Changeset 51342 in vbox for trunk/src

Timestamp:

May 22, 2014 10:24:53 AM (11 years ago)

Author:

vboxsync

Message:

Main,DrvVD: Interface to pass the keys to the disk encryption module from Main

Location:

trunk/src/VBox

Files:

• Devices/Storage/DevAHCI.cpp (modified) (1 diff)
• Devices/Storage/DevATA.cpp (modified) (1 diff)
• Devices/Storage/DrvSCSI.cpp (modified) (1 diff)
• Devices/Storage/DrvVD.cpp (modified) (13 diffs)
• Main/include/ConsoleImpl.h (modified) (2 diffs)
• Main/src-client/ConsoleImpl.cpp (modified) (3 diffs)
• Main/src-client/GuestImpl.cpp (modified) (1 diff)

trunk/src/VBox/Devices/Storage/DevAHCI.cpp

@@ -5740 +5740 @@
         return true;
     }
+    if (rc == VERR_VD_DEK_MISSING)
+    {
+        /* Error message already set. */
+        ASMAtomicCmpXchgBool(&pAhciPort->fRedo, true, false);
+        return true;
+    }
+
     return false;
 }

trunk/src/VBox/Devices/Storage/DevATA.cpp

@@ -1541 +1541 @@
         return true;
     }
+    if (rc == VERR_VD_DEK_MISSING)
+    {
+        /* Error message already set. */
+        pCtl->fRedoIdle = true;
+        return true;
+    }
+
     return false;
 }

trunk/src/VBox/Devices/Storage/DrvSCSI.cpp

@@ -123 +123 @@
         || rc == VERR_FILE_TOO_BIG
         || rc == VERR_BROKEN_PIPE
-        || rc == VERR_NET_CONNECTION_REFUSED)
+        || rc == VERR_NET_CONNECTION_REFUSED
+        || rc == VERR_VD_DEK_MISSING)
         return true;
 

trunk/src/VBox/Devices/Storage/DrvVD.cpp

@@ -186 +186 @@
     /** The block cache handle if configured. */
     PPDMBLKCACHE             pBlkCache;
+
+    /** Cryptographic support
+     * @{ */
+    /** Used algorithm, NULL means no encryption. */
+    char                    *pszEncryptionAlgorithm;
+    /** Config interface for the encryption filter. */
+    VDINTERFACECONFIG        VDIfCfg;
+    /** Flag whether the DEK was provided. */
+    bool                     fDekProvided;
+    /** Pointer to the key material - temporary. */
+    const uint8_t           *pbKey;
+    /** Size of the key material in bytes. */
+    size_t                   cbKey;
+    /** @} */
 } VBOXDISK, *PVBOXDISK;
 
@@ -621 +635 @@
 }
 
+
+/*******************************************************************************
+*   VD Configuration interface implementation for the encryption support       *
+*******************************************************************************/
+
+static bool drvvdCfgEncAreKeysValid(void *pvUser, const char *pszValid)
+{
+    return true;
+}
+
+static int drvvdCfgEncQuerySize(void *pvUser, const char *pszName, size_t *pcb)
+{
+    PVBOXDISK pThis = (PVBOXDISK)pvUser;
+    int rc = VINF_SUCCESS;
+
+    if (!strcmp(pszName, "Algorithm"))
+        *pcb = strlen(pThis->pszEncryptionAlgorithm) + 1;
+    else if (!strcmp(pszName, "Key"))
+        *pcb = pThis->cbKey;
+    else
+        rc = VERR_NOT_SUPPORTED;
+
+    return rc;
+}
+
+static int drvvdCfgEncQuery(void *pvUser, const char *pszName, char *pszString, size_t cchString)
+{
+    PVBOXDISK pThis = (PVBOXDISK)pvUser;
+    int rc = VINF_SUCCESS;
+
+    if (!strcmp(pszName, "Algorithm"))
+        rc = RTStrCopy(pszString, cchString, pThis->pszEncryptionAlgorithm);
+    else
+        rc = VERR_NOT_SUPPORTED;
+
+    return rc;
+}
+
+static int drvvdCfgEncQueryBytes(void *pvUser, const char *pszName, void *pvData, size_t cbData)
+{
+    PVBOXDISK pThis = (PVBOXDISK)pvUser;
+    int rc = VINF_SUCCESS;
+
+    if (!strcmp(pszName, "Key"))
+        if (pThis->cbKey > cbData)
+            rc = VERR_BUFFER_OVERFLOW;
+        else
+            memcpy(pvData, pThis->pbKey, pThis->cbKey);
+    else
+        rc = VERR_NOT_SUPPORTED;
+
+    return rc;
+    
+}
 
