/* SPDX-License-Identifier: GPL-2.0 */
/*
 * fs-verity: read-only file-based authenticity protection
 *
 * This header declares the interface between the fs/verity/ support layer and
 * filesystems that support fs-verity.
 *
 * Copyright 2019 Google LLC
 */

#ifndef _LINUX_FSVERITY_H
#define _LINUX_FSVERITY_H

#include <linux/fs.h>
#include <uapi/linux/fsverity.h>

/* Verity operations for filesystems */
struct fsverity_operations {

        /**
         * Begin enabling verity on the given file.
         *
         * @filp: a readonly file descriptor for the file
         *
         * The filesystem must do any needed filesystem-specific preparations
         * for enabling verity, e.g. evicting inline data.  It also must return
         * -EBUSY if verity is already being enabled on the given file.
         *
         * i_rwsem is held for write.
         *
         * Return: 0 on success, -errno on failure
         */
        int (*begin_enable_verity)(struct file *filp);

        /**
         * End enabling verity on the given file.
         *
         * @filp: a readonly file descriptor for the file
         * @desc: the verity descriptor to write, or NULL on failure
         * @desc_size: size of verity descriptor, or 0 on failure
         * @merkle_tree_size: total bytes the Merkle tree took up
         *
         * If desc == NULL, then enabling verity failed and the filesystem only
         * must do any necessary cleanups.  Else, it must also store the given
         * verity descriptor to a fs-specific location associated with the inode
         * and do any fs-specific actions needed to mark the inode as a verity
         * inode, e.g. setting a bit in the on-disk inode.  The filesystem is
         * also responsible for setting the S_VERITY flag in the VFS inode.
         *
         * i_rwsem is held for write, but it may have been dropped between
         * ->begin_enable_verity() and ->end_enable_verity().
         *
         * Return: 0 on success, -errno on failure
         */
        int (*end_enable_verity)(struct file *filp, const void *desc,
                                 size_t desc_size, u64 merkle_tree_size);

        /**
         * Get the verity descriptor of the given inode.
         *
         * @inode: an inode with the S_VERITY flag set
         * @buf: buffer in which to place the verity descriptor
         * @bufsize: size of @buf, or 0 to retrieve the size only
         *
         * If bufsize == 0, then the size of the verity descriptor is returned.
         * Otherwise the verity descriptor is written to 'buf' and its actual
         * size is returned; -ERANGE is returned if it's too large.  This may be
         * called by multiple processes concurrently on the same inode.
         *
         * Return: the size on success, -errno on failure
         */
        int (*get_verity_descriptor)(struct inode *inode, void *buf,
                                     size_t bufsize);

        /**
         * Read a Merkle tree page of the given inode.
         *
         * @inode: the inode
         * @index: 0-based index of the page within the Merkle tree
         * @num_ra_pages: The number of Merkle tree pages that should be
         *                prefetched starting at @index if the page at @index
         *                isn't already cached.  Implementations may ignore this
         *                argument; it's only a performance optimization.
         *
         * This can be called at any time on an open verity file, as well as
         * between ->begin_enable_verity() and ->end_enable_verity().  It may be
         * called by multiple processes concurrently, even with the same page.
         *
         * Note that this must retrieve a *page*, not necessarily a *block*.
         *
         * Return: the page on success, ERR_PTR() on failure
         */
        struct page *(*read_merkle_tree_page)(struct inode *inode,
                                              pgoff_t index,
                                              unsigned long num_ra_pages);

        /**
         * Write a Merkle tree block to the given inode.
         *
         * @inode: the inode for which the Merkle tree is being built
         * @buf: block to write
         * @index: 0-based index of the block within the Merkle tree
         * @log_blocksize: log base 2 of the Merkle tree block size
         *
         * This is only called between ->begin_enable_verity() and
         * ->end_enable_verity().
         *
         * Return: 0 on success, -errno on failure
         */
        int (*write_merkle_tree_block)(struct inode *inode, const void *buf,
                                       u64 index, int log_blocksize);
};

#ifdef CONFIG_FS_VERITY

static inline struct fsverity_info *fsverity_get_info(const struct inode *inode)
{
        /*
         * Pairs with the cmpxchg_release() in fsverity_set_info().
         * I.e., another task may publish ->i_verity_info concurrently,
         * executing a RELEASE barrier.  We need to use smp_load_acquire() here
         * to safely ACQUIRE the memory the other task published.
         */
        return smp_load_acquire(&inode->i_verity_info);
}

/* enable.c */

int fsverity_ioctl_enable(struct file *filp, const void __user *arg);

/* measure.c */

int fsverity_ioctl_measure(struct file *filp, void __user *arg);

/* open.c */

int fsverity_file_open(struct inode *inode, struct file *filp);
int fsverity_prepare_setattr(struct dentry *dentry, struct iattr *attr);
void fsverity_cleanup_inode(struct inode *inode);

/* read_metadata.c */

int fsverity_ioctl_read_metadata(struct file *filp, const void __user *uarg);

/* verify.c */

bool fsverity_verify_page(struct page *page);
void fsverity_verify_bio(struct bio *bio);
void fsverity_enqueue_verify_work(struct work_struct *work);

#else /* !CONFIG_FS_VERITY */

static inline struct fsverity_info *fsverity_get_info(const struct inode *inode)
{
        return NULL;
}

/* enable.c */

static inline int fsverity_ioctl_enable(struct file *filp,
                                        const void __user *arg)
{
        return -EOPNOTSUPP;
}

/* measure.c */

static inline int fsverity_ioctl_measure(struct file *filp, void __user *arg)
{
        return -EOPNOTSUPP;
}

/* open.c */

static inline int fsverity_file_open(struct inode *inode, struct file *filp)
{
        return IS_VERITY(inode) ? -EOPNOTSUPP : 0;
}

static inline int fsverity_prepare_setattr(struct dentry *dentry,
                                           struct iattr *attr)
{
        return IS_VERITY(d_inode(dentry)) ? -EOPNOTSUPP : 0;
}

static inline void fsverity_cleanup_inode(struct inode *inode)
{
}

/* read_metadata.c */

static inline int fsverity_ioctl_read_metadata(struct file *filp,
                                               const void __user *uarg)
{
        return -EOPNOTSUPP;
}

/* verify.c */

static inline bool fsverity_verify_page(struct page *page)
{
        WARN_ON(1);
        return false;
}

static inline void fsverity_verify_bio(struct bio *bio)
{
        WARN_ON(1);
}

static inline void fsverity_enqueue_verify_work(struct work_struct *work)
{
        WARN_ON(1);
}

#endif  /* !CONFIG_FS_VERITY */

/**
 * fsverity_active() - do reads from the inode need to go through fs-verity?
 * @inode: inode to check
 *
 * This checks whether ->i_verity_info has been set.
 *
 * Filesystems call this from ->readpages() to check whether the pages need to
 * be verified or not.  Don't use IS_VERITY() for this purpose; it's subject to
 * a race condition where the file is being read concurrently with
 * FS_IOC_ENABLE_VERITY completing.  (S_VERITY is set before ->i_verity_info.)
 *
 * Return: true if reads need to go through fs-verity, otherwise false
 */
static inline bool fsverity_active(const struct inode *inode)
{
        return fsverity_get_info(inode) != NULL;
}

#endif  /* _LINUX_FSVERITY_H */