 0;
	}

	if (!S_ISREG(cp->c_mode) && !S_ISDIR(cp->c_mode)) {
		cp->c_cpentry = NULL;
		return 0;
	}

	if (are_wraps_initialized == false)  {
		printf("hfs: cp_update_entry: wrap functions not yet set\n");
		return ENXIO;
	}

	if (hfsmp->hfs_running_cp_major_vers == 0) {
		panic ("hfs cp: no running mount point version! ");		
	}

	CP_ASSERT (cp->c_cpentry == NULL);

	error = cp_getxattr(cp, hfsmp, &entry);
	if (error == ENOATTR) {
		/*
		 * Normally, we should always have a CP EA for a file or directory that
		 * we are initializing here. However, there are some extenuating circumstances,
		 * such as the root directory immediately following a newfs_hfs.
		 *
		 * As a result, we leave code here to deal with an ENOATTR which will always
		 * default to a 'D/NONE' key, though we don't expect to use it much.
		 */
		cp_key_class_t target_class = PROTECTION_CLASS_D;

		if (S_ISDIR(cp->c_mode)) {
			target_class = PROTECTION_CLASS_DIR_NONE;
		}

		cp_key_revision_t key_revision = cp_initial_key_revision(hfsmp);

		/* allow keybag to override our class preferences */
		error = cp_new (&target_class, hfsmp, cp, cp->c_mode, CP_KEYWRAP_DIFFCLASS,
						key_revision, (cp_new_alloc_fn)cp_entry_alloc, (void **)&entry);
		if (error == 0) {
			entry->cp_pclass = target_class;
			entry->cp_key_os_version = cp_os_version();
			entry->cp_key_revision = key_revision;
			error = cp_setxattr (cp, entry, hfsmp, cp->c_fileid, XATTR_CREATE);
		}
	}

	/* 
	 * Bail out if:
	 * a) error was not ENOATTR (we got something bad from the getxattr call)
	 * b) we encountered an error setting the xattr above.
	 * c) we failed to generate a new cprotect data structure.
	 */
	if (error) {
		goto out;
	}	

	cp->c_cpentry = entry;

out:
	if (error == 0) {
		entry->cp_backing_cnode = cp;
	}
	else {
		if (entry) {
			cp_entry_destroy(hfsmp, entry);
		}
		cp->c_cpentry = NULL;
	}

	return error;
}

/*
 * cp_setup_newentry
 * 
 * Generate a keyless cprotect structure for use with the new AppleKeyStore kext.
 * Since the kext is now responsible for vending us both wrapped/unwrapped keys
 * we need to create a keyless xattr upon file / directory creation. When we have the inode value
 * and the file/directory is established, then we can ask it to generate keys.  Note that
 * this introduces a potential race;  If the device is locked and the wrapping
 * keys are purged between the time we call this function and the time we ask it to generate
 * keys for us, we could have to fail the open(2) call and back out the entry.
 */

int cp_setup_newentry (struct hfsmount *hfsmp, struct cnode *dcp,
					   cp_key_class_t suppliedclass, mode_t cmode,
					   struct cprotect **tmpentry)
{
	int isdir = 0;
	struct cprotect *entry = NULL;
	uint32_t target_class = hfsmp->default_cp_class;
	suppliedclass = CP_CLASS(suppliedclass);

	if (hfsmp->hfs_running_cp_major_vers == 0) {
		panic ("CP: major vers not set in mount!");
	}
	
	if (S_ISDIR (cmode))  {
		isdir = 1;
	}

	/* Decide the target class.  Input argument takes priority. */
	if (cp_is_valid_class (isdir, suppliedclass)) {
		/* caller supplies -1 if it was not specified so we will default to the mount point value */
		target_class = suppliedclass;
		/*
		 * One exception, F is never valid for a directory
		 * because its children may inherit and userland will be
		 * unable to read/write to the files.
		 */
		if (isdir) {
			if (target_class == PROTECTION_CLASS_F) {
				*tmpentry = NULL;
				return EINVAL;
			}
		}
	}
	else {
		/* 
		 * If no valid class was supplied, behave differently depending on whether or not
		 * the item being created is a file or directory.
		 * 
		 * for FILE:
		 * 		If parent directory has a non-zero class, use that.
		 * 		If parent directory has a zero class (not set), then attempt to
		 *		apply the mount point default.
		 * 
		 * for DIRECTORY:
		 *		Directories always inherit from the parent; if the parent
		 * 		has a NONE class set, then we can continue to use that.
		 */
		if ((dcp) && (dcp->c_cpentry)) {
			uint32_t parentclass = CP_CLASS(dcp->c_cpentry->cp_pclass);
			/* If the parent class is not valid, default to the mount point value */
			if (cp_is_valid_class(1, parentclass)) {
				if (isdir) {
					target_class = parentclass;	
				}
				else if (parentclass != PROTECTION_CLASS_DIR_NONE) {
					/* files can inherit so long as it's not NONE */
					target_class = parentclass;
				}
			}
			/* Otherwise, we already defaulted to the mount point's default */
		}
	}

	/* Generate the cprotect to vend out */
	entry = cp_entry_alloc(NULL, 0, 0, NULL);
	if (entry == NULL) {
		*tmpentry = NULL;
		return ENOMEM;
	}	

	/* 
	 * We don't have keys yet, so fill in what we can.  At this point
	 * this blob has no keys and it has no backing xattr.  We just know the
	 * target class.
	 */
	entry->cp_flags = CP_NO_XATTR;
	/* Note this is only the effective class */
	entry->cp_pclass = target_class;
	*tmpentry = entry;

	return 0;
}

/*
 * Set up an initial key/class pair for a disassociated cprotect entry.
 * This function is used to generate transient keys that will never be
 * written to disk.  We use class F for this since it provides the exact
 * semantics that are needed here.  Because we never attach this blob to
 * a cnode directly, we take a pointer to the cprotect struct.
 *
 * This function is primarily used in the HFS FS truncation codepath
 * where we may rely on AES symmetry to relocate encrypted data from
 * one spot in the disk to another.
 */
int cpx_gentempkeys(cpx_t *pcpx, __unused struct hfsmount *hfsmp)
{
	cpx_t cpx = cpx_alloc(CP_MAX_KEYSIZE);

	cpx_set_key_len(cpx, CP_MAX_KEYSIZE);
	read_random(cpx_key(cpx), CP_MAX_KEYSIZE);
	cpx_set_use_offset_for_iv(cpx, true);

	*pcpx = cpx;

	return 0;
}

/*
 * Tear down and clear a cprotect blob for a closing file.
 * Called at hfs_reclaim_cnode: cnode is locked exclusive.
 */
void
cp_entry_destroy(hfsmount_t *hfsmp, struct cprotect *entry_ptr)
{
	if (entry_ptr == NULL) {
		/* nothing to clean up */
		return;
	}
	cp_entry_dealloc(hfsmp, entry_ptr);
}


int
cp_fs_protected (mount_t mnt) 
{
	return (vfs_flags(mnt) & MNT_CPROTECT);
}


/*
 * Return a pointer to underlying cnode if there is one for this vnode.
 * Done without taking cnode lock, inspecting only vnode state.
 */
struct cnode *
cp_get_protected_cnode(struct vnode *vp)
{
	if (!cp_vnode_is_eligible(vp)) {
		return NULL;
	}

	if (!cp_fs_protected(VTOVFS(vp))) {
		/* mount point doesn't support it */
		return NULL;
	}

	return (struct cnode*) vp->v_data;
}


/*
 * Sets *class to persistent class associated with vnode,
 * or returns error.
 */
int
cp_vnode_getclass(struct vnode *vp, int *class)
{
	struct cprotect *entry;
	int error = 0;
	struct cnode *cp;
	int took_truncate_lock = 0;
	struct hfsmount *hfsmp = NULL;

	/* Is this an interesting vp? */
	if (!cp_vnode_is_eligible (vp)) {
		return EBADF;
	}

	/* Is the mount point formatted for content protection? */
	if (!cp_fs_protected(VTOVFS(vp))) {
		return ENOTSUP;
	}

	cp = VTOC(vp);
	hfsmp = VTOHFS(vp);

	/*
	 * Take the truncate lock up-front in shared mode because we may need
	 * to manipulate the CP blob. Pend lock events until we're done here.
	 */
	hfs_lock_truncate (cp, HFS_SHARED_LOCK, HFS_LOCK_DEFAULT);
	took_truncate_lock = 1;

	/*
	 * We take only the shared cnode lock up-front.  If it turns out that
	 * we need to manipulate the CP blob to write a key out, drop the
	 * shared cnode lock and acquire an exclusive lock.
	 */
	error = hfs_lock(cp, HFS_SHARED_LOCK, HFS_LOCK_DEFAULT);
	if (error) {
		hfs_unlock_truncate(cp, HFS_LOCK_DEFAULT);
		return error;
	}

	/* pull the class from the live entry */
	entry = cp->c_cpentry;

	if (entry == NULL) {
		panic("Content Protection: uninitialized cnode %p", cp);
	}
	
	/* Note that we may not have keys yet, but we know the target class. */

	if (error == 0) {
		*class = CP_CLASS(entry->cp_pclass);
	}

	if (took_truncate_lock) {
		hfs_unlock_truncate(cp, HFS_LOCK_DEFAULT);
	}

	hfs_unlock(cp);
	return error;
}

/*
 * Sets persistent class for this file or directory.
 * If vnode cannot be protected (system file, non-regular file, non-hfs), EBADF.
 * If the new class can't be accessed now, EPERM.
 * Otherwise, record class and re-wrap key if the mount point is content-protected.
 */
int
cp_vnode_setclass(struct vnode *vp, uint32_t newclass)
{
	struct cnode *cp;
	struct cprotect *entry = 0;
	int error = 0;
	int took_truncate_lock = 0;
	struct hfsmount *hfsmp = NULL;
	int isdir = 0;

	if (vnode_isdir (vp)) {
		isdir = 1;
	}

	/* Ensure we only use the effective class here */
	newclass = CP_CLASS(newclass);

	if (!cp_is_valid_class(isdir, newclass)) {
		printf("hfs: CP: cp_setclass called with invalid class %d\n", newclass);
		return EINVAL;
	}