 #ifdef VBOX_WITH_INIP
@@ -1505 +1573 @@
     PVBOXDISK pThis = PDMIMEDIA_2_VBOXDISK(pInterface);
 
+    if (   pThis->pszEncryptionAlgorithm
+        && !pThis->fDekProvided)
+    {
+        rc = PDMDrvHlpVMSetRuntimeError(pThis->pDrvIns, VMSETRTERR_FLAGS_SUSPEND | VMSETRTERR_FLAGS_NO_WAIT, "DrvVD_DEKMISSING",
+                                        N_("VD: The DEK for this disk is missing"));
+        AssertRC(rc);
+        return VERR_VD_DEK_MISSING;
+    }
+
     if (!pThis->fBootAccelActive)
         rc = VDRead(pThis->pDisk, off, pvBuf, cbRead);
@@ -1555 +1632 @@
     Log2(("%s: off=%#llx pvBuf=%p cbWrite=%d\n%.*Rhxd\n", __FUNCTION__,
           off, pvBuf, cbWrite, cbWrite, pvBuf));
+
+    if (   pThis->pszEncryptionAlgorithm
+        && !pThis->fDekProvided)
+    {
+        int rc = PDMDrvHlpVMSetRuntimeError(pThis->pDrvIns, VMSETRTERR_FLAGS_SUSPEND | VMSETRTERR_FLAGS_NO_WAIT, "DrvVD_DEKMISSING",
+                                            N_("VD: The DEK for this disk is missing"));
+        AssertRC(rc);
+        return VERR_VD_DEK_MISSING;
+    }
 
     /* Invalidate any buffer if boot acceleration is enabled. */
@@ -1613 +1699 @@
 }
 
+/** @copydoc PDMIMEDIA::pfnSetKey */
+static DECLCALLBACK(int) drvvdSetKey(PPDMIMEDIA pInterface, const uint8_t *pbKey,
+                                     size_t cbKey)
+{
+    LogFlowFunc(("\n"));
+    PVBOXDISK pThis = PDMIMEDIA_2_VBOXDISK(pInterface);
+    int rc = VINF_SUCCESS;
+
+    if (pThis->pszEncryptionAlgorithm)
+    {
+        PVDINTERFACE pVDIfFilter = NULL;
+
+        pThis->pbKey = pbKey;
+        pThis->cbKey = cbKey;
+
+        rc = VDInterfaceAdd(&pThis->VDIfCfg.Core, "DrvVD_Config", VDINTERFACETYPE_CONFIG,
+                            pThis, sizeof(VDINTERFACECONFIG), &pVDIfFilter);
+        AssertRC(rc);
+
+        /* Load the crypt filter plugin. */
+        rc = VDFilterAdd(pThis->pDisk, "CRYPT", pVDIfFilter);
+        if (RT_SUCCESS(rc))
+            pThis->fDekProvided = true;
+
+        pThis->pbKey = NULL;
+        pThis->cbKey = 0;
+    }
+    else
+        rc = VERR_NOT_SUPPORTED;
+
+    LogFlowFunc(("returns %Rrc\n", rc));
+    return rc;
+}
+
 /** @copydoc PDMIMEDIA::pfnGetSize */
 static DECLCALLBACK(uint64_t) drvvdGetSize(PPDMIMEDIA pInterface)
@@ -1774 +1894 @@
     PVBOXDISK pThis = PDMIMEDIAASYNC_2_VBOXDISK(pInterface);
 
