2019-07-22 16:26:22 +00:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
|
|
* fs-verity: read-only file-based authenticity protection
|
|
|
|
*
|
|
|
|
* This header declares the interface between the fs/verity/ support layer and
|
|
|
|
* filesystems that support fs-verity.
|
|
|
|
*
|
|
|
|
* Copyright 2019 Google LLC
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef _LINUX_FSVERITY_H
|
|
|
|
#define _LINUX_FSVERITY_H
|
|
|
|
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <uapi/linux/fsverity.h>
|
|
|
|
|
|
|
|
/* Verity operations for filesystems */
|
|
|
|
struct fsverity_operations {
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/**
|
|
|
|
* Begin enabling verity on the given file.
|
|
|
|
*
|
|
|
|
* @filp: a readonly file descriptor for the file
|
|
|
|
*
|
|
|
|
* The filesystem must do any needed filesystem-specific preparations
|
|
|
|
* for enabling verity, e.g. evicting inline data. It also must return
|
|
|
|
* -EBUSY if verity is already being enabled on the given file.
|
|
|
|
*
|
|
|
|
* i_rwsem is held for write.
|
|
|
|
*
|
|
|
|
* Return: 0 on success, -errno on failure
|
|
|
|
*/
|
|
|
|
int (*begin_enable_verity)(struct file *filp);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* End enabling verity on the given file.
|
|
|
|
*
|
|
|
|
* @filp: a readonly file descriptor for the file
|
|
|
|
* @desc: the verity descriptor to write, or NULL on failure
|
|
|
|
* @desc_size: size of verity descriptor, or 0 on failure
|
|
|
|
* @merkle_tree_size: total bytes the Merkle tree took up
|
|
|
|
*
|
|
|
|
* If desc == NULL, then enabling verity failed and the filesystem only
|
|
|
|
* must do any necessary cleanups. Else, it must also store the given
|
|
|
|
* verity descriptor to a fs-specific location associated with the inode
|
|
|
|
* and do any fs-specific actions needed to mark the inode as a verity
|
|
|
|
* inode, e.g. setting a bit in the on-disk inode. The filesystem is
|
|
|
|
* also responsible for setting the S_VERITY flag in the VFS inode.
|
|
|
|
*
|
|
|
|
* i_rwsem is held for write, but it may have been dropped between
|
|
|
|
* ->begin_enable_verity() and ->end_enable_verity().
|
|
|
|
*
|
|
|
|
* Return: 0 on success, -errno on failure
|
|
|
|
*/
|
|
|
|
int (*end_enable_verity)(struct file *filp, const void *desc,
|
|
|
|
size_t desc_size, u64 merkle_tree_size);
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/**
|
|
|
|
* Get the verity descriptor of the given inode.
|
|
|
|
*
|
|
|
|
* @inode: an inode with the S_VERITY flag set
|
|
|
|
* @buf: buffer in which to place the verity descriptor
|
|
|
|
* @bufsize: size of @buf, or 0 to retrieve the size only
|
|
|
|
*
|
|
|
|
* If bufsize == 0, then the size of the verity descriptor is returned.
|
|
|
|
* Otherwise the verity descriptor is written to 'buf' and its actual
|
|
|
|
* size is returned; -ERANGE is returned if it's too large. This may be
|
|
|
|
* called by multiple processes concurrently on the same inode.
|
|
|
|
*
|
|
|
|
* Return: the size on success, -errno on failure
|
|
|
|
*/
|
|
|
|
int (*get_verity_descriptor)(struct inode *inode, void *buf,
|
|
|
|
size_t bufsize);
|
2019-07-22 16:26:22 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Read a Merkle tree page of the given inode.
|
|
|
|
*
|
|
|
|
* @inode: the inode
|
|
|
|
* @index: 0-based index of the page within the Merkle tree
|
fs-verity: implement readahead of Merkle tree pages
When fs-verity verifies data pages, currently it reads each Merkle tree
page synchronously using read_mapping_page().