	/* Is this an interesting vp? */
	if (!cp_vnode_is_eligible(vp)) {
		return EBADF;
	}

	/* Is the mount point formatted for content protection? */
	if (!cp_fs_protected(VTOVFS(vp))) {
		return ENOTSUP;
	}

	hfsmp = VTOHFS(vp);
	if (hfsmp->hfs_flags & HFS_READ_ONLY) {
		return EROFS;
	}

	/*
	 * Take the cnode truncate lock exclusive because we want to manipulate the
	 * CP blob. The lock-event handling code is doing the same.  This also forces
	 * all pending IOs to drain before we can re-write the persistent and cache keys.
	 */
	cp = VTOC(vp);
	hfs_lock_truncate (cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT);
	took_truncate_lock = 1;

	/*
	 * The truncate lock is not sufficient to guarantee the CP blob
	 * isn't being used.  We must wait for existing writes to finish.
	 */
	vnode_waitforwrites(vp, 0, 0, 0, "cp_vnode_setclass");

	if (hfs_lock(cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT)) {
		return EINVAL;
	}

	entry = cp->c_cpentry;
	if (entry == NULL) {
		error = EINVAL;
		goto out;
	}

	/* 
	 * re-wrap per-file key with new class.  
	 * Generate an entirely new key if switching to F. 
	 */
	if (vnode_isreg(vp)) {
		/*
		 * The vnode is a file.  Before proceeding with the re-wrap, we need
		 * to unwrap the keys before proceeding.  This is to ensure that 
		 * the destination class's properties still work appropriately for the
		 * target class (since B allows I/O but an unwrap prior to the next unlock
		 * will not be allowed).
		 */
		if (!cpx_has_key(&entry->cp_keys.cpkp_cpx)) {
			error = cp_restore_keys (entry, hfsmp, cp);
			if (error) {
				goto out;
			}
		}

		if (newclass == PROTECTION_CLASS_F) {
			/* Verify that file is blockless if switching to class F */
			if (cp->c_datafork->ff_size > 0) {
				error = EINVAL;
				goto out;
			}

			cp_key_pair_t *cpkp;
			cprotect_t new_entry = cp_entry_alloc(NULL, 0, CP_MAX_KEYSIZE, &cpkp);

			if (!new_entry) {
				error = ENOMEM;
				goto out;
			}

			/* newclass is only the effective class */
			new_entry->cp_pclass = newclass;
			new_entry->cp_key_os_version = cp_os_version();
			new_entry->cp_key_revision = cp_next_key_revision(entry->cp_key_revision);

			cpx_t cpx = cpkp_cpx(cpkp);

			/* Class F files are not wrapped, so they continue to use MAX_KEYSIZE */
			cpx_set_key_len(cpx, CP_MAX_KEYSIZE);
			read_random (cpx_key(cpx), CP_MAX_KEYSIZE);

			cp_replace_entry(hfsmp, cp, new_entry);

			error = 0;
			goto out;
		}

		/* Deny the setclass if file is to be moved from F to something else */
		if (entry->cp_pclass == PROTECTION_CLASS_F) {
			error = EPERM;
			goto out;
		}

		if (!cpkp_has_pers_key(&entry->cp_keys)) {
			struct cprotect *new_entry = NULL;
			/*
			 * We want to fail if we can't wrap to the target class. By not setting
			 * CP_KEYWRAP_DIFFCLASS, we tell keygeneration that if it can't wrap
			 * to 'newclass' then error out.
			 */
			uint32_t flags = 0;
			error = cp_generate_keys (hfsmp, cp, newclass, flags,  &new_entry);
			if (error == 0) {
				cp_replace_entry (hfsmp, cp, new_entry);
			}
			/* Bypass the setxattr code below since generate_keys does it for us */
			goto out;
		}

		cprotect_t new_entry;
		error = cp_rewrap(cp, hfsmp, &newclass, &entry->cp_keys, entry,
						  (cp_new_alloc_fn)cp_entry_alloc, (void **)&new_entry);
		if (error) {
			/* we didn't have perms to set this class. leave file as-is and error out */
			goto out;
		}


		new_entry->cp_pclass = newclass;

		cp_replace_entry(hfsmp, cp, new_entry);
		entry = new_entry;
	}
	else if (vnode_isdir(vp)) {
		/* For directories, just update the pclass.  newclass is only effective class */
		entry->cp_pclass = newclass;
		error = 0;	
	}
	else {
		/* anything else, just error out */
		error = EINVAL;
		goto out;	
	}
	
	/* 
	 * We get here if the new class was F, or if we were re-wrapping a cprotect that already
	 * existed. If the keys were never generated, then they'll skip the setxattr calls.
	 */

	error = cp_setxattr(cp, cp->c_cpentry, VTOHFS(vp), 0, XATTR_REPLACE);
	if (error == ENOATTR) {
		error = cp_setxattr(cp, cp->c_cpentry, VTOHFS(vp), 0, XATTR_CREATE);
	}

out:

	if (took_truncate_lock) {
		hfs_unlock_truncate (cp, HFS_LOCK_DEFAULT);
	}
	hfs_unlock(cp);
	return error;
}


int cp_vnode_transcode(vnode_t vp, void *key, unsigned *len)
{
	struct cnode *cp;
	struct cprotect *entry = 0;
	int error = 0;
	int took_truncate_lock = 0;
	struct hfsmount *hfsmp = NULL;

	/* Structures passed between HFS and AKS */
	cp_cred_s access_in;
	cp_wrapped_key_s wrapped_key_in, wrapped_key_out;

	/* Is this an interesting vp? */
	if (!cp_vnode_is_eligible(vp)) {
		return EBADF;
	}

	/* Is the mount point formatted for content protection? */
	if (!cp_fs_protected(VTOVFS(vp))) {
		return ENOTSUP;
	}

	cp = VTOC(vp);
	hfsmp = VTOHFS(vp);

	/*
	 * Take the cnode truncate lock exclusive because we want to manipulate the
	 * CP blob. The lock-event handling code is doing the same.  This also forces
	 * all pending IOs to drain before we can re-write the persistent and cache keys.
	 */
	hfs_lock_truncate (cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT);
	took_truncate_lock = 1;

	if (hfs_lock(cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT)) {
		return EINVAL;
	}

	entry = cp->c_cpentry;
	if (entry == NULL) {
		error = EINVAL;
		goto out;
	}

	/* Send the per-file key in wrapped form for re-wrap with the current class information
	 * Send NULLs in the output parameters of the wrapper() and AKS will do the rest.
	 * Don't need to process any outputs, so just clear the locks and pass along the error. */
	if (vnode_isreg(vp)) {

		/* Picked up the following from cp_wrap().
		 * If needed, more comments available there. */

		if (CP_CLASS(entry->cp_pclass) == PROTECTION_CLASS_F) {
			error = EINVAL;
			goto out;
		}

		cp_init_access(&access_in, cp);

		bzero(&wrapped_key_in, sizeof(wrapped_key_in));
		bzero(&wrapped_key_out, sizeof(wrapped_key_out));

		cp_key_pair_t *cpkp = &entry->cp_keys;


		wrapped_key_in.key = cpkp_pers_key(cpkp);
		wrapped_key_in.key_len = cpkp_pers_key_len(cpkp);

		if (!wrapped_key_in.key_len) {
			error = EINVAL;
			goto out;
		}

		/* Use the actual persistent class when talking to AKS */
		wrapped_key_in.dp_class = entry->cp_pclass;
		wrapped_key_out.key = key;
		wrapped_key_out.key_len = *len;

		error = g_cp_wrap_func.backup_key(&access_in,
						&wrapped_key_in,
						&wrapped_key_out);

		if(error)
			error = EPERM;
		else
			*len = wrapped_key_out.key_len;
	}

out:
	if (took_truncate_lock) {
		hfs_unlock_truncate (cp, HFS_LOCK_DEFAULT);
	}
	hfs_unlock(cp);
	return error;
}


/*
 * Check permission for the given operation (read, write) on this node.
 * Additionally, if the node needs work, do it:
 * - create a new key for the file if one hasn't been set before
 * - write out the xattr if it hasn't already been saved
 * - unwrap the key if needed
 *
 * Takes cnode lock, and upgrades to exclusive if modifying cprotect.
 *
 * Note that this function does *NOT* take the cnode truncate lock.  This is because
 * the thread calling us may already have the truncate lock.  It is not necessary
 * because either we successfully finish this function before the keys are tossed
 * and the IO will fail, or the keys are tossed and then this function will fail.
 * Either way, the cnode lock still ultimately guards the keys.  We only rely on the
 * truncate lock to protect us against tossing the keys as a cluster call is in-flight.
 */
int
cp_handle_vnop(struct vnode *vp, int vnop, int ioflag)
{
	struct cprotect *entry;
	int error = 0;
	struct hfsmount *hfsmp = NULL;
	struct cnode *cp = NULL;

