/src/cryptsetup/lib/verity/verity_hash.c

Source
// SPDX-License-Identifier: LGPL-2.1-or-later
/*
 * dm-verity volume handling
 *
 * Copyright (C) 2012-2025 Red Hat, Inc. All rights reserved.
 */

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>

#include "verity.h"
#include "internal.h"

#define VERITY_MAX_LEVELS 63
#define VERITY_MAX_DIGEST_SIZE  1024

static unsigned get_bits_up(size_t u)
{
  unsigned i = 0;
  while ((1U << i) < u)
    i++;
  return i;
}

static unsigned get_bits_down(size_t u)
{
  unsigned i = 0;
  while ((u >> i) > 1U)
    i++;
  return i;
}

static int verify_zero(struct crypt_device *cd, FILE *wr, size_t bytes)
{
  char *block = NULL;
  size_t i;
  int r;

  block = malloc(bytes);
  if (!block)
    return -ENOMEM;

  if (fread(block, bytes, 1, wr) != 1) {
    log_dbg(cd, "EIO while reading spare area.");
    r = -EIO;
    goto out;
  }
  for (i = 0; i < bytes; i++)
    if (block[i]) {
      log_err(cd, _("Spare area is not zeroed at position %" PRIu64 "."),
        ftello(wr) - bytes);
      r = -EPERM;
      goto out;
    }
  r = 0;
out:
  free(block);
  return r;
}

static int verify_hash_block(const char *hash_name, int version,
            char *hash, size_t hash_size,
            const char *data, size_t data_size,
            const char *salt, size_t salt_size)
{
  struct crypt_hash *ctx = NULL;
  int r;

  if (crypt_hash_init(&ctx, hash_name))
    return -EINVAL;

  if (version == 1 && (r = crypt_hash_write(ctx, salt, salt_size)))
    goto out;

  if ((r = crypt_hash_write(ctx, data, data_size)))
    goto out;

  if (version == 0 && (r = crypt_hash_write(ctx, salt, salt_size)))
    goto out;

  r = crypt_hash_final(ctx, hash, hash_size);
out:
  crypt_hash_destroy(ctx);
  return r;
}

static int hash_levels(size_t hash_block_size, size_t digest_size,
           uint64_t data_file_blocks, uint64_t *hash_position, int *levels,
           uint64_t *hash_level_block, uint64_t *hash_level_size)
{
  size_t hash_per_block_bits;
  uint64_t s, s_shift;
  int i;

  if (!digest_size)
    return -EINVAL;

  hash_per_block_bits = get_bits_down(hash_block_size / digest_size);
  if (!hash_per_block_bits)
    return -EINVAL;

  *levels = 0;
  while (hash_per_block_bits * *levels < 64 &&
         (data_file_blocks - 1) >> (hash_per_block_bits * *levels))
    (*levels)++;

  if (*levels > VERITY_MAX_LEVELS)
    return -EINVAL;

  for (i = *levels - 1; i >= 0; i--) {
    if (hash_level_block)
      hash_level_block[i] = *hash_position;
    // verity position of block data_file_blocks at level i
    s_shift = (i + 1) * hash_per_block_bits;
    if (s_shift > 63)
      return -EINVAL;
    s = (data_file_blocks + ((uint64_t)1 << s_shift) - 1) >> ((i + 1) * hash_per_block_bits);
    if (hash_level_size)
      hash_level_size[i] = s;
    if ((*hash_position + s) < *hash_position)
      return -EINVAL;
    *hash_position += s;
  }

  return 0;
}

static int create_or_verify(struct crypt_device *cd, FILE *rd, FILE *wr,
           uint64_t data_block, size_t data_block_size,
           uint64_t hash_block, size_t hash_block_size,
           uint64_t blocks, int version,
           const char *hash_name, int verify,
           char *calculated_digest, size_t digest_size,
           const char *salt, size_t salt_size)
{
  char *left_block, *data_buffer;
  char read_digest[VERITY_MAX_DIGEST_SIZE];
  size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
  size_t digest_size_full = 1 << get_bits_up(digest_size);
  uint64_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block;
  uint64_t seek_rd, seek_wr;
  size_t left_bytes;
  unsigned i;
  int r;