Therefore, when the Merkle tree pages aren't already cached, fs-verity
causes an extra 4 KiB I/O request for every 512 KiB of data (assuming
that the Merkle tree uses SHA-256 and 4 KiB blocks). This results in
more I/O requests and performance loss than is strictly necessary.
Therefore, implement readahead of the Merkle tree pages.
For simplicity, we take advantage of the fact that the kernel already
does readahead of the file's *data*, just like it does for any other
file. Due to this, we don't really need a separate readahead state
(struct file_ra_state) just for the Merkle tree, but rather we just need
to piggy-back on the existing data readahead requests.
We also only really need to bother with the first level of the Merkle
tree, since the usual fan-out factor is 128, so normally over 99% of
Merkle tree I/O requests are for the first level.
Therefore, make fsverity_verify_bio() enable readahead of the first
Merkle tree level, for up to 1/4 the number of pages in the bio, when it
sees that the REQ_RAHEAD flag is set on the bio. The readahead size is
then passed down to ->read_merkle_tree_page() for the filesystem to
(optionally) implement if it sees that the requested page is uncached.
While we're at it, also make build_merkle_tree_level() set the Merkle
tree readahead size, since it's easy to do there.
However, for now don't set the readahead size in fsverity_verify_page(),
since currently it's only used to verify holes on ext4 and f2fs, and it
would need parameters added to know how much to read ahead.
This patch significantly improves fs-verity sequential read performance.
Some quick benchmarks with 'cat'-ing a 250MB file after dropping caches:
On an ARM64 phone (using sha256-ce):
Before: 217 MB/s
After: 263 MB/s
(compare to sha256sum of non-verity file: 357 MB/s)
In an x86_64 VM (using sha256-avx2):
Before: 173 MB/s
After: 215 MB/s
(compare to sha256sum of non-verity file: 223 MB/s)
Link: https://lore.kernel.org/r/20200106205533.137005-1-ebiggers@kernel.org
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-06 20:55:33 +00:00
|
|
|
* @num_ra_pages: The number of Merkle tree pages that should be
|
|
|
|
* prefetched starting at @index if the page at @index
|
|
|
|
* isn't already cached. Implementations may ignore this
|
|
|
|
* argument; it's only a performance optimization.
|
2019-07-22 16:26:22 +00:00
|
|
|
*
|
|
|
|
* This can be called at any time on an open verity file, as well as
|
|
|
|
* between ->begin_enable_verity() and ->end_enable_verity(). It may be
|
|
|
|
* called by multiple processes concurrently, even with the same page.
|
|
|
|
*
|
|
|
|
* Note that this must retrieve a *page*, not necessarily a *block*.
|
|
|
|
*
|
|
|
|
* Return: the page on success, ERR_PTR() on failure
|
|
|
|
*/
|
|
|
|
struct page *(*read_merkle_tree_page)(struct inode *inode,
|
fs-verity: implement readahead of Merkle tree pages
When fs-verity verifies data pages, currently it reads each Merkle tree
page synchronously using read_mapping_page().
Therefore, when the Merkle tree pages aren't already cached, fs-verity
causes an extra 4 KiB I/O request for every 512 KiB of data (assuming
that the Merkle tree uses SHA-256 and 4 KiB blocks). This results in
more I/O requests and performance loss than is strictly necessary.
Therefore, implement readahead of the Merkle tree pages.
For simplicity, we take advantage of the fact that the kernel already
does readahead of the file's *data*, just like it does for any other
file. Due to this, we don't really need a separate readahead state
(struct file_ra_state) just for the Merkle tree, but rather we just need
to piggy-back on the existing data readahead requests.
We also only really need to bother with the first level of the Merkle
tree, since the usual fan-out factor is 128, so normally over 99% of
Merkle tree I/O requests are for the first level.
Therefore, make fsverity_verify_bio() enable readahead of the first
Merkle tree level, for up to 1/4 the number of pages in the bio, when it
sees that the REQ_RAHEAD flag is set on the bio. The readahead size is
then passed down to ->read_merkle_tree_page() for the filesystem to
(optionally) implement if it sees that the requested page is uncached.