	/*
	 * First, do validation against the vnode before proceeding any further:
	 * Is this vnode originating from a valid content-protected filesystem ?
	 */
	if (cp_vnode_is_eligible(vp) == 0) {
		/*
		 * It is either not HFS or not a file/dir.  Just return success. This is a valid
		 * case if servicing i/o against another filesystem type from VFS
		 */
		return 0;
	}

	if (cp_fs_protected (VTOVFS(vp)) == 0) {
		/*
		 * The underlying filesystem does not support content protection.  This is also
		 * a valid case.  Simply return success.
		 */
		return 0;
	}

	/*
	 * At this point, we know we have a HFS vnode that backs a file or directory on a
	 * filesystem that supports content protection
	 */
	cp = VTOC(vp);

	if ((error = hfs_lock(cp, HFS_SHARED_LOCK, HFS_LOCK_DEFAULT))) {
		return error;
	}

	entry = cp->c_cpentry;

	if (entry == NULL) {
		/*
		 * If this cnode is not content protected, simply return success.
		 * Note that this function is called by all I/O-based call sites
		 * when CONFIG_PROTECT is enabled during XNU building.
		 */

		/* 
		 * All files should have cprotect structs.  It's possible to encounter
		 * a directory from a V2.0 CP system but all files should have protection
		 * EAs
		 */
		if (vnode_isreg(vp)) {
			error = EPERM;
		}

		goto out;
	}

	vp = CTOV(cp, 0);
	if (vp == NULL) {
		/* is it a rsrc */
		vp = CTOV(cp,1);
		if (vp == NULL) {
			error = EINVAL;
			goto out;
		}
	}
	hfsmp = VTOHFS(vp);

	if ((error = cp_check_access(cp, hfsmp, vnop))) {
		/* check for raw encrypted access before bailing out */
		if ((ioflag & IO_ENCRYPTED)
			&& (vnop == CP_READ_ACCESS)) {
			/*
			 * read access only + asking for the raw encrypted bytes
			 * is legitimate, so reset the error value to 0
			 */
			error = 0;
		}
		else {
			goto out;
		}
	}

	if (!ISSET(entry->cp_flags, CP_NO_XATTR)) {
		if (!S_ISREG(cp->c_mode))
			goto out;

		// If we have a persistent key and the cached key, we're done
		if (!cp_needs_pers_key(entry)
			&& cpx_has_key(cpkp_cpx(&entry->cp_keys))) {
			goto out;
		}
	}

	/* upgrade to exclusive lock */
	if (lck_rw_lock_shared_to_exclusive(&cp->c_rwlock) == FALSE) {
		if ((error = hfs_lock(cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT))) {
			return error;
		}
	} else {
		cp->c_lockowner = current_thread();
	}

	/* generate new keys if none have ever been saved */
	if (cp_needs_pers_key(entry)) {
		struct cprotect *newentry = NULL;
		/* 
		 * It's ok if this ends up being wrapped in a different class than 'pclass'.
		 * class modification is OK here. 
		 */		
		uint32_t flags = CP_KEYWRAP_DIFFCLASS;

		error = cp_generate_keys (hfsmp, cp, CP_CLASS(cp->c_cpentry->cp_pclass), flags, &newentry);	
		if (error == 0) {
			cp_replace_entry (hfsmp, cp, newentry);
			entry = newentry;
		}
		else {
			goto out;
		}
	}

	/* unwrap keys if needed */
	if (!cpx_has_key(cpkp_cpx(&entry->cp_keys))) {
		if ((vnop == CP_READ_ACCESS) && (ioflag & IO_ENCRYPTED)) {
			/* no need to try to restore keys; they are not going to be used */
			error = 0;
		}
		else {
			error = cp_restore_keys(entry, hfsmp, cp);
			if (error) {
				goto out;
			}
		}
	}

	/* write out the xattr if it's new */
	if (entry->cp_flags & CP_NO_XATTR)
		error = cp_setxattr(cp, entry, VTOHFS(cp->c_vp), 0, XATTR_CREATE);

out:

	hfs_unlock(cp);
	return error;
}

#if HFS_TMPDBG
#if !SECURE_KERNEL
static void cp_log_eperm (struct vnode* vp, int pclass, boolean_t create) {
	char procname[256] = {};
	const char *fname = "unknown";
	const char *dbgop = "open";

	int ppid = proc_selfpid();
	/* selfname does a strlcpy so we're OK */
	proc_selfname(procname, sizeof(procname));
	if (vp && vp->v_name) {
		/* steal from the namecache */
		fname = vp->v_name;
	}

	if (create) {
		dbgop = "create";	
	}
	
	printf("proc %s (pid %d) class %d, op: %s failure @ file %s\n", procname, ppid, pclass, dbgop, fname);
}
#endif
#endif


int
cp_handle_open(struct vnode *vp, int mode)
{
	struct cnode *cp = NULL ;
	struct cprotect *entry = NULL;
	struct hfsmount *hfsmp;
	int error = 0;

	/* If vnode not eligible, just return success */
	if (!cp_vnode_is_eligible(vp)) {
		return 0;
	}

	/* If mount point not properly set up, then also return success */
	if (!cp_fs_protected(VTOVFS(vp))) {
		return 0;
	}

	cp = VTOC(vp);

	// Allow if raw encrypted mode requested
	if (ISSET(mode, FENCRYPTED)) {
		return 0;
	}
	if (ISSET(mode, FUNENCRYPTED)) {
		return 0;
	}

	/* We know the vnode is in a valid state. Acquire cnode and validate */
	hfsmp = VTOHFS(vp);

	if ((error = hfs_lock(cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT))) {
		return error;
	}

	entry = cp->c_cpentry;
	if (entry == NULL) {
		/* 
		 * If the mount is protected and we couldn't get a cprotect for this vnode,
		 * then it's not valid for opening.
		 */
		if (vnode_isreg(vp)) {
			error = EPERM;
		}
		goto out;
	}

	if (!S_ISREG(cp->c_mode))
		goto out;

	/*
	 * Does the cnode have keys yet?  If not, then generate them.
	 */
	if (cp_needs_pers_key(entry)) {
		struct cprotect *newentry = NULL;
		/* Allow the keybag to override our class preferences */
		uint32_t flags = CP_KEYWRAP_DIFFCLASS;
		error = cp_generate_keys (hfsmp, cp, CP_CLASS(cp->c_cpentry->cp_pclass), flags, &newentry);
		if (error == 0) {
			cp_replace_entry (hfsmp, cp, newentry);
			entry = newentry;
		}	
		else {
			goto out;
		}
	}	

	/*
	 * We want to minimize the number of unwraps that we'll have to do since 
	 * the cost can vary, depending on the platform we're running. 
	 */
	switch (CP_CLASS(entry->cp_pclass)) {
		case PROTECTION_CLASS_B:
			if (mode & O_CREAT) {
				/* 
				 * Class B always allows creation.  Since O_CREAT was passed through
				 * we infer that this was a newly created vnode/cnode.  Even though a potential
				 * race exists when multiple threads attempt to create/open a particular
				 * file, only one can "win" and actually create it.  VFS will unset the
				 * O_CREAT bit on the loser.	 
				 * 
				 * Note that skipping the unwrap check here is not a security issue -- 
				 * we have to unwrap the key permanently upon the first I/O.
				 */
				break;
			}
			
			if (cpx_has_key(cpkp_cpx(&entry->cp_keys)) && !ISSET(mode, FENCRYPTED)) {
				/*
				 * For a class B file, attempt the unwrap if we have the key in
				 * core already. 
				 * The device could have just transitioned into the lock state, and 
				 * this vnode may not yet have been purged from the vnode cache (which would
				 * remove the keys). 
				 */
				cp_cred_s access_in;
				cp_wrapped_key_s wrapped_key_in;

				cp_init_access(&access_in, cp);
				bzero(&wrapped_key_in, sizeof(wrapped_key_in));
				wrapped_key_in.key = cpkp_pers_key(&entry->cp_keys);
				wrapped_key_in.key_len = cpkp_pers_key_len(&entry->cp_keys);
				/* Use the persistent class when talking to AKS */
				wrapped_key_in.dp_class = entry->cp_pclass;
				error = g_cp_wrap_func.unwrapper(&access_in, &wrapped_key_in, NULL);
				if (error) {
					error = EPERM;
				}
				break;
			}
			/* otherwise, fall through to attempt the unwrap/restore */
		case PROTECTION_CLASS_A:
		case PROTECTION_CLASS_C:
			/*
			 * At this point, we know that we need to attempt an unwrap if needed; we want
			 * to makes sure that open(2) fails properly if the device is either just-locked
			 * or never made it past first unlock.  Since the keybag serializes access to the
			 * unwrapping keys for us and only calls our VFS callback once they've been purged, 
			 * we will get here in two cases:
			 * 
			 * A) we're in a window before the wrapping keys are purged; this is OK since when they get 
			 * purged, the vnode will get flushed if needed.
			 * 
			 * B) The keys are already gone.  In this case, the restore_keys call below will fail. 
			 *
			 * Since this function is bypassed entirely if we're opening a raw encrypted file, 
			 * we can always attempt the restore.
			 */
			if (!cpx_has_key(cpkp_cpx(&entry->cp_keys))) {
				error = cp_restore_keys(entry, hfsmp, cp);
			}
	
			if (error) {
				error = EPERM;
			}
	
			break;

		case PROTECTION_CLASS_D:
		default:
			break;
	}

out:

#if HFS_TMPDBG
#if !SECURE_KERNEL
	if ((hfsmp->hfs_cp_verbose) && (error == EPERM)) {
		cp_log_eperm (vp, CP_CLASS(entry->cp_pclass), false);
	}
#endif
#endif

	hfs_unlock(cp);
	return error;
}


/*
 * cp_getrootxattr:
 * Gets the EA we set on the root folder (fileid 1) to get information about the
 * version of Content Protection that was used to write to this filesystem.
 * Note that all multi-byte fields are written to disk little endian so they must be
 * converted to native endian-ness as needed.
 */
int
cp_getrootxattr(struct hfsmount* hfsmp, struct cp_root_xattr *outxattr) 
{
	uio_t   auio;
	char    uio_buf[UIO_SIZEOF(1)];
	void	*buf;

