fsverity: support verification with tree block size < PAGE_SIZE
authorEric Biggers <ebiggers@google.com>
Fri, 23 Dec 2022 20:36:33 +0000 (12:36 -0800)
committerEric Biggers <ebiggers@google.com>
Tue, 10 Jan 2023 03:06:03 +0000 (19:06 -0800)
commit5306892a50bf4cd4cc945bad286c7c950078d65e
treeadb884e35d725db5e226a46ea51997e6220b5fa3
parentf45555bf23cfc6bf0f0239de321221b1b81817ab
fsverity: support verification with tree block size < PAGE_SIZE

Add support for verifying data from verity files whose Merkle tree block
size is less than the page size.  The main use case for this is to allow
a single Merkle tree block size to be used across all systems, so that
only one set of fsverity file digests and signatures is needed.

To do this, eliminate various assumptions that the Merkle tree block
size and the page size are the same:

- Make fsverity_verify_page() a wrapper around a new function
  fsverity_verify_blocks() which verifies one or more blocks in a page.

- When a Merkle tree block is needed, get the corresponding page and
  only verify and use the needed portion.  (The Merkle tree continues to
  be read and cached in page-sized chunks; that doesn't need to change.)

- When the Merkle tree block size and page size differ, use a bitmap
  fsverity_info::hash_block_verified to keep track of which Merkle tree
  blocks have been verified, as PageChecked cannot be used directly.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Andrey Albershteyn <aalbersh@redhat.com>
Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://lore.kernel.org/r/20221223203638.41293-7-ebiggers@kernel.org
Documentation/filesystems/fsverity.rst
fs/verity/fsverity_private.h
fs/verity/open.c
fs/verity/verify.c
include/linux/fsverity.h