+    if (   pThis->pszEncryptionAlgorithm
+        && !pThis->fDekProvided)
+    {
+        rc = PDMDrvHlpVMSetRuntimeError(pThis->pDrvIns, VMSETRTERR_FLAGS_SUSPEND | VMSETRTERR_FLAGS_NO_WAIT, "DrvVD_DEKMISSING",
+                                        N_("VD: The DEK for this disk is missing"));
+        AssertRC(rc);
+        return VERR_VD_DEK_MISSING;
+    }
+
     pThis->fBootAccelActive = false;
 
@@ -1803 +1932 @@
     PVBOXDISK pThis = PDMIMEDIAASYNC_2_VBOXDISK(pInterface);
 
+    if (   pThis->pszEncryptionAlgorithm
+        && !pThis->fDekProvided)
+    {
+        rc = PDMDrvHlpVMSetRuntimeError(pThis->pDrvIns, VMSETRTERR_FLAGS_SUSPEND | VMSETRTERR_FLAGS_NO_WAIT, "DrvVD_DEKMISSING",
+                                        N_("VD: The DEK for this disk is missing"));
+        AssertRC(rc);
+        return VERR_VD_DEK_MISSING;
+    }
+
     pThis->fBootAccelActive = false;
 
@@ -1886 +2024 @@
     int rc = VINF_SUCCESS;
     PVBOXDISK pThis = PDMINS_2_DATA(pDrvIns, PVBOXDISK);
+
+    Assert (!pThis->pszEncryptionAlgorithm);
 
     switch (enmXferDir)
@@ -2173 +2313 @@
         pThis->pszBwGroup = NULL;
     }
+    if (pThis->pszEncryptionAlgorithm)
+    {
+        MMR3HeapFree(pThis->pszEncryptionAlgorithm);
+        pThis->pszBwGroup = NULL;
+    }
 }
 
@@ -2208 +2353 @@
     pThis->uMergeSource                 = VD_LAST_IMAGE;
     pThis->uMergeTarget                 = VD_LAST_IMAGE;
+    pThis->pszEncryptionAlgorithm       = NULL;
+    pThis->fDekProvided                 = false;
 
     /* IMedia */
@@ -2214 +2361 @@
     pThis->IMedia.pfnFlush              = drvvdFlush;
     pThis->IMedia.pfnMerge              = drvvdMerge;
+    pThis->IMedia.pfnSetKey             = drvvdSetKey;
     pThis->IMedia.pfnGetSize            = drvvdGetSize;
     pThis->IMedia.pfnGetSectorSize      = drvvdGetSectorSize;
@@ -2612 +2760 @@
                             pCfgVDConfig, sizeof(VDINTERFACECONFIG), &pImage->pVDIfsImage);
         AssertRC(rc);
+
+        /* Check VDConfig for encryption config. */
+        if (pCfgVDConfig)
+        {
+            rc = CFGMR3QueryStringAlloc(pCfgVDConfig, "EncryptionAlgorithm", &pThis->pszEncryptionAlgorithm);
+            if (RT_FAILURE(rc) && rc != VERR_CFGM_VALUE_NOT_FOUND)
+            {
+                rc = PDMDRV_SET_ERROR(pDrvIns, rc,
+                                      N_("DrvVD: Configuration error: Querying \"EncryptionAlgorithm\" as string failed"));
+                break;
+            }
+            else
+                rc = VINF_SUCCESS;
+        }
+
+        if (pThis->pszEncryptionAlgorithm)
+        {
+            /* Setup VDConfig interface for disk encryption support. */
+            pThis->VDIfCfg.pfnAreKeysValid = drvvdCfgEncAreKeysValid;
+            pThis->VDIfCfg.pfnQuerySize    = drvvdCfgEncQuerySize;
+            pThis->VDIfCfg.pfnQuery        = drvvdCfgEncQuery;
+            pThis->VDIfCfg.pfnQueryBytes   = drvvdCfgEncQueryBytes;
+        }
 