	/*
	 * We allow for an extra 64 bytes to cater for upgrades.  This wouldn't
	 * be necessary if the xattr routines just returned what we asked for.
	 */
	size_t attrsize = roundup(sizeof(struct cp_root_xattr) + 64, 64);

	int error = 0;
	struct vnop_getxattr_args args;

	if (!outxattr) {
		panic("Content Protection: cp_xattr called with xattr == NULL");
	}

	MALLOC(buf, void *, attrsize, M_TEMP, M_WAITOK);

	auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ, &uio_buf[0], sizeof(uio_buf));
	uio_addiov(auio, CAST_USER_ADDR_T(buf), attrsize);

	args.a_desc = NULL; // unused
	args.a_vp = NULL; //unused since we're writing EA to root folder.
	args.a_name = CONTENT_PROTECTION_XATTR_NAME;
	args.a_uio = auio;
	args.a_size = &attrsize;
	args.a_options = XATTR_REPLACE;
	args.a_context = NULL; // unused

	error = hfs_getxattr_internal(NULL, &args, hfsmp, 1);

	if (error != 0) {
		goto out;
	}

	if (attrsize < CP_ROOT_XATTR_MIN_LEN) {
		error = HFS_EINCONSISTENT;
		goto out;
	}

	const struct cp_root_xattr *xattr = buf;

	bzero(outxattr, sizeof(*outxattr));

	/* Now convert the multi-byte fields to native endianness */
	outxattr->major_version = OSSwapLittleToHostInt16(xattr->major_version);
	outxattr->minor_version = OSSwapLittleToHostInt16(xattr->minor_version);
	outxattr->flags = OSSwapLittleToHostInt64(xattr->flags);

	if (outxattr->major_version >= CP_VERS_5) {
		if (attrsize < sizeof(struct cp_root_xattr)) {
			error = HFS_EINCONSISTENT;
			goto out;
		}
	}

out:
	uio_free(auio);
	FREE(buf, M_TEMP);
	return error;
}

/*
 * cp_setrootxattr:
 * Sets the EA we set on the root folder (fileid 1) to get information about the
 * version of Content Protection that was used to write to this filesystem.
 * Note that all multi-byte fields are written to disk little endian so they must be
 * converted to little endian as needed.
 *
 * This will be written to the disk when it detects the EA is not there, or when we need
 * to make a modification to the on-disk version that can be done in-place.
 */
int
cp_setrootxattr(struct hfsmount *hfsmp, struct cp_root_xattr *newxattr)
{
	int error = 0;
	struct vnop_setxattr_args args;

	args.a_desc = NULL;
	args.a_vp = NULL;
	args.a_name = CONTENT_PROTECTION_XATTR_NAME;
	args.a_uio = NULL; //pass data ptr instead
	args.a_options = 0;
	args.a_context = NULL; //no context needed, only done from mount.

	const uint32_t flags = newxattr->flags;

	/* Now convert the multi-byte fields to little endian before writing to disk. */
	newxattr->flags = OSSwapHostToLittleInt64(newxattr->flags);

	int xattr_size = sizeof(struct cp_root_xattr);


	newxattr->major_version = OSSwapHostToLittleInt16(newxattr->major_version);
	newxattr->minor_version = OSSwapHostToLittleInt16(newxattr->minor_version);

	error = hfs_setxattr_internal(NULL, (caddr_t)newxattr,
			xattr_size, &args, hfsmp, 1);

	if (!error) {
		hfsmp->cproot_flags = flags;
	}

	return error;
}


/*
 * Stores new xattr data on the cnode.
 * cnode lock held exclusive (if available).
 *
 * This function is also invoked during file creation.
 */
int cp_setxattr(struct cnode *cp, struct cprotect *entry, struct hfsmount *hfsmp,
				uint32_t fileid, int options)
{
	int error = 0;
	cp_key_pair_t *cpkp = &entry->cp_keys;

	if (hfsmp->hfs_flags & HFS_READ_ONLY) {
		return EROFS;
	}

	if (hfsmp->hfs_running_cp_major_vers < CP_CURRENT_VERS) {
		// Upgrade
		printf("hfs: upgrading to cp version %u\n", CP_CURRENT_VERS);

		struct cp_root_xattr root_xattr;

		error = cp_getrootxattr(hfsmp, &root_xattr);
		if (error)
			return error;

		root_xattr.major_version = CP_CURRENT_VERS;
		root_xattr.minor_version = CP_MINOR_VERS;

		error = cp_setrootxattr(hfsmp, &root_xattr);
		if (error)
			return error;

		hfsmp->hfs_running_cp_major_vers = CP_CURRENT_VERS;
	}

	struct cp_xattr_v5 *xattr;
	MALLOC(xattr, struct cp_xattr_v5 *, sizeof(*xattr), M_TEMP, M_WAITOK);

	xattr->xattr_major_version	= OSSwapHostToLittleConstInt16(CP_VERS_5);
	xattr->xattr_minor_version	= OSSwapHostToLittleConstInt16(CP_MINOR_VERS);
	xattr->flags				= 0;
	xattr->persistent_class		= OSSwapHostToLittleInt32(entry->cp_pclass);
	xattr->key_os_version		= OSSwapHostToLittleInt32(entry->cp_key_os_version);
	xattr->key_revision			= OSSwapHostToLittleInt16(entry->cp_key_revision);

	uint16_t key_len = cpkp_pers_key_len(cpkp);
	xattr->key_len	= OSSwapHostToLittleInt16(key_len);
	memcpy(xattr->persistent_key, cpkp_pers_key(cpkp), key_len);

	size_t xattr_len = offsetof(struct cp_xattr_v5, persistent_key) + key_len;


	struct vnop_setxattr_args args = {
		.a_vp		= cp ? cp->c_vp : NULL,
		.a_name		= CONTENT_PROTECTION_XATTR_NAME,
		.a_options	= options,
		.a_context	= vfs_context_current(),
	};

	error = hfs_setxattr_internal(cp, xattr, xattr_len, &args, hfsmp, fileid);

	FREE(xattr, M_TEMP);

	if (error == 0 ) {
		entry->cp_flags &= ~CP_NO_XATTR;
	}

	return error;
}

/*
 * Used by an fcntl to query the underlying FS for its content protection version #
 */

int
cp_get_root_major_vers(vnode_t vp, uint32_t *level) 
{
	int err = 0;
	struct hfsmount *hfsmp = NULL;
	struct mount *mp = NULL;

	mp = VTOVFS(vp);

	/* check if it supports content protection */
	if (cp_fs_protected(mp) == 0) {
		return ENOTSUP;
	}

	hfsmp = VFSTOHFS(mp);
	/* figure out the level */

	err = cp_root_major_vers(mp);

	if (err == 0) {
		*level = hfsmp->hfs_running_cp_major_vers;
	}
	/* in error case, cp_root_major_vers will just return EINVAL. Use that */

	return err;
}

/* Used by fcntl to query default protection level of FS */
int cp_get_default_level (struct vnode *vp, uint32_t *level) {
	int err = 0;
	struct hfsmount *hfsmp = NULL;
	struct mount *mp = NULL;

	mp = VTOVFS(vp);

	/* check if it supports content protection */
	if (cp_fs_protected(mp) == 0) {
		return ENOTSUP;
	}

	hfsmp = VFSTOHFS(mp);
	/* figure out the default */

	*level = hfsmp->default_cp_class;
	return err;
}

/********************
 * Private Functions
 *******************/

static int
cp_root_major_vers(mount_t mp)
{
	int err = 0;
	struct cp_root_xattr xattr;
	struct hfsmount *hfsmp = NULL;

	hfsmp = vfs_fsprivate(mp);
	err = cp_getrootxattr (hfsmp, &xattr);

	if (err == 0) {
		hfsmp->hfs_running_cp_major_vers = xattr.major_version;
	}
	else {
		return EINVAL;
	}

	return 0;
}

static int
cp_vnode_is_eligible(struct vnode *vp)
{
	return ((vp->v_op == hfs_vnodeop_p) &&
			(!vnode_issystem(vp)) &&
			(vnode_isreg(vp) || vnode_isdir(vp)));
}



int
cp_is_valid_class(int isdir, int32_t protectionclass)
{
	/* 
	 * The valid protection classes are from 0 -> N
	 * We use a signed argument to detect unassigned values from 
	 * directory entry creation time in HFS.
	 */
	if (isdir) {
		/* Directories are not allowed to have F, but they can have "NONE" */
		return ((protectionclass >= PROTECTION_CLASS_DIR_NONE) && 
				(protectionclass <= PROTECTION_CLASS_D));
	}
	else {
		return ((protectionclass >= PROTECTION_CLASS_A) &&
				(protectionclass <= PROTECTION_CLASS_F));
	}
}

#if DEBUG
static const uint32_t cp_magic1 = 0x7b727063;	// cpr{
static const uint32_t cp_magic2 = 0x7270637d;	// }cpr
#endif

struct cprotect *
cp_entry_alloc(cprotect_t old, uint16_t pers_key_len,
			   uint16_t cached_key_len, cp_key_pair_t **pcpkp)
{
	struct cprotect *cp_entry;

	if (pers_key_len > CP_MAX_WRAPPEDKEYSIZE)
		return (NULL);

	size_t size = (sizeof(struct cprotect) - sizeof(cp_key_pair_t)
				   + cpkp_size(pers_key_len, cached_key_len));