  if (digest_size > sizeof(read_digest))
    return -EINVAL;

  if (uint64_mult_overflow(&seek_rd, data_block, data_block_size) ||
      uint64_mult_overflow(&seek_wr, hash_block, hash_block_size)) {
    log_err(cd, _("Device offset overflow."));
    return -EINVAL;
  }

  if (fseeko(rd, seek_rd, SEEK_SET)) {
    log_dbg(cd, "Cannot seek to requested position in data device.");
    return -EIO;
  }

  if (wr && fseeko(wr, seek_wr, SEEK_SET)) {
    log_dbg(cd, "Cannot seek to requested position in hash device.");
    return -EIO;
  }

  left_block = malloc(hash_block_size);
  data_buffer = malloc(data_block_size);
  if (!left_block || !data_buffer) {
    r = -ENOMEM;
    goto out;
  }

  memset(left_block, 0, hash_block_size);
  while (blocks_to_write--) {
    left_bytes = hash_block_size;
    for (i = 0; i < hash_per_block; i++) {
      if (!blocks)
        break;
      blocks--;
      if (fread(data_buffer, data_block_size, 1, rd) != 1) {
        log_dbg(cd, "Cannot read data device block.");
        r = -EIO;
        goto out;
      }

      if (verify_hash_block(hash_name, version,
          calculated_digest, digest_size,
          data_buffer, data_block_size,
          salt, salt_size)) {
        r = -EINVAL;
        goto out;
      }

      if (!wr)
        break;
      if (verify) {
        if (fread(read_digest, digest_size, 1, wr) != 1) {
          log_dbg(cd, "Cannot read digest form hash device.");
          r = -EIO;
          goto out;
        }
        if (crypt_backend_memeq(read_digest, calculated_digest, digest_size)) {
          log_err(cd, _("Verification failed at position %" PRIu64 "."),
            ftello(rd) - data_block_size);
          r = -EPERM;
          goto out;
        }
      } else {
        if (fwrite(calculated_digest, digest_size, 1, wr) != 1) {
          log_dbg(cd, "Cannot write digest to hash device.");
          r = -EIO;
          goto out;
        }
      }
      if (version == 0) {
        left_bytes -= digest_size;
      } else {
        if (digest_size_full - digest_size) {
          if (verify) {
            r = verify_zero(cd, wr, digest_size_full - digest_size);
            if (r)
              goto out;
          } else if (fwrite(left_block, digest_size_full - digest_size, 1, wr) != 1) {
            log_dbg(cd, "Cannot write spare area to hash device.");
            r = -EIO;
            goto out;
          }
        }
        left_bytes -= digest_size_full;
      }
    }
    if (wr && left_bytes) {
      if (verify) {
        r = verify_zero(cd , wr, left_bytes);
        if (r)
          goto out;
      } else if (fwrite(left_block, left_bytes, 1, wr) != 1) {
        log_dbg(cd, "Cannot write remaining spare area to hash device.");
        r = -EIO;
        goto out;
      }
    }
  }
  r = 0;
out:
  free(left_block);
  free(data_buffer);
  return r;
}

static int VERITY_create_or_verify_hash(struct crypt_device *cd, bool verify,
  struct crypt_params_verity *params,
  char *root_hash, size_t digest_size)
{
  char calculated_digest[VERITY_MAX_DIGEST_SIZE];
  FILE *data_file = NULL;
  FILE *hash_file = NULL, *hash_file_2;
  uint64_t hash_level_block[VERITY_MAX_LEVELS];
  uint64_t hash_level_size[VERITY_MAX_LEVELS];
  uint64_t data_file_blocks;
  uint64_t data_device_offset_max = 0, hash_device_offset_max = 0;
  uint64_t hash_position = VERITY_hash_offset_block(params);
  uint64_t dev_size;
  int levels, i, r;