         /* Unconditionally insert the TCPNET interface, don't bother to check
@@ -2850 +3021 @@
         && !pThis->fShareable
         && !fDiscard
+        && !pThis->pszEncryptionAlgorithm /* Disk encryption disables the block cache for security reasons */
         && RT_SUCCESS(rc))
     {

trunk/src/VBox/Main/include/ConsoleImpl.h

@@ -320 +320 @@
 
     EmulatedUSB *getEmulatedUSB(void) { return mEmulatedUSB; }
+
+    /**
+     * Sets the disk encryption keys.
+     *
+     * @returns COM status code.
+     * @þaram   strCfg    The config for the disks.
+     *
+     * @note: One line in the config string contains all required data for one disk.
+     *        The format for one disk is some sort of comma separated value using
+     *        key=value pairs.
+     *        There are two keys defined at the moment:
+     *            - uuid: The uuid of the base image the key is for (with or without)
+     *                    the curly braces.
+     *            - dek: The data encryption key in base64 encoding
+     */
+    HRESULT setDiskEncryptionKeys(const Utf8Str &strCfg);
 
 private:
@@ -779 +795 @@
     bool isResetTurnedIntoPowerOff(void);
 
+    /** @name Disk encryption support
+     * @{ */
+    HRESULT consoleParseDiskEncryption(const char *psz, const char **ppszEnd);
+    HRESULT configureEncryptionForDisk(const char *pszUuid, const uint8_t *pbKey, size_t cbKey);
+    int consoleParseKeyValue(const char *psz, const char **ppszEnd,
+                             char **ppszKey, char **ppszVal);
+    /** @} */
+
     /** @name Teleporter support
      * @{ */

trunk/src/VBox/Main/src-client/ConsoleImpl.cpp

@@ -92 +92 @@
 #include <iprt/string.h>
 #include <iprt/system.h>
+#include <iprt/base64.h>
 