#if DEBUG
	size += 4;	// Extra for magic2
#endif

	MALLOC(cp_entry, struct cprotect *, size, M_TEMP, M_WAITOK);

	if (old) {
		memcpy(cp_entry, old, offsetof(struct cprotect, cp_keys));

	} else {
		bzero(cp_entry, offsetof(struct cprotect, cp_keys));
	}

#if DEBUG
	cp_entry->cp_magic1 = cp_magic1;
	*PTR_ADD(uint32_t *, cp_entry, size - 4) = cp_magic2;
#endif

	cpkp_init(&cp_entry->cp_keys, pers_key_len, cached_key_len);

	/*
	 * If we've been passed the old entry, then we are in the process of
	 * rewrapping in which case we need to copy the cached key.  This is
	 * important for class B files when the device is locked because we
	 * won't be able to unwrap whilst in this state, yet we still need the
	 * unwrapped key.
	 */
	if (old)
		cpx_copy(cpkp_cpx(&old->cp_keys), cpkp_cpx(&cp_entry->cp_keys));

	if (pcpkp)
		*pcpkp = &cp_entry->cp_keys;

	return cp_entry;
}

static void
cp_entry_dealloc(__unused hfsmount_t *hfsmp, struct cprotect *entry)
{

	cpkp_flush(&entry->cp_keys);

#if DEBUG
	assert(entry->cp_magic1 == cp_magic1);
	assert(*PTR_ADD(uint32_t *, entry, (sizeof(struct cprotect) - sizeof(cp_key_pair_t)
										+ cpkp_sizex(&entry->cp_keys) == cp_magic2)));
#endif

	FREE(entry, M_TEMP);
}

static int cp_read_xattr_v4(__unused hfsmount_t *hfsmp, struct cp_xattr_v4 *xattr,
							size_t xattr_len, cprotect_t *pcpr, cp_getxattr_options_t options)
{
	/* Endian swap the multi-byte fields into host endianness from L.E. */
	xattr->xattr_major_version = OSSwapLittleToHostInt16(xattr->xattr_major_version);
	xattr->xattr_minor_version = OSSwapLittleToHostInt16(xattr->xattr_minor_version);
	xattr->key_size = OSSwapLittleToHostInt32(xattr->key_size);
	xattr->flags = OSSwapLittleToHostInt32(xattr->flags);
	xattr->persistent_class = OSSwapLittleToHostInt32(xattr->persistent_class);
	xattr->key_os_version = OSSwapLittleToHostInt32(xattr->key_os_version);

	/*
	 * Prevent a buffer overflow, and validate the key length obtained from the
	 * EA. If it's too big, then bail out, because the EA can't be trusted at this
	 * point.
	 */
	if (xattr->key_size > CP_MAX_WRAPPEDKEYSIZE)
		return HFS_EINCONSISTENT;

	size_t min_len = offsetof(struct cp_xattr_v4, persistent_key) + xattr->key_size;
	if (xattr_len < min_len)
		return HFS_EINCONSISTENT;

	/*
	 * Class F files have no backing key; their keylength should be 0,
	 * though they should have the proper flags set.
	 *
	 * A request to instantiate a CP for a class F file should result
	 * in a bzero'd cp that just says class F, with key_flushed set.
	 */
	if (CP_CLASS(xattr->persistent_class) == PROTECTION_CLASS_F
		|| ISSET(xattr->flags, CP_XAF_NEEDS_KEYS)) {
		xattr->key_size = 0;
	}

	/* set up entry with information from xattr */
	cp_key_pair_t *cpkp;
	cprotect_t entry;
	
	if (ISSET(options, CP_GET_XATTR_BASIC_INFO)) {
		/* caller passed in a pre-allocated structure to get the basic info */
		entry = *pcpr;
		bzero(entry, offsetof(struct cprotect, cp_keys));
	}
	else {
		entry = cp_entry_alloc(NULL, xattr->key_size, CP_MAX_CACHEBUFLEN, &cpkp);
	}

	entry->cp_pclass = xattr->persistent_class;
	entry->cp_key_os_version = xattr->key_os_version;


	if (!ISSET(options, CP_GET_XATTR_BASIC_INFO)) {
		if (xattr->key_size) {
			cpkp_set_pers_key_len(cpkp, xattr->key_size);
			memcpy(cpkp_pers_key(cpkp), xattr->persistent_key, xattr->key_size);
		}

		*pcpr = entry;
	}
	else if (xattr->key_size) {
		SET(entry->cp_flags, CP_HAS_A_KEY);
	}

	return 0;
}

int cp_read_xattr_v5(hfsmount_t *hfsmp, struct cp_xattr_v5 *xattr,
					 size_t xattr_len, cprotect_t *pcpr, cp_getxattr_options_t options)
{
	if (xattr->xattr_major_version == OSSwapHostToLittleConstInt16(CP_VERS_4)) {
		return cp_read_xattr_v4(hfsmp, (struct cp_xattr_v4 *)xattr, xattr_len, pcpr, options);
	}

	xattr->xattr_major_version	= OSSwapLittleToHostInt16(xattr->xattr_major_version);

	if (xattr->xattr_major_version != CP_VERS_5) {
		printf("hfs: cp_getxattr: unsupported xattr version %d\n",
			   xattr->xattr_major_version);
		return ENOTSUP;
	}

	size_t min_len = offsetof(struct cp_xattr_v5, persistent_key);

	if (xattr_len < min_len)
		return HFS_EINCONSISTENT;

	xattr->xattr_minor_version	= OSSwapLittleToHostInt16(xattr->xattr_minor_version);
	xattr->flags				= OSSwapLittleToHostInt32(xattr->flags);
	xattr->persistent_class		= OSSwapLittleToHostInt32(xattr->persistent_class);
	xattr->key_os_version		= OSSwapLittleToHostInt32(xattr->key_os_version);
	xattr->key_revision			= OSSwapLittleToHostInt16(xattr->key_revision);
	xattr->key_len				= OSSwapLittleToHostInt16(xattr->key_len);

	uint16_t pers_key_len = xattr->key_len;

	min_len += pers_key_len;
	if (xattr_len < min_len)
		return HFS_EINCONSISTENT;


	cp_key_pair_t *cpkp;
	cprotect_t entry;
	
	/* 
	 * If option CP_GET_XATTR_BASIC_INFO is set, we only return basic
	 * information about the file's protection (and not the key) and
	 * we store the result in the structure the caller passed to us.
	 */
	if (ISSET(options, CP_GET_XATTR_BASIC_INFO)) {
		entry = *pcpr;
		bzero(entry, offsetof(struct cprotect, cp_keys));
	} else {
		entry = cp_entry_alloc(NULL, xattr->key_len, CP_MAX_CACHEBUFLEN, &cpkp);
	}

	entry->cp_pclass			= xattr->persistent_class;
	entry->cp_key_os_version	= xattr->key_os_version;
	entry->cp_key_revision		= xattr->key_revision;

	if (!ISSET(options, CP_GET_XATTR_BASIC_INFO)) {
		if (xattr->key_len) {
			cpkp_set_pers_key_len(cpkp, xattr->key_len);
			memcpy(cpkp_pers_key(cpkp), xattr->persistent_key, xattr->key_len);
		}


		*pcpr = entry;
	}
	else if (xattr->key_len) {
		SET(entry->cp_flags, CP_HAS_A_KEY);
	}

	return 0;
}

/*
 * Initializes a new cprotect entry with xattr data from the cnode.
 * cnode lock held shared
 */
static int
cp_getxattr(struct cnode *cp, struct hfsmount *hfsmp, cprotect_t *outentry)
{
	size_t xattr_len = sizeof(struct cp_xattr_v5);
	struct cp_xattr_v5 *xattr;

	MALLOC (xattr, struct cp_xattr_v5 *, xattr_len,
			M_TEMP, M_WAITOK);

	int error = hfs_xattr_read(cp->c_vp, CONTENT_PROTECTION_XATTR_NAME,
							   xattr, &xattr_len);

	if (!error) {
		if (xattr_len < CP_XATTR_MIN_LEN)
			error = HFS_EINCONSISTENT;
		else
			error = cp_read_xattr_v5(hfsmp, xattr, xattr_len, outentry, 0);
	}

#if DEBUG
	if (error && error != ENOATTR) {
		printf("cp_getxattr: bad cp xattr (%d):\n", error);
		for (size_t i = 0; i < xattr_len; ++i)
			printf("%02x ", ((uint8_t *)xattr)[i]);
		printf("\n");
	}
#endif

	FREE(xattr, M_TEMP);

	return error;
}

/*
 * If permitted, restore entry's unwrapped key from the persistent key.
 * If not, clear key and set CP_KEY_FLUSHED.
 * cnode lock held exclusive
 */
static int
cp_restore_keys(struct cprotect *entry, struct hfsmount *hfsmp, struct cnode *cp)
{
	int error = 0;

 	error = cp_unwrap(hfsmp, entry, cp);
	if (error) {
		cp_flush_cached_keys(entry);
		error = EPERM;
	}
	return error;
}

static int
cp_lock_vfs_callback(mount_t mp, void *arg) 
{

	/* Use a pointer-width integer field for casting */
	unsigned long new_state;
	struct hfsmount *hfsmp;