  log_dbg(cd, "Hash %s %s, data device %s, data blocks %" PRIu64
    ", hash_device %s, offset %" PRIu64 ".",
    verify ? "verification" : "creation", params->hash_name,
    device_path(crypt_data_device(cd)), params->data_size,
    device_path(crypt_metadata_device(cd)), hash_position);

  if (digest_size > sizeof(calculated_digest))
    return -EINVAL;

  if (!params->data_size) {
    r = device_size(crypt_data_device(cd), &dev_size);
    if (r < 0)
      return r;

    data_file_blocks = dev_size / params->data_block_size;
  } else
    data_file_blocks = params->data_size;

  if (uint64_mult_overflow(&data_device_offset_max, params->data_size, params->data_block_size)) {
    log_err(cd, _("Device offset overflow."));
    return -EINVAL;
  }
  log_dbg(cd, "Data device size required: %" PRIu64 " bytes.", data_device_offset_max);

  if (hash_levels(params->hash_block_size, digest_size, data_file_blocks, &hash_position,
    &levels, &hash_level_block[0], &hash_level_size[0])) {
    log_err(cd, _("Hash area overflow."));
    return -EINVAL;
  }
  if (uint64_mult_overflow(&hash_device_offset_max, hash_position, params->hash_block_size)) {
    log_err(cd, _("Device offset overflow."));
    return -EINVAL;
  }
  log_dbg(cd, "Hash device size required: %" PRIu64 " bytes.",
    hash_device_offset_max - params->hash_area_offset);
  log_dbg(cd, "Using %d hash levels.", levels);

  r = device_check_size(cd, crypt_metadata_device(cd),
            hash_device_offset_max - params->hash_area_offset, 1);
  if (r < 0)
    return r;

  data_file = fopen(device_path(crypt_data_device(cd)), "r");
  if (!data_file) {
    log_err(cd, _("Cannot open device %s."),
      device_path(crypt_data_device(cd))
    );
    r = -EIO;
    goto out;
  }

  hash_file = fopen(device_path(crypt_metadata_device(cd)), verify ? "r" : "r+");
  if (!hash_file) {
    log_err(cd, _("Cannot open device %s."),
      device_path(crypt_metadata_device(cd)));
    r = -EIO;
    goto out;
  }

  memset(calculated_digest, 0, digest_size);

  for (i = 0; i < levels; i++) {
    if (!i) {
      r = create_or_verify(cd, data_file, hash_file,
                0, params->data_block_size,
                hash_level_block[i], params->hash_block_size,
                data_file_blocks, params->hash_type, params->hash_name, verify,
                calculated_digest, digest_size, params->salt, params->salt_size);
      if (r)
        goto out;
    } else {
      hash_file_2 = fopen(device_path(crypt_metadata_device(cd)), "r");
      if (!hash_file_2) {
        log_err(cd, _("Cannot open device %s."),
          device_path(crypt_metadata_device(cd)));
        r = -EIO;
        goto out;
      }
      r = create_or_verify(cd, hash_file_2, hash_file,
                hash_level_block[i - 1], params->hash_block_size,
                hash_level_block[i], params->hash_block_size,
                hash_level_size[i - 1], params->hash_type, params->hash_name, verify,
                calculated_digest, digest_size, params->salt, params->salt_size);
      fclose(hash_file_2);
      if (r)
        goto out;
    }
  }