 #include <VBox/vmm/vmapi.h>
@@ -4442 +4443 @@
 {
     return mDisplay;
+}
+
+/**
+ * Parses one key value pair.
+ *
+ * @returns VBox status code.
+ * @param   psz     Configuration string.
+ * @param   ppszEnd Where to store the pointer to the string following the key value pair.
+ * @param   ppszKey Where to store the key on success.
+ * @param   ppszVal Where to store the value on success.
+ */
+int Console::consoleParseKeyValue(const char *psz, const char **ppszEnd,
+                                  char **ppszKey, char **ppszVal)
+{
+    int rc = VINF_SUCCESS;
+    const char *pszKeyStart = psz;
+    const char *pszValStart = NULL;
+    size_t cchKey = 0;
+    size_t cchVal = 0;
+
+    while (   *psz != '='
+           && *psz)
+        psz++;
+
+    /* End of string at this point is invalid. */
+    if (*psz == '\0')
+        return VERR_INVALID_PARAMETER;
+
+    cchKey = psz - pszKeyStart;
+    psz++; /* Skip = character */
+    pszValStart = psz;
+
+    while (   *psz != ','
+           && *psz != '\n'
+           && *psz != '\r'
+           && *psz)
+        psz++;
+
+    cchVal = psz - pszValStart;
+
+    if (cchKey && cchVal)
+    {
+        *ppszKey = RTStrDupN(pszKeyStart, cchKey);
+        if (*ppszKey)
+        {
+            *ppszVal = RTStrDupN(pszValStart, cchVal);
+            if (!*ppszVal)
+            {
+                RTStrFree(*ppszKey);
+                rc = VERR_NO_MEMORY;
+            }
+        }
+        else
+            rc = VERR_NO_MEMORY;
+    }
+    else
+        rc = VERR_INVALID_PARAMETER;
+
+    if (RT_SUCCESS(rc))
+        *ppszEnd = psz;
+
+    return rc;
+}
+
+/**
+ * Configures the encryption support for the disk identified by the gien UUID with
+ * the given key.
+ *
+ * @returns COM status code.
+ * @param   pszUuid   The UUID of the disk to configure encryption for.
+ * @param   pbKey     The key to use
+ * @param   cbKey     Size of the key in bytes.
+ */
+HRESULT Console::configureEncryptionForDisk(const char *pszUuid, const uint8_t *pbKey, size_t cbKey)
+{
+    HRESULT hrc = S_OK;
+    SafeIfaceArray<IMediumAttachment> sfaAttachments;
+
+    AutoCaller autoCaller(this);
+    AssertComRCReturnRC(autoCaller.rc());
+
+    /* Get the VM - must be done before the read-locking. */
+    SafeVMPtr ptrVM(this);
+    if (!ptrVM.isOk())
+        return ptrVM.rc();
+
+    AutoReadLock alock(this COMMA_LOCKVAL_SRC_POS);
+
+    hrc = mMachine->COMGETTER(MediumAttachments)(ComSafeArrayAsOutParam(sfaAttachments));
+    if (FAILED(hrc))
+        return hrc;
+
+    /* Find the correct attachment. */
+    for (unsigned i = 0; i < sfaAttachments.size(); i++)
+    {
+        const ComPtr<IMediumAttachment> &pAtt = sfaAttachments[i];
+        ComPtr<IMedium> pMedium;
+        ComPtr<IMedium> pBase;
+        Bstr uuid;
+
+        hrc = pAtt->COMGETTER(Medium)(pMedium.asOutParam());
+        if (FAILED(hrc))
+            break;
+
+        /* Skip non hard disk attachments. */
+        if (pMedium.isNull())
+            continue;
+
+        /* Get the UUID of the base medium and compare. */
+        hrc = pMedium->COMGETTER(Base)(pBase.asOutParam());
+        if (FAILED(hrc))
+            break;
+
+        hrc = pBase->COMGETTER(Id)(uuid.asOutParam());
+        if (FAILED(hrc))
+            break;
+
+        if (!RTUuidCompare2Strs(Utf8Str(uuid).c_str(), pszUuid))
+        {
+            /*
+             * Found the matching medium, query storage controller, port and device
+             * to identify the correct driver.
+             */
+            ComPtr<IStorageController> pStorageCtrl;
+            Bstr storageCtrlName;
+            LONG lPort, lDev;
+            ULONG ulStorageCtrlInst;
+
+            hrc = pAtt->COMGETTER(Controller)(storageCtrlName.asOutParam());
+            if (FAILED(hrc))
+                break;
+
+            hrc = pAtt->COMGETTER(Port)(&lPort);
+            if (FAILED(hrc))
+                break;
+
+            hrc = pAtt->COMGETTER(Device)(&lDev);
+            if (FAILED(hrc))
+                break;
+
+            hrc = mMachine->GetStorageControllerByName(storageCtrlName.raw(), pStorageCtrl.asOutParam());
+            if (FAILED(hrc))
+                break;
+
+            hrc = pStorageCtrl->COMGETTER(Instance)(&ulStorageCtrlInst);
+            if (FAILED(hrc))
+                break;
+
+            StorageControllerType_T enmCtrlType;
+            hrc = pStorageCtrl->COMGETTER(ControllerType)(&enmCtrlType);
+            AssertComRC(hrc);
+            const char *pcszDevice = convertControllerTypeToDev(enmCtrlType);
