diff options
| author | Eric Biggers <ebiggers@google.com> | 2022-12-23 12:36:33 -0800 |
|---|---|---|
| committer | Eric Biggers <ebiggers@google.com> | 2023-01-09 19:06:03 -0800 |
| commit | 5306892a50bf4cd4cc945bad286c7c950078d65e (patch) | |
| tree | adb884e35d725db5e226a46ea51997e6220b5fa3 /fs/verity/fsverity_private.h | |
| parent | f45555bf23cfc6bf0f0239de321221b1b81817ab (diff) | |
| download | linux-5306892a50bf4cd4cc945bad286c7c950078d65e.tar.gz linux-5306892a50bf4cd4cc945bad286c7c950078d65e.tar.bz2 linux-5306892a50bf4cd4cc945bad286c7c950078d65e.zip | |
fsverity: support verification with tree block size < PAGE_SIZE
Add support for verifying data from verity files whose Merkle tree block
size is less than the page size. The main use case for this is to allow
a single Merkle tree block size to be used across all systems, so that
only one set of fsverity file digests and signatures is needed.
To do this, eliminate various assumptions that the Merkle tree block
size and the page size are the same:
- Make fsverity_verify_page() a wrapper around a new function
fsverity_verify_blocks() which verifies one or more blocks in a page.
- When a Merkle tree block is needed, get the corresponding page and
only verify and use the needed portion. (The Merkle tree continues to
be read and cached in page-sized chunks; that doesn't need to change.)
- When the Merkle tree block size and page size differ, use a bitmap
fsverity_info::hash_block_verified to keep track of which Merkle tree
blocks have been verified, as PageChecked cannot be used directly.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Andrey Albershteyn <aalbersh@redhat.com>
Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://lore.kernel.org/r/20221223203638.41293-7-ebiggers@kernel.org
Diffstat (limited to 'fs/verity/fsverity_private.h')
| -rw-r--r-- | fs/verity/fsverity_private.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h index 23ded939d649..d34dcc033d72 100644 --- a/fs/verity/fsverity_private.h +++ b/fs/verity/fsverity_private.h @@ -42,9 +42,11 @@ struct merkle_tree_params { unsigned int digest_size; /* same as hash_alg->digest_size */ unsigned int block_size; /* size of data and tree blocks */ unsigned int hashes_per_block; /* number of hashes per tree block */ + unsigned int blocks_per_page; /* PAGE_SIZE / block_size */ u8 log_digestsize; /* log2(digest_size) */ u8 log_blocksize; /* log2(block_size) */ u8 log_arity; /* log2(hashes_per_block) */ + u8 log_blocks_per_page; /* log2(blocks_per_page) */ unsigned int num_levels; /* number of levels in Merkle tree */ u64 tree_size; /* Merkle tree size in bytes */ unsigned long tree_pages; /* Merkle tree size in pages */ @@ -70,9 +72,10 @@ struct fsverity_info { u8 root_hash[FS_VERITY_MAX_DIGEST_SIZE]; u8 file_digest[FS_VERITY_MAX_DIGEST_SIZE]; const struct inode *inode; + unsigned long *hash_block_verified; + spinlock_t hash_page_init_lock; }; - #define FS_VERITY_MAX_SIGNATURE_SIZE (FS_VERITY_MAX_DESCRIPTOR_SIZE - \ sizeof(struct fsverity_descriptor)) |