  if (levels)
    r = create_or_verify(cd, hash_file, NULL,
              hash_level_block[levels - 1], params->hash_block_size,
              0, params->hash_block_size,
              1, params->hash_type, params->hash_name, verify,
              calculated_digest, digest_size, params->salt, params->salt_size);
  else
    r = create_or_verify(cd, data_file, NULL,
              0, params->data_block_size,
              0, params->hash_block_size,
              data_file_blocks, params->hash_type, params->hash_name, verify,
              calculated_digest, digest_size, params->salt, params->salt_size);
out:
  if (verify) {
    if (r)
      log_err(cd, _("Verification of data area failed."));
    else {
      log_dbg(cd, "Verification of data area succeeded.");
      r = crypt_backend_memeq(root_hash, calculated_digest, digest_size) ? -EFAULT : 0;
      if (r)
        log_err(cd, _("Verification of root hash failed."));
      else
        log_dbg(cd, "Verification of root hash succeeded.");
    }
  } else {
    if (r == -EIO)
      log_err(cd, _("Input/output error while creating hash area."));
    else if (r)
      log_err(cd, _("Creation of hash area failed."));
    else {
      fsync(fileno(hash_file));
      memcpy(root_hash, calculated_digest, digest_size);
    }
  }

  if (data_file)
    fclose(data_file);
  if (hash_file)
    fclose(hash_file);
  return r;
}

/* Verify verity device using userspace crypto backend */
int VERITY_verify(struct crypt_device *cd,
      struct crypt_params_verity *verity_hdr,
      const char *root_hash,
      size_t root_hash_size)
{
  return VERITY_create_or_verify_hash(cd, 1, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
}

/* Create verity hash */
int VERITY_create(struct crypt_device *cd,
      struct crypt_params_verity *verity_hdr,
      const char *root_hash,
      size_t root_hash_size)
{
  unsigned pgsize = (unsigned)crypt_getpagesize();

  if (verity_hdr->salt_size > 256)
    return -EINVAL;

  if (verity_hdr->data_block_size > pgsize)
    log_err(cd, _("WARNING: Kernel cannot activate device if data "
            "block size exceeds page size (%u)."), pgsize);

  return VERITY_create_or_verify_hash(cd, 0, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
}

uint64_t VERITY_hash_blocks(struct crypt_device *cd, struct crypt_params_verity *params)
{
  uint64_t hash_position = 0;
  int levels = 0;

  if (hash_levels(params->hash_block_size, crypt_get_volume_key_size(cd),
    params->data_size, &hash_position, &levels, NULL, NULL))
    return 0;