	/*
	 * When iterating the various mount points that may
	 * be present on a content-protected device, we need to skip
	 * those that do not have it enabled.
	 */
	if (!cp_fs_protected(mp)) {
		return 0;
	}
	new_state = (unsigned long) arg;
	
	hfsmp = VFSTOHFS(mp);

	hfs_lock_mount(hfsmp);
	/* this loses all of the upper bytes of precision; that's OK */
	hfsmp->hfs_cp_lock_state = (uint8_t) new_state;
	hfs_unlock_mount(hfsmp);

	if (new_state == CP_LOCKED_STATE) { 
		/* 
		 * We respond only to lock events.  Since cprotect structs
		 * decrypt/restore keys lazily, the unlock events don't
		 * actually cause anything to happen.
		 */
		return vnode_iterate(mp, 0, cp_lock_vnode_callback, arg);
	}
	/* Otherwise just return 0. */
	return 0;

}


/*
 * Deny access to protected files if keys have been locked.
 */
static int
cp_check_access(struct cnode *cp, struct hfsmount *hfsmp, int vnop __unused)
{
	int error = 0;

	/* 
	 * For now it's OK to examine the state variable here without
	 * holding the HFS lock.  This is only a short-circuit; if the state
	 * transitions (or is in transition) after we examine this field, we'd
	 * have to handle that anyway. 
	 */
	if (hfsmp->hfs_cp_lock_state == CP_UNLOCKED_STATE) {
		return 0;
	}

	if (!cp->c_cpentry) {
		/* unprotected node */
		return 0;
	}

	if (!S_ISREG(cp->c_mode)) {
		return 0;
	}

	/* Deny all access for class A files */
	switch (CP_CLASS(cp->c_cpentry->cp_pclass)) {
		case PROTECTION_CLASS_A: {
			error = EPERM;
			break;
		}
		default:
			error = 0;
			break;
	}

	return error;
}

/*
 * Respond to a lock or unlock event.
 * On lock: clear out keys from memory, then flush file contents.
 * On unlock: nothing (function not called).
 */
static int
cp_lock_vnode_callback(struct vnode *vp, void *arg)
{
	cnode_t *cp = NULL;
	struct cprotect *entry = NULL;
	int error = 0;
	int locked = 1;
	unsigned long action = 0;
	int took_truncate_lock = 0;

	error = vnode_getwithref (vp);
	if (error) {
		return error;
	}

	cp = VTOC(vp);

	/*
	 * When cleaning cnodes due to a lock event, we must
	 * take the truncate lock AND the cnode lock.  By taking
	 * the truncate lock here, we force (nearly) all pending IOs
	 * to drain before we can acquire the truncate lock.  All HFS cluster
	 * io calls except for swapfile IO need to acquire the truncate lock
	 * prior to calling into the cluster layer.
	 */
	hfs_lock_truncate (cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_DEFAULT);
	took_truncate_lock = 1;

	hfs_lock(cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_ALLOW_NOEXISTS);

	entry = cp->c_cpentry;
	if (!entry) {
		/* unprotected vnode: not a regular file */
		goto out;
	}

	action = (unsigned long) arg;
	switch (action) {
		case CP_LOCKED_STATE: {
			vfs_context_t ctx;
			if (CP_CLASS(entry->cp_pclass) != PROTECTION_CLASS_A ||
				vnode_isdir(vp)) {
				/*
				 * There is no change at lock for other classes than A.
				 * B is kept in memory for writing, and class F (for VM) does
				 * not have a wrapped key, so there is no work needed for
				 * wrapping/unwrapping.
				 *
				 * Note that 'class F' is relevant here because if
				 * hfs_vnop_strategy does not take the cnode lock
				 * to protect the cp blob across IO operations, we rely
				 * implicitly on the truncate lock to be held when doing IO.
				 * The only case where the truncate lock is not held is during
				 * swapfile IO because HFS just funnels the VNOP_PAGEOUT
				 * directly to cluster_pageout.
				 */
				goto out;
			}

			/* Before doing anything else, zero-fill sparse ranges as needed */
			ctx = vfs_context_current();
			(void) hfs_filedone (vp, ctx, 0);

			/* first, sync back dirty pages */
			hfs_unlock (cp);
			ubc_msync (vp, 0, ubc_getsize(vp), NULL, UBC_PUSHALL | UBC_INVALIDATE | UBC_SYNC);
			hfs_lock (cp, HFS_EXCLUSIVE_LOCK, HFS_LOCK_ALLOW_NOEXISTS);

			/* flush keys:
			 * There was a concern here(9206856) about flushing keys before nand layer is done using them.
			 * But since we are using ubc_msync with UBC_SYNC, it blocks until all IO is completed.
			 * Once IOFS caches or is done with these keys, it calls the completion routine in IOSF.
			 * Which in turn calls buf_biodone() and eventually unblocks ubc_msync()
			 * Also verified that the cached data in IOFS is overwritten by other data, and there
			 * is no key leakage in that layer.
			 */

			cp_flush_cached_keys(entry);

			/* some write may have arrived in the mean time. dump those pages */
			hfs_unlock(cp);
			locked = 0;

			ubc_msync (vp, 0, ubc_getsize(vp), NULL, UBC_INVALIDATE | UBC_SYNC);
			break;
		}
		case CP_UNLOCKED_STATE: {
			/* no-op */
			break;
		}
		default:
			panic("Content Protection: unknown lock action %lu\n", action);
	}

out:
	if (locked) {
		hfs_unlock(cp);
	}

	if (took_truncate_lock) {
		hfs_unlock_truncate (cp, HFS_LOCK_DEFAULT);
	}

	vnode_put (vp);
	return error;
}


/* 
 * cp_rewrap:
 *
 * Generate a new wrapped key based on the existing cache key.
 */

int
cp_rewrap(struct cnode *cp, __unused hfsmount_t *hfsmp,
		  cp_key_class_t *newclass, cp_key_pair_t *cpkp, const void *old_holder,
		  cp_new_alloc_fn alloc_fn, void **pholder)
{
	struct cprotect *entry = cp->c_cpentry;

	uint8_t new_persistent_key[CP_MAX_WRAPPEDKEYSIZE];
	size_t keylen = CP_MAX_WRAPPEDKEYSIZE;
	int error = 0;
	const cp_key_class_t key_class = CP_CLASS(*newclass);

	/* Structures passed between HFS and AKS */
	cp_cred_s access_in;
	cp_wrapped_key_s wrapped_key_in;
	cp_wrapped_key_s wrapped_key_out;

	/*
	 * PROTECTION_CLASS_F is in-use by VM swapfile; it represents a transient
	 * key that is only good as long as the file is open.  There is no
	 * wrapped key, so there isn't anything to wrap.
	 */
	if (key_class == PROTECTION_CLASS_F) {
		return EINVAL;
	}

	cp_init_access(&access_in, cp);

	bzero(&wrapped_key_in, sizeof(wrapped_key_in));
	wrapped_key_in.key = cpkp_pers_key(cpkp);
	wrapped_key_in.key_len = cpkp_pers_key_len(cpkp);
	/* Use the persistent class when talking to AKS */
	wrapped_key_in.dp_class = entry->cp_pclass;

	bzero(&wrapped_key_out, sizeof(wrapped_key_out));
	wrapped_key_out.key = new_persistent_key;
	wrapped_key_out.key_len = keylen;

	/*
	 * inode is passed here to find the backup bag wrapped blob
	 * from userspace.  This lookup will occur shortly after creation
	 * and only if the file still exists.  Beyond this lookup the
	 * inode is not used.  Technically there is a race, we practically
	 * don't lose.
	 */
	error = g_cp_wrap_func.rewrapper(&access_in,
			key_class, /* new class */
			&wrapped_key_in,
			&wrapped_key_out);

	keylen = wrapped_key_out.key_len;

	if (error == 0) {
		/*
		 * Verify that AKS returned to us a wrapped key of the 
		 * target class requested.   
		 */
		/* Get the effective class here */
		cp_key_class_t effective = CP_CLASS(wrapped_key_out.dp_class);
		if (effective != key_class) {
			/* 
			 * Fail the operation if defaults or some other enforcement
			 * dictated that the class be wrapped differently. 
			 */

			/* TODO: Invalidate the key when 12170074 unblocked */
			return EPERM;
		}

		/* Allocate a new cpentry */
		cp_key_pair_t *new_cpkp;
		*pholder = alloc_fn(old_holder, keylen, CP_MAX_CACHEBUFLEN, &new_cpkp);

		/* copy the new key into the entry */
		cpkp_set_pers_key_len(new_cpkp, keylen);
		memcpy(cpkp_pers_key(new_cpkp), new_persistent_key, keylen);

		/* Actually record/store what AKS reported back, not the effective class stored in newclass */
		*newclass = wrapped_key_out.dp_class;
	}
	else {
		error = EPERM;
	}

	return error;
}

static int cpkp_unwrap(cnode_t *cp, cp_key_class_t key_class, cp_key_pair_t *cpkp)
{
	int error = 0;
	uint8_t iv_key[CP_IV_KEYSIZE];
	cpx_t cpx = cpkp_cpx(cpkp);