+
+            StorageBus_T enmBus;
+            hrc = pStorageCtrl->COMGETTER(Bus)(&enmBus);
+            AssertComRC(hrc);
+
+            unsigned uLUN;
+            hrc = Console::convertBusPortDeviceToLun(enmBus, lPort, lDev, uLUN);
+            AssertComRCReturnRC(hrc);
+
+            PPDMIBASE pIBase = NULL;
+            PPDMIMEDIA pIMedium = NULL;
+            int rc = PDMR3QueryDriverOnLun(ptrVM.rawUVM(), pcszDevice, ulStorageCtrlInst, uLUN, "VD", &pIBase);
+            if (RT_SUCCESS(rc))
+            {
+                if (pIBase)
+                {
+                    pIMedium = (PPDMIMEDIA)pIBase->pfnQueryInterface(pIBase, PDMIMEDIA_IID);
+                    if (!pIMedium)
+                        return setError(E_FAIL, tr("could not query medium interface of controller"));
+                }
+                else
+                    return setError(E_FAIL, tr("could not query base interface of controller"));
+            }
+
+            rc = pIMedium->pfnSetKey(pIMedium, pbKey, cbKey);
+            if (RT_FAILURE(rc))
+                return setError(E_FAIL, tr("Failed to set the encryption key (%Rrc)"), rc);
+        }
+    }
+
+    return hrc;
+}
+
+/**
+ * Parses the encryption configuration for one disk.
+ *
+ * @returns Pointer to the string following encryption configuration.
+ * @param   psz    Pointer to the configuration for the encryption of one disk.
+ */
+HRESULT Console::consoleParseDiskEncryption(const char *psz, const char **ppszEnd)
+{
+    char *pszUuid = NULL;
+    char *pszKeyEnc = NULL;
+    int rc = VINF_SUCCESS;
+    HRESULT hrc = S_OK;
+
+    while (   *psz
+           && RT_SUCCESS(rc))
+    {
+        char *pszKey = NULL;
+        char *pszVal = NULL;
+        const char *pszEnd = NULL;
+
+        rc = consoleParseKeyValue(psz, &pszEnd, &pszKey, &pszVal);
+        if (RT_SUCCESS(rc))
+        {
+            if (!RTStrCmp(pszKey, "uuid"))
+                pszUuid = pszVal;
+            else if (!RTStrCmp(pszKey, "dek"))
+                pszKeyEnc = pszVal;
+            else
+                rc = VERR_INVALID_PARAMETER;
+
+            RTStrFree(pszKey);
+
+            if (*pszEnd == ',')
+                psz = pszEnd + 1;
+            else
+            {
+                /*
+                 * End of the configuration for the current disk, skip linefeed and
+                 * carriage returns.
+                 */
+                while (   *pszEnd == '\n'
+                       || *pszEnd == '\r')
+                    pszEnd++;
+
+                psz = pszEnd;
+                break; /* Stop parsing */
+            }
+
+        }
+    }
+
+    if (   RT_SUCCESS(rc)
+        && pszUuid
+        && pszKeyEnc)
+    {
+        ssize_t cbKey = 0;
+
+        /* Decode the key. */
+        cbKey = RTBase64DecodedSize(pszKeyEnc, NULL);
+        if (cbKey != -1)
+        {
+            uint8_t *pbKey = (uint8_t *)RTMemLockedAlloc(cbKey);
+            if (pbKey)
+            {
+                rc = RTBase64Decode(pszKeyEnc, pbKey, cbKey, NULL, NULL);
+                if (RT_SUCCESS(rc))
+                    hrc = configureEncryptionForDisk(pszUuid, pbKey, cbKey);
+                else
+                    hrc = setError(E_FAIL,
+                                   tr("Failed to decode the key (%Rrc)"),
+                                   rc);
+
+                RTMemWipeThoroughly(pbKey, cbKey, 10 /* cMinPasses */);
+                RTMemLockedFree(pbKey);
+            }
+            else
+                hrc = setError(E_FAIL,
+                               tr("Failed to allocate secure memory for the key"));
+        }
+        else
+            hrc = setError(E_FAIL,
+                           tr("The base64 encoding of the passed key is incorrect"));
+    }
+    else if (RT_SUCCESS(rc))
+        hrc = setError(E_FAIL,
+                       tr("The encryption configuration is incomplete"));
+
+    if (pszUuid)
+        RTStrFree(pszUuid);
+    if (pszKeyEnc)
+    {
+        RTMemWipeThoroughly(pszKeyEnc, strlen(pszKeyEnc), 10 /* cMinPasses */);
+        RTStrFree(pszKeyEnc);
+    }
+
+    if (ppszEnd)
+        *ppszEnd = psz;
+
+    return hrc;
+}
+
+HRESULT Console::setDiskEncryptionKeys(const Utf8Str &strCfg)
+{
+    HRESULT hrc = S_OK;
+    const char *pszCfg = strCfg.c_str();
+
+    while (   *pszCfg
+           && SUCCEEDED(hrc))
+    {
+        const char *pszNext = NULL;
+        hrc = consoleParseDiskEncryption(pszCfg, &pszNext);
+        pszCfg = pszNext;
+    }
+
+    return hrc;
 }
 