  return (uint64_t)hash_position;
}

Coverage Report

Created: 2025-10-12 06:56

Line	Count	Source
1		// SPDX-License-Identifier: LGPL-2.1-or-later
2		/*
3		* dm-verity volume handling
4		*
5		* Copyright (C) 2012-2025 Red Hat, Inc. All rights reserved.
6		*/
7
8		#include <errno.h>
9		#include <stdio.h>
10		#include <stdlib.h>
11		#include <string.h>
12		#include <stdint.h>
13
14		#include "verity.h"
15		#include "internal.h"
16
17	0	#define VERITY_MAX_LEVELS 63
18		#define VERITY_MAX_DIGEST_SIZE 1024
19
20		static unsigned get_bits_up(size_t u)
21	0	{
22	0	unsigned i = 0;
23	0	while ((1U << i) < u)
24	0	i++;
25	0	return i;
26	0	}
27
28		static unsigned get_bits_down(size_t u)
29	0	{
30	0	unsigned i = 0;
31	0	while ((u >> i) > 1U)
32	0	i++;
33	0	return i;
34	0	}
35
36		static int verify_zero(struct crypt_device cd, FILE wr, size_t bytes)
37	0	{
38	0	char *block = NULL;
39	0	size_t i;
40	0	int r;
41
42	0	block = malloc(bytes);
43	0	if (!block)
44	0	return -ENOMEM;
45
46	0	if (fread(block, bytes, 1, wr) != 1) {
47	0	log_dbg(cd, "EIO while reading spare area.");
48	0	r = -EIO;
49	0	goto out;
50	0	}
51	0	for (i = 0; i < bytes; i++)
52	0	if (block[i]) {
53	0	log_err(cd, _("Spare area is not zeroed at position %" PRIu64 "."),
54	0	ftello(wr) - bytes);
55	0	r = -EPERM;
56	0	goto out;
57	0	}
58	0	r = 0;
59	0	out:
60	0	free(block);
61	0	return r;
62	0	}
63
64		static int verify_hash_block(const char *hash_name, int version,
65		char *hash, size_t hash_size,
66		const char *data, size_t data_size,
67		const char *salt, size_t salt_size)
68	0	{
69	0	struct crypt_hash *ctx = NULL;
70	0	int r;
71
72	0	if (crypt_hash_init(&ctx, hash_name))
73	0	return -EINVAL;
74
75	0	if (version == 1 && (r = crypt_hash_write(ctx, salt, salt_size)))
76	0	goto out;
77
78	0	if ((r = crypt_hash_write(ctx, data, data_size)))
79	0	goto out;
80
81	0	if (version == 0 && (r = crypt_hash_write(ctx, salt, salt_size)))
82	0	goto out;
83
84	0	r = crypt_hash_final(ctx, hash, hash_size);
85	0	out:
86	0	crypt_hash_destroy(ctx);
87	0	return r;
88	0	}
89
90		static int hash_levels(size_t hash_block_size, size_t digest_size,
91		uint64_t data_file_blocks, uint64_t hash_position, int levels,
92		uint64_t hash_level_block, uint64_t hash_level_size)
93	0	{
94	0	size_t hash_per_block_bits;
95	0	uint64_t s, s_shift;
96	0	int i;
97
98	0	if (!digest_size)
99	0	return -EINVAL;
100
101	0	hash_per_block_bits = get_bits_down(hash_block_size / digest_size);
102	0	if (!hash_per_block_bits)
103	0	return -EINVAL;
104
105	0	*levels = 0;
106	0	while (hash_per_block_bits * *levels < 64 &&
107	0	(data_file_blocks - 1) >> (hash_per_block_bits * *levels))
108	0	(*levels)++;
109
110	0	if (*levels > VERITY_MAX_LEVELS)
111	0	return -EINVAL;
112
113	0	for (i = *levels - 1; i >= 0; i--) {
114	0	if (hash_level_block)
115	0	hash_level_block[i] = *hash_position;
116		// verity position of block data_file_blocks at level i
117	0	s_shift = (i + 1) * hash_per_block_bits;
118	0	if (s_shift > 63)
119	0	return -EINVAL;
120	0	s = (data_file_blocks + ((uint64_t)1 << s_shift) - 1) >> ((i + 1) * hash_per_block_bits);
121	0	if (hash_level_size)
122	0	hash_level_size[i] = s;
123	0	if ((hash_position + s) < hash_position)
124	0	return -EINVAL;
125	0	*hash_position += s;
126	0	}
127
128	0	return 0;
129	0	}
130
131		static int create_or_verify(struct crypt_device cd, FILE rd, FILE *wr,