While we're at it, also make build_merkle_tree_level() set the Merkle
tree readahead size, since it's easy to do there.
However, for now don't set the readahead size in fsverity_verify_page(),
since currently it's only used to verify holes on ext4 and f2fs, and it
would need parameters added to know how much to read ahead.
This patch significantly improves fs-verity sequential read performance.
Some quick benchmarks with 'cat'-ing a 250MB file after dropping caches:
On an ARM64 phone (using sha256-ce):
Before: 217 MB/s
After: 263 MB/s
(compare to sha256sum of non-verity file: 357 MB/s)
In an x86_64 VM (using sha256-avx2):
Before: 173 MB/s
After: 215 MB/s
(compare to sha256sum of non-verity file: 223 MB/s)
Link: https://lore.kernel.org/r/20200106205533.137005-1-ebiggers@kernel.org
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-06 20:55:33 +00:00
|
|
|
pgoff_t index,
|
|
|
|
unsigned long num_ra_pages);
|
2019-07-22 16:26:22 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Write a Merkle tree block to the given inode.
|
|
|
|
*
|
|
|
|
* @inode: the inode for which the Merkle tree is being built
|
|
|
|
* @buf: block to write
|
|
|
|
* @index: 0-based index of the block within the Merkle tree
|
|
|
|
* @log_blocksize: log base 2 of the Merkle tree block size
|
|
|
|
*
|
|
|
|
* This is only called between ->begin_enable_verity() and
|
|
|
|
* ->end_enable_verity().
|
|
|
|
*
|
|
|
|
* Return: 0 on success, -errno on failure
|
|
|
|
*/
|
|
|
|
int (*write_merkle_tree_block)(struct inode *inode, const void *buf,
|
|
|
|
u64 index, int log_blocksize);
|
2019-07-22 16:26:22 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
#ifdef CONFIG_FS_VERITY
|
|
|
|
|
|
|
|
static inline struct fsverity_info *fsverity_get_info(const struct inode *inode)
|
|
|
|
{
|
2020-07-21 22:59:20 +00:00
|
|
|
/*
|
|
|
|
* Pairs with the cmpxchg_release() in fsverity_set_info().
|
|
|
|
* I.e., another task may publish ->i_verity_info concurrently,
|
|
|
|
* executing a RELEASE barrier. We need to use smp_load_acquire() here
|
|
|
|
* to safely ACQUIRE the memory the other task published.
|
|
|
|
*/
|
|
|
|
return smp_load_acquire(&inode->i_verity_info);
|
2019-07-22 16:26:22 +00:00
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* enable.c */
|
|
|
|
|
2020-05-11 19:21:18 +00:00
|
|
|
int fsverity_ioctl_enable(struct file *filp, const void __user *arg);
|
2019-07-22 16:26:22 +00:00
|
|
|
|
2019-07-22 16:26:23 +00:00
|
|
|
/* measure.c */
|
|
|
|
|
2020-05-11 19:21:18 +00:00
|
|
|
int fsverity_ioctl_measure(struct file *filp, void __user *arg);
|
2019-07-22 16:26:23 +00:00
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* open.c */
|
|
|
|
|
2020-05-11 19:21:18 +00:00
|
|
|
int fsverity_file_open(struct inode *inode, struct file *filp);
|
|
|
|
int fsverity_prepare_setattr(struct dentry *dentry, struct iattr *attr);
|
|
|
|
void fsverity_cleanup_inode(struct inode *inode);
|
2019-07-22 16:26:22 +00:00
|
|
|
|
fs-verity: add FS_IOC_READ_VERITY_METADATA ioctl
Add an ioctl FS_IOC_READ_VERITY_METADATA which will allow reading verity
metadata from a file that has fs-verity enabled, including:
- The Merkle tree
- The fsverity_descriptor (not including the signature if present)
- The built-in signature, if present
This ioctl has similar semantics to pread(). It is passed the type of
metadata to read (one of the above three), and a buffer, offset, and
size. It returns the number of bytes read or an error.