	/* Structures passed between HFS and AKS */
	cp_cred_s access_in;
	cp_wrapped_key_s wrapped_key_in;
	cp_raw_key_s key_out;

	cp_init_access(&access_in, cp);

	bzero(&wrapped_key_in, sizeof(wrapped_key_in));
	wrapped_key_in.key = cpkp_pers_key(cpkp);
	wrapped_key_in.key_len = cpkp_max_pers_key_len(cpkp);
	/* Use the persistent class when talking to AKS */
	wrapped_key_in.dp_class = key_class;

	bzero(&key_out, sizeof(key_out));
	key_out.iv_key = iv_key;
	key_out.key = cpx_key(cpx);
	/*
	 * The unwrapper should validate/set the key length for
	 * the IV key length and the cache key length, however we need
	 * to supply the correct buffer length so that AKS knows how
	 * many bytes it has to work with.
	 */
	key_out.iv_key_len = CP_IV_KEYSIZE;
	key_out.key_len = cpx_max_key_len(cpx);

	error = g_cp_wrap_func.unwrapper(&access_in, &wrapped_key_in, &key_out);
	if (!error) {
		if (key_out.key_len == 0 || key_out.key_len > CP_MAX_CACHEBUFLEN) {
			panic ("cp_unwrap: invalid key length! (%ul)\n", key_out.key_len);
		}

		if (key_out.iv_key_len != CP_IV_KEYSIZE)
			panic ("cp_unwrap: invalid iv key length! (%ul)\n", key_out.iv_key_len);

		cpx_set_key_len(cpx, key_out.key_len);

		cpx_set_aes_iv_key(cpx, iv_key);
		cpx_set_is_sep_wrapped_key(cpx, ISSET(key_out.flags, CP_RAW_KEY_WRAPPEDKEY));
	} else {
		error = EPERM;
	}

	return error;
}

static int
cp_unwrap(__unused struct hfsmount *hfsmp, struct cprotect *entry, struct cnode *cp)
{
	/*
	 * PROTECTION_CLASS_F is in-use by VM swapfile; it represents a transient
	 * key that is only good as long as the file is open.  There is no
	 * wrapped key, so there isn't anything to unwrap.
	 */
	if (CP_CLASS(entry->cp_pclass) == PROTECTION_CLASS_F) {
		return EPERM;
	}

	int error = cpkp_unwrap(cp, entry->cp_pclass, &entry->cp_keys);


	return error;
}

/*
 * cp_generate_keys
 *
 * Take a cnode that has already been initialized and establish persistent and
 * cache keys for it at this time. Note that at the time this is called, the
 * directory entry has already been created and we are holding the cnode lock
 * on 'cp'.
 * 
 */
int cp_generate_keys (struct hfsmount *hfsmp, struct cnode *cp, cp_key_class_t targetclass,
		uint32_t keyflags, struct cprotect **newentry) 
{

	int error = 0;
	struct cprotect *newcp = NULL;
	*newentry = NULL;

	/* Target class must be an effective class only */
	targetclass = CP_CLASS(targetclass);

	/* Validate that it has a cprotect already */
	if (cp->c_cpentry == NULL) {
		/* We can't do anything if it shouldn't be protected. */
		return 0;
	}	

	/* Asserts for the underlying cprotect */
	if (cp->c_cpentry->cp_flags & CP_NO_XATTR) {
		/* should already have an xattr by this point. */
		error = EINVAL;
		goto out;
	}

	if (S_ISREG(cp->c_mode)) {
		if (!cp_needs_pers_key(cp->c_cpentry)) {
			error = EINVAL;
			goto out;
		}
	}

	cp_key_revision_t key_revision = cp_initial_key_revision(hfsmp);

	error = cp_new (&targetclass, hfsmp, cp, cp->c_mode, keyflags, key_revision,
					(cp_new_alloc_fn)cp_entry_alloc, (void **)&newcp);
	if (error) {
		/* 
		 * Key generation failed. This is not necessarily fatal
		 * since the device could have transitioned into the lock 
		 * state before we called this.  
		 */	
		error = EPERM;
		goto out;
	}

	newcp->cp_pclass			= targetclass;
	newcp->cp_key_os_version	= cp_os_version();
	newcp->cp_key_revision		= key_revision;

	/*
	 * If we got here, then we have a new cprotect.
	 * Attempt to write the new one out.
	 */
	error = cp_setxattr (cp, newcp, hfsmp, cp->c_fileid, XATTR_REPLACE);

	if (error) {
		/* Tear down the new cprotect; Tell MKB that it's invalid. Bail out */
		/* TODO: rdar://12170074 needs to be fixed before we can tell MKB */
		if (newcp) {
			cp_entry_destroy(hfsmp, newcp);
		}	
		goto out;
	}

	/* 
	 * If we get here then we can assert that:
	 * 1) generated wrapped/unwrapped keys.
	 * 2) wrote the new keys to disk.
	 * 3) cprotect is ready to go.
	 */

	*newentry = newcp;

out:
	return error;

}

void cp_replace_entry (hfsmount_t *hfsmp, struct cnode *cp, struct cprotect *newentry)
{
	if (cp->c_cpentry) {

		cp_entry_destroy (hfsmp, cp->c_cpentry);
	}
	cp->c_cpentry = newentry;
	newentry->cp_backing_cnode = cp;

	return;
}


/*
 * cp_new
 *
 * Given a double-pointer to a cprotect, generate keys (either in-kernel or from keystore),
 * allocate a cprotect, and vend it back to the caller.
 * 
 * Additionally, decide if keys are even needed -- directories get cprotect data structures
 * but they do not have keys.
 *
 */

int
cp_new(cp_key_class_t *newclass_eff, __unused struct hfsmount *hfsmp, struct cnode *cp,
	   mode_t cmode, int32_t keyflags, cp_key_revision_t key_revision,
	   cp_new_alloc_fn alloc_fn, void **pholder)
{
	int error = 0;
	uint8_t new_key[CP_MAX_CACHEBUFLEN];
	size_t new_key_len = CP_MAX_CACHEBUFLEN;  /* AKS tell us the proper key length, how much of this is used */
	uint8_t new_persistent_key[CP_MAX_WRAPPEDKEYSIZE];
	size_t new_persistent_len = CP_MAX_WRAPPEDKEYSIZE;
	uint8_t iv_key[CP_IV_KEYSIZE];
	size_t iv_key_len = CP_IV_KEYSIZE;
	int iswrapped = 0;
	cp_key_class_t key_class = CP_CLASS(*newclass_eff);

	/* Structures passed between HFS and AKS */
	cp_cred_s access_in;
	cp_wrapped_key_s wrapped_key_out;
	cp_raw_key_s key_out;

	if (are_wraps_initialized == false) {
		printf("hfs: cp_new: wrap/gen functions not yet set\n");
		return ENXIO;
	}

	/* Sanity check that it's a file or directory here */
	if (!(S_ISREG(cmode)) && !(S_ISDIR(cmode))) {
		return EPERM;
	}

	/*
	 * Step 1: Generate Keys if needed.
	 * 
	 * For class F files, the kernel provides the key.
	 * PROTECTION_CLASS_F is in-use by VM swapfile; it represents a transient
	 * key that is only good as long as the file is open.  There is no
	 * wrapped key, so there isn't anything to wrap.
	 *
	 * For class A->D files, the key store provides the key 
	 * 
	 * For Directories, we only give them a class ; no keys.
	 */
	if (S_ISDIR (cmode)) {
		/* Directories */
		new_persistent_len = 0;
		new_key_len = 0;

		error = 0;
	}
	else {
		/* Must be a file */         
		if (key_class == PROTECTION_CLASS_F) {
			/* class F files are not wrapped; they can still use the max key size */
			new_key_len = CP_MAX_KEYSIZE;
			read_random (&new_key[0], new_key_len);
			new_persistent_len = 0;

			error = 0;
		}
		else {
			/* 
			 * The keystore is provided the file ID so that it can associate
			 * the wrapped backup blob with this key from userspace. This 
			 * lookup occurs after successful file creation.  Beyond this, the
			 * file ID is not used.  Note that there is a potential race here if
			 * the file ID is re-used.  
			 */
			cp_init_access(&access_in, cp);
		
			bzero(&key_out, sizeof(key_out));
			key_out.key = new_key;
			key_out.iv_key = iv_key;
			/* 
			 * AKS will override our key length fields, but we need to supply
			 * the length of the buffer in those length fields so that 
			 * AKS knows hoa many bytes it has to work with.
			 */
			key_out.key_len = new_key_len;
			key_out.iv_key_len = iv_key_len;

			bzero(&wrapped_key_out, sizeof(wrapped_key_out));
			wrapped_key_out.key = new_persistent_key;
			wrapped_key_out.key_len = new_persistent_len;

			access_in.key_revision = key_revision;

			error = g_cp_wrap_func.new_key(&access_in,
					key_class,
					&key_out,
					&wrapped_key_out);

			if (error) {
				/* keybag returned failure */
				error = EPERM;
				goto cpnew_fail;
			}

			/* Now sanity-check the output from new_key */
			if (key_out.key_len == 0 || key_out.key_len > CP_MAX_CACHEBUFLEN) {
				panic ("cp_new: invalid key length! (%ul) \n", key_out.key_len);
			}

			if (key_out.iv_key_len != CP_IV_KEYSIZE) {
				panic ("cp_new: invalid iv key length! (%ul) \n", key_out.iv_key_len);
			}	
		
			/* 
			 * AKS is allowed to override our preferences and wrap with a 
			 * different class key for policy reasons. If we were told that 
			 * any class other than the one specified is unacceptable then error out 
			 * if that occurred.  Check that the effective class returned by 
			 * AKS is the same as our effective new class 
			 */
			if (CP_CLASS(wrapped_key_out.dp_class) != key_class) {
				if (!ISSET(keyflags, CP_KEYWRAP_DIFFCLASS)) {
					error = EPERM;
					/* TODO: When 12170074 fixed, release/invalidate the key! */
					goto cpnew_fail;
				}
			}

			*newclass_eff = wrapped_key_out.dp_class;
			new_key_len = key_out.key_len;
			iv_key_len = key_out.iv_key_len;
			new_persistent_len = wrapped_key_out.key_len;

			/* Is the key a SEP wrapped key? */
			if (key_out.flags & CP_RAW_KEY_WRAPPEDKEY) {
				iswrapped = 1;
			}
		}
	}

	/*
	 * Step 2: allocate cprotect and initialize it.
	 */

	cp_key_pair_t *cpkp;
	*pholder = alloc_fn(NULL, new_persistent_len, new_key_len, &cpkp);
	if (*pholder == NULL) {
		return ENOMEM;
	}