132		uint64_t data_block, size_t data_block_size,
133		uint64_t hash_block, size_t hash_block_size,
134		uint64_t blocks, int version,
135		const char *hash_name, int verify,
136		char *calculated_digest, size_t digest_size,
137		const char *salt, size_t salt_size)
138	0	{
139	0	char left_block, data_buffer;
140	0	char read_digest[VERITY_MAX_DIGEST_SIZE];
141	0	size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
142	0	size_t digest_size_full = 1 << get_bits_up(digest_size);
143	0	uint64_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block;
144	0	uint64_t seek_rd, seek_wr;
145	0	size_t left_bytes;
146	0	unsigned i;
147	0	int r;
148
149	0	if (digest_size > sizeof(read_digest))
150	0	return -EINVAL;
151
152	0	if (uint64_mult_overflow(&seek_rd, data_block, data_block_size) \|\|
153	0	uint64_mult_overflow(&seek_wr, hash_block, hash_block_size)) {
154	0	log_err(cd, _("Device offset overflow."));
155	0	return -EINVAL;
156	0	}
157
158	0	if (fseeko(rd, seek_rd, SEEK_SET)) {
159	0	log_dbg(cd, "Cannot seek to requested position in data device.");
160	0	return -EIO;
161	0	}
162
163	0	if (wr && fseeko(wr, seek_wr, SEEK_SET)) {
164	0	log_dbg(cd, "Cannot seek to requested position in hash device.");
165	0	return -EIO;
166	0	}
167
168	0	left_block = malloc(hash_block_size);
169	0	data_buffer = malloc(data_block_size);
170	0	if (!left_block \|\| !data_buffer) {
171	0	r = -ENOMEM;
172	0	goto out;
173	0	}
174
175	0	memset(left_block, 0, hash_block_size);
176	0	while (blocks_to_write--) {
177	0	left_bytes = hash_block_size;
178	0	for (i = 0; i < hash_per_block; i++) {
179	0	if (!blocks)
180	0	break;
181	0	blocks--;
182	0	if (fread(data_buffer, data_block_size, 1, rd) != 1) {
183	0	log_dbg(cd, "Cannot read data device block.");
184	0	r = -EIO;
185	0	goto out;
186	0	}
187
188	0	if (verify_hash_block(hash_name, version,
189	0	calculated_digest, digest_size,
190	0	data_buffer, data_block_size,
191	0	salt, salt_size)) {
192	0	r = -EINVAL;
193	0	goto out;
194	0	}
195
196	0	if (!wr)
197	0	break;
198	0	if (verify) {
199	0	if (fread(read_digest, digest_size, 1, wr) != 1) {
200	0	log_dbg(cd, "Cannot read digest form hash device.");
201	0	r = -EIO;
202	0	goto out;
203	0	}
204	0	if (crypt_backend_memeq(read_digest, calculated_digest, digest_size)) {
205	0	log_err(cd, _("Verification failed at position %" PRIu64 "."),
206	0	ftello(rd) - data_block_size);
207	0	r = -EPERM;
208	0	goto out;
209	0	}
210	0	} else {
211	0	if (fwrite(calculated_digest, digest_size, 1, wr) != 1) {
212	0	log_dbg(cd, "Cannot write digest to hash device.");
213	0	r = -EIO;
214	0	goto out;
215	0	}
216	0	}
217	0	if (version == 0) {
218	0	left_bytes -= digest_size;
219	0	} else {
220	0	if (digest_size_full - digest_size) {
221	0	if (verify) {
222	0	r = verify_zero(cd, wr, digest_size_full - digest_size);
223	0	if (r)
224	0	goto out;
225	0	} else if (fwrite(left_block, digest_size_full - digest_size, 1, wr) != 1) {
226	0	log_dbg(cd, "Cannot write spare area to hash device.");
227	0	r = -EIO;
228	0	goto out;
229	0	}
230	0	}
231	0	left_bytes -= digest_size_full;
232	0	}
233	0	}
234	0	if (wr && left_bytes) {
235	0	if (verify) {
236	0	r = verify_zero(cd , wr, left_bytes);
237	0	if (r)
238	0	goto out;
239	0	} else if (fwrite(left_block, left_bytes, 1, wr) != 1) {
240	0	log_dbg(cd, "Cannot write remaining spare area to hash device.");