@@ -8654 +8955 @@
     LogRel(("Console: VM runtime error: fatal=%RTbool, errorID=%s message=\"%s\"\n",
             fFatal, pszErrorId, message.c_str()));
+
+    /* Set guest property if the reason of the error is a missing DEK for a disk. */
+    if (!RTStrCmp(pszErrorId, "DrvVD_DEKMISSING"))
+    {
+        that->mMachine->DeleteGuestProperty(Bstr("/VirtualBox/HostInfo/DekMissing").raw());
+        that->mMachine->SetGuestProperty(Bstr("/VirtualBox/HostInfo/DekMissing").raw(),
+                                         Bstr("1").raw(), Bstr("RDONLYGUEST").raw());
+        that->mMachine->SaveSettings();
+    }
+
 
     that->onRuntimeError(BOOL(fFatal), Bstr(pszErrorId).raw(), Bstr(message).raw());

trunk/src/VBox/Main/src-client/GuestImpl.cpp

@@ -815 +815 @@
     if (FAILED(autoCaller.rc())) return autoCaller.rc();
 
-    /* forward the information to the VMM device */
-    VMMDev *pVMMDev = mParent->getVMMDev();
-    if (pVMMDev)
-    {
-        PPDMIVMMDEVPORT pVMMDevPort = pVMMDev->getVMMDevPort();
-        if (pVMMDevPort)
+    /* Check for magic domain names which are used to pass encryption keys to the disk. */
+    if (Utf8Str(aDomain) == "@@disk")
+        return mParent->setDiskEncryptionKeys(Utf8Str(aPassword));
+    else if (Utf8Str(aDomain) == "@@mem")
+    {
+        /** @todo */
+        return E_NOTIMPL;    
+    }
+    else
+    {
+        /* forward the information to the VMM device */
+        VMMDev *pVMMDev = mParent->getVMMDev();
+        if (pVMMDev)
         {
-            uint32_t u32Flags = VMMDEV_SETCREDENTIALS_GUESTLOGON;
-            if (!aAllowInteractiveLogon)
-                u32Flags = VMMDEV_SETCREDENTIALS_NOLOCALLOGON;
-
-            pVMMDevPort->pfnSetCredentials(pVMMDevPort,
-                                           Utf8Str(aUserName).c_str(),
-                                           Utf8Str(aPassword).c_str(),
-                                           Utf8Str(aDomain).c_str(),
-                                           u32Flags);
-            return S_OK;
+            PPDMIVMMDEVPORT pVMMDevPort = pVMMDev->getVMMDevPort();
+            if (pVMMDevPort)
+            {
+                uint32_t u32Flags = VMMDEV_SETCREDENTIALS_GUESTLOGON;
+                if (!aAllowInteractiveLogon)
+                    u32Flags = VMMDEV_SETCREDENTIALS_NOLOCALLOGON;
+    
+                pVMMDevPort->pfnSetCredentials(pVMMDevPort,
+                                               Utf8Str(aUserName).c_str(),
+                                               Utf8Str(aPassword).c_str(),
+                                               Utf8Str(aDomain).c_str(),
+                                               u32Flags);
+                return S_OK;
+            }
         }
     }