	/* Copy the cache key & IV keys into place if needed. */
	if (new_key_len > 0) {
		cpx_t cpx = cpkp_cpx(cpkp);

		cpx_set_key_len(cpx, new_key_len);
		memcpy(cpx_key(cpx), new_key, new_key_len);

		/* Initialize the IV key */
		if (key_class != PROTECTION_CLASS_F)
			cpx_set_aes_iv_key(cpx, iv_key);

		cpx_set_is_sep_wrapped_key(cpx, iswrapped);
	}
	if (new_persistent_len > 0) {
		cpkp_set_pers_key_len(cpkp, new_persistent_len);
		memcpy(cpkp_pers_key(cpkp), new_persistent_key, new_persistent_len);
	}

cpnew_fail:

#if HFS_TMPDBG
#if !SECURE_KERNEL
	if ((hfsmp->hfs_cp_verbose) && (error == EPERM)) {
		/* Only introspect the data fork */
		cp_log_eperm (cp->c_vp, *newclass_eff, true);
	}
#endif
#endif

	return error;
}

/* Initialize the cp_cred_t structure passed to AKS */
static void cp_init_access(cp_cred_t access, struct cnode *cp)
{
	vfs_context_t context = vfs_context_current();
	kauth_cred_t cred = vfs_context_ucred(context);
	proc_t proc = vfs_context_proc(context);

	bzero(access, sizeof(*access));

	/* Note: HFS uses 32-bit fileID, even though inode is a 64-bit value */
	access->inode = cp->c_fileid;
	access->pid = proc_pid(proc);
	access->uid = kauth_cred_getuid(cred);

	if (cp->c_cpentry)
		access->key_revision = cp->c_cpentry->cp_key_revision;

	return;
}

/*
 * Parses versions of the form 12A316, i.e. <major><minor><revision> and
 * returns a uint32_t in the form 0xaabbcccc where aa = <major>, 
 * bb = <ASCII char>, cccc = <revision>.
 */
static cp_key_os_version_t parse_os_version(void)
{
	const char *p = osversion;

	int a = 0;
	while (*p >= '0' && *p <= '9') {
		a = a * 10 + *p - '0';
		++p;
	}

	if (!a)
		return 0;

	int b = *p++;
	if (!b)
		return 0;

	int c = 0;
	while (*p >= '0' && *p <= '9') {
		c = c * 10 + *p - '0';
		++p;
	}

	if (!c)
		return 0;

	return (a & 0xff) << 24 | b << 16 | (c & 0xffff);
}

cp_key_os_version_t cp_os_version(void)
{
	static cp_key_os_version_t cp_os_version;

	if (cp_os_version)
		return cp_os_version;

	if (!osversion[0])
		return 0;

	cp_os_version = parse_os_version();
	if (!cp_os_version) {
		printf("cp_os_version: unable to parse osversion `%s'\n", osversion);
		cp_os_version = 1;
	}

	return cp_os_version;
}


errno_t cp_handle_strategy(buf_t bp)
{
	vnode_t vp = buf_vnode(bp);
	cnode_t *cp = NULL;

	if (bufattr_rawencrypted(buf_attr(bp))
		|| !(cp = cp_get_protected_cnode(vp))
		|| !cp->c_cpentry) {
		// Nothing to do
		return 0;
	}

	/*
	 * For filesystem resize, we may not have access to the underlying
	 * file's cache key for whatever reason (device may be locked).
	 * However, we do not need it since we are going to use the
	 * temporary HFS-wide resize key which is generated once we start
	 * relocating file content.  If this file's I/O should be done
	 * using the resize key, it will have been supplied already, so do
	 * not attach the file's cp blob to the buffer.
	 */
	if (ISSET(cp->c_cpentry->cp_flags, CP_RELOCATION_INFLIGHT))
		return 0;

	{
		// Fast path
		cpx_t cpx = cpkp_cpx(&cp->c_cpentry->cp_keys);

		if (cpx_has_key(cpx)) {
			bufattr_setcpx(buf_attr(bp), cpx);
			return 0;
		}
	}

	/*
	 * We rely mostly (see note below) upon the truncate lock to
	 * protect the CP cache key from getting tossed prior to our IO
	 * finishing here.  Nearly all cluster io calls to manipulate file
	 * payload from HFS take the truncate lock before calling into the
	 * cluster layer to ensure the file size does not change, or that
	 * they have exclusive right to change the EOF of the file.  That
	 * same guarantee protects us here since the code that deals with
	 * CP lock events must now take the truncate lock before doing
	 * anything.
	 *
	 * If you want to change content protection structures, then the
	 * truncate lock is not sufficient; you must take the truncate
	 * lock and then wait for outstanding writes to complete.  This is
	 * necessary because asynchronous I/O only holds the truncate lock
	 * whilst I/O is being queued.
	 *
	 * One exception should be the VM swapfile IO, because HFS will
	 * funnel the VNOP_PAGEOUT directly into a cluster_pageout call
	 * for the swapfile code only without holding the truncate lock.
	 * This is because individual swapfiles are maintained at
	 * fixed-length sizes by the VM code.  In non-swapfile IO we use
	 * PAGEOUT_V2 semantics which allow us to create our own UPL and
	 * thus take the truncate lock before calling into the cluster
	 * layer.  In that case, however, we are not concerned with the CP
	 * blob being wiped out in the middle of the IO because there
	 * isn't anything to toss; the VM swapfile key stays in-core as
	 * long as the file is open.
	 */

	off_rsrc_t off_rsrc = off_rsrc_make(buf_lblkno(bp) * GetLogicalBlockSize(vp),
										VNODE_IS_RSRC(vp));
	cp_io_params_t io_params;


	/*
	 * We want to take the cnode lock here and because the vnode write
	 * count is a pseudo-lock, we need to do something to preserve
	 * lock ordering; the cnode lock comes before the write count.
	 * Ideally, the write count would be incremented after the
	 * strategy routine returns, but that becomes complicated if the
	 * strategy routine where to call buf_iodone before returning.
	 * For now, we drop the write count here and then pick it up again
	 * later.
	 */
	if (!ISSET(buf_flags(bp), B_READ) && !ISSET(buf_flags(bp), B_RAW))
		vnode_writedone(vp);

	hfs_lock_always(cp, HFS_SHARED_LOCK);
	cp_io_params(VTOHFS(vp), cp->c_cpentry, off_rsrc,
				 ISSET(buf_flags(bp), B_READ) ? VNODE_READ : VNODE_WRITE,
				 &io_params);
	hfs_unlock(cp);

	/*
	 * Last chance: If this data protected I/O does not have unwrapped
	 * keys present, then try to get them.  We already know that it
	 * should, by this point.
	 */
	if (!cpx_has_key(io_params.cpx)) {
		int io_op = ( (buf_flags(bp) & B_READ) ? CP_READ_ACCESS : CP_WRITE_ACCESS);
		errno_t error = cp_handle_vnop(vp, io_op, 0);
		if (error) {
			/*
			 * We have to be careful here.  By this point in the I/O
			 * path, VM or the cluster engine has prepared a buf_t
			 * with the proper file offsets and all the rest, so
			 * simply erroring out will result in us leaking this
			 * particular buf_t.  We need to properly decorate the
			 * buf_t just as buf_strategy would so as to make it
			 * appear that the I/O errored out with the particular
			 * error code.
			 */
			if (!ISSET(buf_flags(bp), B_READ) && !ISSET(buf_flags(bp), B_RAW))
				vnode_startwrite(vp);
			buf_seterror (bp, error);
			buf_biodone(bp);
			return error;
		}

		hfs_lock_always(cp, HFS_SHARED_LOCK);
		cp_io_params(VTOHFS(vp), cp->c_cpentry, off_rsrc,
					 ISSET(buf_flags(bp), B_READ) ? VNODE_READ : VNODE_WRITE,
					 &io_params);
		hfs_unlock(cp);
	}

	assert(buf_count(bp) <= io_params.max_len);
	bufattr_setcpx(buf_attr(bp), io_params.cpx);

	if (!ISSET(buf_flags(bp), B_READ) && !ISSET(buf_flags(bp), B_RAW))
		vnode_startwrite(vp);

	return 0;
}

#else // !CONFIG_PROTECT

#include <sys/cdefs.h>
#include <sys/cprotect.h>
#include <sys/errno.h>

int cp_key_store_action(int action __unused)
{
	return ENOTSUP;
}

int cp_register_wraps(cp_wrap_func_t key_store_func __unused)
{
	return ENOTSUP;
}

size_t cpx_size(__unused size_t key_size)
{
	return 0;
}

cpx_t cpx_alloc(__unused size_t key_size)
{
	return NULL;
}

void cpx_free(__unused cpx_t cpx)
{
}

bool cpx_is_sep_wrapped_key(__unused const struct cpx *cpx)
{
	return false;
}

void cpx_set_is_sep_wrapped_key(__unused struct cpx *cpx, __unused bool v)
{
}

bool cpx_use_offset_for_iv(__unused const struct cpx *cpx)
{
	return false;
}

void cpx_set_use_offset_for_iv(__unused struct cpx *cpx, __unused bool v)
{
}

uint16_t cpx_key_len(__unused const struct cpx *cpx)
{
	return 0;
}

void cpx_set_key_len(__unused struct cpx *cpx, __unused uint16_t key_len)
{
}

void *cpx_key(__unused const struct cpx *cpx)
{
	return NULL;
}

aes_encrypt_ctx *cpx_iv_aes_ctx(__unused cpx_t cpx)
{
	return NULL;
}

#endif /* CONFIG_PROTECT */