241	0	r = -EIO;
242	0	goto out;
243	0	}
244	0	}
245	0	}
246	0	r = 0;
247	0	out:
248	0	free(left_block);
249	0	free(data_buffer);
250	0	return r;
251	0	}
252
253		static int VERITY_create_or_verify_hash(struct crypt_device *cd, bool verify,
254		struct crypt_params_verity *params,
255		char *root_hash, size_t digest_size)
256	0	{
257	0	char calculated_digest[VERITY_MAX_DIGEST_SIZE];
258	0	FILE *data_file = NULL;
259	0	FILE hash_file = NULL, hash_file_2;
260	0	uint64_t hash_level_block[VERITY_MAX_LEVELS];
261	0	uint64_t hash_level_size[VERITY_MAX_LEVELS];
262	0	uint64_t data_file_blocks;
263	0	uint64_t data_device_offset_max = 0, hash_device_offset_max = 0;
264	0	uint64_t hash_position = VERITY_hash_offset_block(params);
265	0	uint64_t dev_size;
266	0	int levels, i, r;
267
268	0	log_dbg(cd, "Hash %s %s, data device %s, data blocks %" PRIu64
269	0	", hash_device %s, offset %" PRIu64 ".",
270	0	verify ? "verification" : "creation", params->hash_name,
271	0	device_path(crypt_data_device(cd)), params->data_size,
272	0	device_path(crypt_metadata_device(cd)), hash_position);
273
274	0	if (digest_size > sizeof(calculated_digest))
275	0	return -EINVAL;
276
277	0	if (!params->data_size) {
278	0	r = device_size(crypt_data_device(cd), &dev_size);
279	0	if (r < 0)
280	0	return r;
281
282	0	data_file_blocks = dev_size / params->data_block_size;
283	0	} else
284	0	data_file_blocks = params->data_size;
285
286	0	if (uint64_mult_overflow(&data_device_offset_max, params->data_size, params->data_block_size)) {
287	0	log_err(cd, _("Device offset overflow."));
288	0	return -EINVAL;
289	0	}
290	0	log_dbg(cd, "Data device size required: %" PRIu64 " bytes.", data_device_offset_max);
291
292	0	if (hash_levels(params->hash_block_size, digest_size, data_file_blocks, &hash_position,
293	0	&levels, &hash_level_block[0], &hash_level_size[0])) {
294	0	log_err(cd, _("Hash area overflow."));
295	0	return -EINVAL;
296	0	}
297	0	if (uint64_mult_overflow(&hash_device_offset_max, hash_position, params->hash_block_size)) {
298	0	log_err(cd, _("Device offset overflow."));
299	0	return -EINVAL;
300	0	}
301	0	log_dbg(cd, "Hash device size required: %" PRIu64 " bytes.",
302	0	hash_device_offset_max - params->hash_area_offset);
303	0	log_dbg(cd, "Using %d hash levels.", levels);
304
305	0	r = device_check_size(cd, crypt_metadata_device(cd),
306	0	hash_device_offset_max - params->hash_area_offset, 1);
307	0	if (r < 0)
308	0	return r;
309
310	0	data_file = fopen(device_path(crypt_data_device(cd)), "r");
311	0	if (!data_file) {
312	0	log_err(cd, _("Cannot open device %s."),
313	0	device_path(crypt_data_device(cd))
314	0	);
315	0	r = -EIO;
316	0	goto out;
317	0	}
318
319	0	hash_file = fopen(device_path(crypt_metadata_device(cd)), verify ? "r" : "r+");
320	0	if (!hash_file) {
321	0	log_err(cd, _("Cannot open device %s."),
322	0	device_path(crypt_metadata_device(cd)));
323	0	r = -EIO;
324	0	goto out;
325	0	}
326
327	0	memset(calculated_digest, 0, digest_size);
328
329	0	for (i = 0; i < levels; i++) {
330	0	if (!i) {
331	0	r = create_or_verify(cd, data_file, hash_file,
332	0	0, params->data_block_size,
333	0	hash_level_block[i], params->hash_block_size,
334	0	data_file_blocks, params->hash_type, params->hash_name, verify,
335	0	calculated_digest, digest_size, params->salt, params->salt_size);
336	0	if (r)
