1 // SPDX-License-Identifier: GPL-2.0
3 * fs/f2fs/verity.c: fs-verity support for f2fs
5 * Copyright 2019 Google LLC
9 * Implementation of fsverity_operations for f2fs.
11 * Like ext4, f2fs stores the verity metadata (Merkle tree and
12 * fsverity_descriptor) past the end of the file, starting at the first 64K
13 * boundary beyond i_size. This approach works because (a) verity files are
14 * readonly, and (b) pages fully beyond i_size aren't visible to userspace but
15 * can be read/written internally by f2fs with only some relatively small
16 * changes to f2fs. Extended attributes cannot be used because (a) f2fs limits
17 * the total size of an inode's xattr entries to 4096 bytes, which wouldn't be
18 * enough for even a single Merkle tree block, and (b) f2fs encryption doesn't
19 * encrypt xattrs, yet the verity metadata *must* be encrypted when the file is
20 * because it contains hashes of the plaintext data.
22 * Using a 64K boundary rather than a 4K one keeps things ready for
23 * architectures with 64K pages, and it doesn't necessarily waste space on-disk
24 * since there can be a hole between i_size and the start of the Merkle tree.
27 #include <linux/f2fs_fs.h>
32 #define F2FS_VERIFY_VER (1)
34 static inline loff_t
f2fs_verity_metadata_pos(const struct inode
*inode
)
36 return round_up(inode
->i_size
, 65536);
40 * Read some verity metadata from the inode. __vfs_read() can't be used because
41 * we need to read beyond i_size.
43 static int pagecache_read(struct inode
*inode
, void *buf
, size_t count
,
47 size_t n
= min_t(size_t, count
,
48 PAGE_SIZE
- offset_in_page(pos
));
52 page
= read_mapping_page(inode
->i_mapping
, pos
>> PAGE_SHIFT
,
57 addr
= kmap_atomic(page
);
58 memcpy(buf
, addr
+ offset_in_page(pos
), n
);
71 * Write some verity metadata to the inode for FS_IOC_ENABLE_VERITY.
72 * kernel_write() can't be used because the file descriptor is readonly.
74 static int pagecache_write(struct inode
*inode
, const void *buf
, size_t count
,
77 if (pos
+ count
> inode
->i_sb
->s_maxbytes
)
81 size_t n
= min_t(size_t, count
,
82 PAGE_SIZE
- offset_in_page(pos
));
88 res
= pagecache_write_begin(NULL
, inode
->i_mapping
, pos
, n
, 0,
93 addr
= kmap_atomic(page
);
94 memcpy(addr
+ offset_in_page(pos
), buf
, n
);
97 res
= pagecache_write_end(NULL
, inode
->i_mapping
, pos
, n
, n
,
112 * Format of f2fs verity xattr. This points to the location of the verity
113 * descriptor within the file data rather than containing it directly because
114 * the verity descriptor *must* be encrypted when f2fs encryption is used. But,
115 * f2fs encryption does not encrypt xattrs.
117 struct fsverity_descriptor_location
{
123 static int f2fs_begin_enable_verity(struct file
*filp
)
125 struct inode
*inode
= file_inode(filp
);
128 if (f2fs_verity_in_progress(inode
))
131 if (f2fs_is_atomic_file(inode
) || f2fs_is_volatile_file(inode
))
135 * Since the file was opened readonly, we have to initialize the quotas
136 * here and not rely on ->open() doing it. This must be done before
137 * evicting the inline data.
139 err
= dquot_initialize(inode
);
143 err
= f2fs_convert_inline_inode(inode
);
147 set_inode_flag(inode
, FI_VERITY_IN_PROGRESS
);
151 static int f2fs_end_enable_verity(struct file
*filp
, const void *desc
,
152 size_t desc_size
, u64 merkle_tree_size
)
154 struct inode
*inode
= file_inode(filp
);
155 struct f2fs_sb_info
*sbi
= F2FS_I_SB(inode
);
156 u64 desc_pos
= f2fs_verity_metadata_pos(inode
) + merkle_tree_size
;
157 struct fsverity_descriptor_location dloc
= {
158 .version
= cpu_to_le32(F2FS_VERIFY_VER
),
159 .size
= cpu_to_le32(desc_size
),
160 .pos
= cpu_to_le64(desc_pos
),
162 int err
= 0, err2
= 0;
165 * If an error already occurred (which fs/verity/ signals by passing
166 * desc == NULL), then only clean-up is needed.
