1 // SPDX-License-Identifier: GPL-2.0-only 2 3 #include <linux/list.h> 4 #include <linux/kernel.h> 5 #include <linux/dm-verity-loadpin.h> 6 7 #include "dm.h" 8 #include "dm-core.h" 9 #include "dm-verity.h" 10 11 #define DM_MSG_PREFIX "verity-loadpin" 12 13 LIST_HEAD(dm_verity_loadpin_trusted_root_digests); 14 15 static bool is_trusted_verity_target(struct dm_target *ti) 16 { 17 int verity_mode; 18 u8 *root_digest; 19 unsigned int digest_size; 20 struct dm_verity_loadpin_trusted_root_digest *trd; 21 bool trusted = false; 22 23 if (!dm_is_verity_target(ti)) 24 return false; 25 26 verity_mode = dm_verity_get_mode(ti); 27 28 if ((verity_mode != DM_VERITY_MODE_EIO) && 29 (verity_mode != DM_VERITY_MODE_RESTART) && 30 (verity_mode != DM_VERITY_MODE_PANIC)) 31 return false; 32 33 if (dm_verity_get_root_digest(ti, &root_digest, &digest_size)) 34 return false; 35 36 list_for_each_entry(trd, &dm_verity_loadpin_trusted_root_digests, node) { 37 if ((trd->len == digest_size) && 38 !memcmp(trd->data, root_digest, digest_size)) { 39 trusted = true; 40 break; 41 } 42 } 43 44 kfree(root_digest); 45 46 return trusted; 47 } 48 49 /* 50 * Determines whether the file system of a superblock is located on 51 * a verity device that is trusted by LoadPin. 52 */ 53 bool dm_verity_loadpin_is_bdev_trusted(struct block_device *bdev) 54 { 55 struct mapped_device *md; 56 struct dm_table *table; 57 struct dm_target *ti; 58 int srcu_idx; 59 bool trusted = false; 60 61 if (list_empty(&dm_verity_loadpin_trusted_root_digests)) 62 return false; 63 64 md = dm_get_md(bdev->bd_dev); 65 if (!md) 66 return false; 67 68 table = dm_get_live_table(md, &srcu_idx); 69 70 if (table->num_targets != 1) 71 goto out; 72 73 ti = dm_table_get_target(table, 0); 74 75 if (is_trusted_verity_target(ti)) 76 trusted = true; 77 78 out: 79 dm_put_live_table(md, srcu_idx); 80 dm_put(md); 81 82 return trusted; 83 } 84