Separate patches will add support for each of the above metadata types.
This patch just adds the ioctl itself.
This ioctl doesn't make any assumption about where the metadata is
stored on-disk. It does assume the metadata is in a stable format, but
that's basically already the case:
- The Merkle tree and fsverity_descriptor are defined by how fs-verity
file digests are computed; see the "File digest computation" section
of Documentation/filesystems/fsverity.rst. Technically, the way in
which the levels of the tree are ordered relative to each other wasn't
previously specified, but it's logical to put the root level first.
- The built-in signature is the value passed to FS_IOC_ENABLE_VERITY.
This ioctl is useful because it allows writing a server program that
takes a verity file and serves it to a client program, such that the
client can do its own fs-verity compatible verification of the file.
This only makes sense if the client doesn't trust the server and if the
server needs to provide the storage for the client.
More concretely, there is interest in using this ability in Android to
export APK files (which are protected by fs-verity) to "protected VMs".
This would use Protected KVM (https://lwn.net/Articles/836693), which
provides an isolated execution environment without having to trust the
traditional "host". A "guest" VM can boot from a signed image and
perform specific tasks in a minimum trusted environment using files that
have fs-verity enabled on the host, without trusting the host or
requiring that the guest has its own trusted storage.
Technically, it would be possible to duplicate the metadata and store it
in separate files for serving. However, that would be less efficient
and would require extra care in userspace to maintain file consistency.
In addition to the above, the ability to read the built-in signatures is
useful because it allows a system that is using the in-kernel signature
verification to migrate to userspace signature verification.
Link: https://lore.kernel.org/r/20210115181819.34732-4-ebiggers@kernel.org
Reviewed-by: Victor Hsieh <victorhsieh@google.com>
Acked-by: Jaegeuk Kim <jaegeuk@kernel.org>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2021-01-15 18:18:16 +00:00
|
|
|
/* read_metadata.c */
|
|
|
|
|
|
|
|
int fsverity_ioctl_read_metadata(struct file *filp, const void __user *uarg);
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* verify.c */
|
|
|
|
|
2020-05-11 19:21:18 +00:00
|
|
|
bool fsverity_verify_page(struct page *page);
|
|
|
|
void fsverity_verify_bio(struct bio *bio);
|
|
|
|
void fsverity_enqueue_verify_work(struct work_struct *work);
|
2019-07-22 16:26:22 +00:00
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
#else /* !CONFIG_FS_VERITY */
|
|
|
|
|
|
|
|
static inline struct fsverity_info *fsverity_get_info(const struct inode *inode)
|
|
|
|
{
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* enable.c */
|
|
|
|
|
|
|
|
static inline int fsverity_ioctl_enable(struct file *filp,
|
|
|
|
const void __user *arg)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:23 +00:00
|
|
|
/* measure.c */
|
|
|
|
|
|
|
|
static inline int fsverity_ioctl_measure(struct file *filp, void __user *arg)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* open.c */
|
|
|
|
|
|
|
|
static inline int fsverity_file_open(struct inode *inode, struct file *filp)
|
|
|
|
{
|
|
|
|
return IS_VERITY(inode) ? -EOPNOTSUPP : 0;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
static inline int fsverity_prepare_setattr(struct dentry *dentry,
|
|
|
|
struct iattr *attr)
|
|
|
|
{
|
|
|
|
return IS_VERITY(d_inode(dentry)) ? -EOPNOTSUPP : 0;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
static inline void fsverity_cleanup_inode(struct inode *inode)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
fs-verity: add FS_IOC_READ_VERITY_METADATA ioctl
Add an ioctl FS_IOC_READ_VERITY_METADATA which will allow reading verity
metadata from a file that has fs-verity enabled, including:
- The Merkle tree
- The fsverity_descriptor (not including the signature if present)
- The built-in signature, if present
This ioctl has similar semantics to pread(). It is passed the type of
metadata to read (one of the above three), and a buffer, offset, and
size. It returns the number of bytes read or an error.