171 /* Append the verity descriptor. */
172 err
= pagecache_write(inode
, desc
, desc_size
, desc_pos
);
177 * Write all pages (both data and verity metadata). Note that this must
178 * happen before clearing FI_VERITY_IN_PROGRESS; otherwise pages beyond
179 * i_size won't be written properly. For crash consistency, this also
180 * must happen before the verity inode flag gets persisted.
182 err
= filemap_write_and_wait(inode
->i_mapping
);
186 /* Set the verity xattr. */
187 err
= f2fs_setxattr(inode
, F2FS_XATTR_INDEX_VERITY
,
188 F2FS_XATTR_NAME_VERITY
, &dloc
, sizeof(dloc
),
193 /* Finally, set the verity inode flag. */
194 file_set_verity(inode
);
195 f2fs_set_inode_flags(inode
);
196 f2fs_mark_inode_dirty_sync(inode
, true);
198 clear_inode_flag(inode
, FI_VERITY_IN_PROGRESS
);
203 * Verity failed to be enabled, so clean up by truncating any verity
204 * metadata that was written beyond i_size (both from cache and from
205 * disk) and clearing FI_VERITY_IN_PROGRESS.
207 * Taking i_gc_rwsem[WRITE] is needed to stop f2fs garbage collection
208 * from re-instantiating cached pages we are truncating (since unlike
209 * normal file accesses, garbage collection isn't limited by i_size).
211 down_write(&F2FS_I(inode
)->i_gc_rwsem
[WRITE
]);
212 truncate_inode_pages(inode
->i_mapping
, inode
->i_size
);
213 err2
= f2fs_truncate(inode
);
215 f2fs_err(sbi
, "Truncating verity metadata failed (errno=%d)",
217 set_sbi_flag(sbi
, SBI_NEED_FSCK
);
219 up_write(&F2FS_I(inode
)->i_gc_rwsem
[WRITE
]);
220 clear_inode_flag(inode
, FI_VERITY_IN_PROGRESS
);
224 static int f2fs_get_verity_descriptor(struct inode
*inode
, void *buf
,
227 struct fsverity_descriptor_location dloc
;
232 /* Get the descriptor location */
233 res
= f2fs_getxattr(inode
, F2FS_XATTR_INDEX_VERITY
,
234 F2FS_XATTR_NAME_VERITY
, &dloc
, sizeof(dloc
), NULL
);
235 if (res
< 0 && res
!= -ERANGE
)
237 if (res
!= sizeof(dloc
) || dloc
.version
!= cpu_to_le32(F2FS_VERIFY_VER
)) {
238 f2fs_warn(F2FS_I_SB(inode
), "unknown verity xattr format");
241 size
= le32_to_cpu(dloc
.size
);
242 pos
= le64_to_cpu(dloc
.pos
);
244 /* Get the descriptor */
245 if (pos
+ size
< pos
|| pos
+ size
> inode
->i_sb
->s_maxbytes
||
246 pos
< f2fs_verity_metadata_pos(inode
) || size
> INT_MAX
) {
247 f2fs_warn(F2FS_I_SB(inode
), "invalid verity xattr");
248 return -EFSCORRUPTED
;
253 res
= pagecache_read(inode
, buf
, size
, pos
);
260 static struct page
*f2fs_read_merkle_tree_page(struct inode
*inode
,
262 unsigned long num_ra_pages
)
264 DEFINE_READAHEAD(ractl
, NULL
, NULL
, inode
->i_mapping
, index
);
267 index
+= f2fs_verity_metadata_pos(inode
) >> PAGE_SHIFT
;
269 page
= find_get_page_flags(inode
->i_mapping
, index
, FGP_ACCESSED
);
270 if (!page
|| !PageUptodate(page
)) {
273 else if (num_ra_pages
> 1)
274 page_cache_ra_unbounded(&ractl
, num_ra_pages
, 0);
275 page
= read_mapping_page(inode
->i_mapping
, index
, NULL
);
280 static int f2fs_write_merkle_tree_block(struct inode
*inode
, const void *buf
,
281 u64 index
, int log_blocksize
)
283 loff_t pos
= f2fs_verity_metadata_pos(inode
) + (index
<< log_blocksize
);
285 return pagecache_write(inode
, buf
, 1 << log_blocksize
, pos
);
288 const struct fsverity_operations f2fs_verityops
= {
289 .begin_enable_verity
= f2fs_begin_enable_verity
,
290 .end_enable_verity
= f2fs_end_enable_verity
,
291 .get_verity_descriptor
= f2fs_get_verity_descriptor
,
292 .read_merkle_tree_page
= f2fs_read_merkle_tree_page
,
293 .write_merkle_tree_block
= f2fs_write_merkle_tree_block
,