337	0	goto out;
338	0	} else {
339	0	hash_file_2 = fopen(device_path(crypt_metadata_device(cd)), "r");
340	0	if (!hash_file_2) {
341	0	log_err(cd, _("Cannot open device %s."),
342	0	device_path(crypt_metadata_device(cd)));
343	0	r = -EIO;
344	0	goto out;
345	0	}
346	0	r = create_or_verify(cd, hash_file_2, hash_file,
347	0	hash_level_block[i - 1], params->hash_block_size,
348	0	hash_level_block[i], params->hash_block_size,
349	0	hash_level_size[i - 1], params->hash_type, params->hash_name, verify,
350	0	calculated_digest, digest_size, params->salt, params->salt_size);
351	0	fclose(hash_file_2);
352	0	if (r)
353	0	goto out;
354	0	}
355	0	}
356
357	0	if (levels)
358	0	r = create_or_verify(cd, hash_file, NULL,
359	0	hash_level_block[levels - 1], params->hash_block_size,
360	0	0, params->hash_block_size,
361	0	1, params->hash_type, params->hash_name, verify,
362	0	calculated_digest, digest_size, params->salt, params->salt_size);
363	0	else
364	0	r = create_or_verify(cd, data_file, NULL,
365	0	0, params->data_block_size,
366	0	0, params->hash_block_size,
367	0	data_file_blocks, params->hash_type, params->hash_name, verify,
368	0	calculated_digest, digest_size, params->salt, params->salt_size);
369	0	out:
370	0	if (verify) {
371	0	if (r)
372	0	log_err(cd, _("Verification of data area failed."));
373	0	else {
374	0	log_dbg(cd, "Verification of data area succeeded.");
375	0	r = crypt_backend_memeq(root_hash, calculated_digest, digest_size) ? -EFAULT : 0;
376	0	if (r)
377	0	log_err(cd, _("Verification of root hash failed."));
378	0	else
379	0	log_dbg(cd, "Verification of root hash succeeded.");
380	0	}
381	0	} else {
382	0	if (r == -EIO)
383	0	log_err(cd, _("Input/output error while creating hash area."));
384	0	else if (r)
385	0	log_err(cd, _("Creation of hash area failed."));
386	0	else {
387	0	fsync(fileno(hash_file));
388	0	memcpy(root_hash, calculated_digest, digest_size);
389	0	}
390	0	}
391
392	0	if (data_file)
393	0	fclose(data_file);
394	0	if (hash_file)
395	0	fclose(hash_file);
396	0	return r;
397	0	}
398
399		/* Verify verity device using userspace crypto backend */
400		int VERITY_verify(struct crypt_device *cd,
401		struct crypt_params_verity *verity_hdr,
402		const char *root_hash,
403		size_t root_hash_size)
404	0	{
405	0	return VERITY_create_or_verify_hash(cd, 1, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
406	0	}
407
408		/* Create verity hash */
409		int VERITY_create(struct crypt_device *cd,
410		struct crypt_params_verity *verity_hdr,
411		const char *root_hash,
412		size_t root_hash_size)
413	0	{
414	0	unsigned pgsize = (unsigned)crypt_getpagesize();
415
416	0	if (verity_hdr->salt_size > 256)
417	0	return -EINVAL;
418
419	0	if (verity_hdr->data_block_size > pgsize)
420	0	log_err(cd, _("WARNING: Kernel cannot activate device if data "
421	0	"block size exceeds page size (%u)."), pgsize);
422
423	0	return VERITY_create_or_verify_hash(cd, 0, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
424	0	}
425
426		uint64_t VERITY_hash_blocks(struct crypt_device cd, struct crypt_params_verity params)
427	0	{
428	0	uint64_t hash_position = 0;
429	0	int levels = 0;
430
431	0	if (hash_levels(params->hash_block_size, crypt_get_volume_key_size(cd),
432	0	params->data_size, &hash_position, &levels, NULL, NULL))
433	0	return 0;
434
435	0	return (uint64_t)hash_position;
436	0	}