Separate patches will add support for each of the above metadata types.
This patch just adds the ioctl itself.
This ioctl doesn't make any assumption about where the metadata is
stored on-disk. It does assume the metadata is in a stable format, but
that's basically already the case:
- The Merkle tree and fsverity_descriptor are defined by how fs-verity
file digests are computed; see the "File digest computation" section
of Documentation/filesystems/fsverity.rst. Technically, the way in
which the levels of the tree are ordered relative to each other wasn't
previously specified, but it's logical to put the root level first.
- The built-in signature is the value passed to FS_IOC_ENABLE_VERITY.
This ioctl is useful because it allows writing a server program that
takes a verity file and serves it to a client program, such that the
client can do its own fs-verity compatible verification of the file.
This only makes sense if the client doesn't trust the server and if the
server needs to provide the storage for the client.
More concretely, there is interest in using this ability in Android to
export APK files (which are protected by fs-verity) to "protected VMs".
This would use Protected KVM (https://lwn.net/Articles/836693), which
provides an isolated execution environment without having to trust the
traditional "host". A "guest" VM can boot from a signed image and
perform specific tasks in a minimum trusted environment using files that
have fs-verity enabled on the host, without trusting the host or
requiring that the guest has its own trusted storage.
Technically, it would be possible to duplicate the metadata and store it
in separate files for serving. However, that would be less efficient
and would require extra care in userspace to maintain file consistency.
In addition to the above, the ability to read the built-in signatures is
useful because it allows a system that is using the in-kernel signature
verification to migrate to userspace signature verification.
Link: https://lore.kernel.org/r/20210115181819.34732-4-ebiggers@kernel.org
Reviewed-by: Victor Hsieh <victorhsieh@google.com>
Acked-by: Jaegeuk Kim <jaegeuk@kernel.org>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2021-01-15 18:18:16 +00:00
|
|
|
/* read_metadata.c */
|
|
|
|
|
|
|
|
static inline int fsverity_ioctl_read_metadata(struct file *filp,
|
|
|
|
const void __user *uarg)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/* verify.c */
|
|
|
|
|
|
|
|
static inline bool fsverity_verify_page(struct page *page)
|
|
|
|
{
|
|
|
|
WARN_ON(1);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void fsverity_verify_bio(struct bio *bio)
|
|
|
|
{
|
|
|
|
WARN_ON(1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void fsverity_enqueue_verify_work(struct work_struct *work)
|
|
|
|
{
|
|
|
|
WARN_ON(1);
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
#endif /* !CONFIG_FS_VERITY */
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
/**
|
|
|
|
* fsverity_active() - do reads from the inode need to go through fs-verity?
|
2020-05-11 19:21:17 +00:00
|
|
|
* @inode: inode to check
|
2019-07-22 16:26:22 +00:00
|
|
|
*
|
|
|
|
* This checks whether ->i_verity_info has been set.
|
|
|
|
*
|
|
|
|
* Filesystems call this from ->readpages() to check whether the pages need to
|
|
|
|
* be verified or not. Don't use IS_VERITY() for this purpose; it's subject to
|
|
|
|
* a race condition where the file is being read concurrently with
|
|
|
|
* FS_IOC_ENABLE_VERITY completing. (S_VERITY is set before ->i_verity_info.)
|
2020-05-11 19:21:17 +00:00
|
|
|
*
|
|
|
|
* Return: true if reads need to go through fs-verity, otherwise false
|
2019-07-22 16:26:22 +00:00
|
|
|
*/
|
|
|
|
static inline bool fsverity_active(const struct inode *inode)
|
|
|
|
{
|
|
|
|
return fsverity_get_info(inode) != NULL;
|
|
|
|
}
|
|
|
|
|
2019-07-22 16:26:22 +00:00
|
|
|
#endif /* _LINUX_FSVERITY_H */
|