* Copyright (c) 2023-2024 Huawei Device Co., Ltd.
*/
#include <linux/string.h>
#include <linux/fcntl.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/rwlock_types.h>
#include <linux/rwlock.h>
#include <linux/init.h>
#include <linux/moduleparam.h>
#include <linux/device-mapper.h>
#include <linux/kdev_t.h>
#include <linux/namei.h>
#include <linux/sched.h>
#include "mount.h"
#include "internal.h"
#include "exec_signature_info.h"
#include "xpm_report.h"
#include "xpm_log.h"
#include "code_sign_elf.h"
#define VERITY_NODE_CACHE_LIMITS 10000
#define VERITY_NODE_CACHE_RECYCLE_NUM 200
static DEFINE_RWLOCK(dm_verity_tree_lock);
static struct rb_root dm_verity_tree = RB_ROOT;
static int dm_verity_node_count;
static DEFINE_RWLOCK(fs_verity_tree_lock);
static struct rb_root fs_verity_tree = RB_ROOT;
static int fs_verity_node_count;
struct verity_info {
struct rb_root *root;
rwlock_t *lock;
int *node_count;
};
static bool dm_verity_enable_check;
#define DM_PARTITION_PATH_MAX 30
#define DM_VERITY_INVALID_DEV ((dev_t)-1)
struct dm_partition {
char path[DM_PARTITION_PATH_MAX];
int len;
dev_t s_dev;
};
static struct dm_partition dm_partition_table[] = {
{ .path = "/", .len = 1, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/cust/", .len = 6, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/system/", .len = 8, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/vendor/", .len = 8, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/version/", .len = 9, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/preload/", .len = 9, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/sys_prod/", .len = 10, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/chip_prod/", .len = 11, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/module_updata/", .len = 15, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/vendor/modem/modem_vendor/", .len = 27, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/vendor/modem/modem_driver/", .len = 27, .s_dev = DM_VERITY_INVALID_DEV },
{ .path = "/misc/", .len = 6, .s_dev = DM_VERITY_INVALID_DEV },
};
static struct path root_path;
static dev_t get_file_dev(struct file *file)
{
struct super_block *sb;
struct mount *mnt;
if (file->f_path.mnt == NULL)
return DM_VERITY_INVALID_DEV;
mnt = container_of(file->f_path.mnt, struct mount, mnt);
sb = mnt->mnt.mnt_sb;
if (sb == NULL)
return DM_VERITY_INVALID_DEV;
return sb->s_dev;
}
static dev_t get_partition_dev_form_mnt(const struct vfsmount *mnt)
{
if (IS_ERR_OR_NULL(mnt) || IS_ERR_OR_NULL(mnt->mnt_sb))
return DM_VERITY_INVALID_DEV;
return mnt->mnt_sb->s_dev;
}
static dev_t get_root_partition_dev(struct path *root_path)
{
int ret;
struct path path;
struct path *mount_path = &path;
dev_t s_dev;
if (root_path != NULL)
mount_path = root_path;
ret = kern_path("/", LOOKUP_DIRECTORY, mount_path);
if (ret) {
xpm_log_error("get / path failed");
return DM_VERITY_INVALID_DEV;
}
s_dev = get_partition_dev_form_mnt(mount_path->mnt);
if (s_dev == DM_VERITY_INVALID_DEV || root_path == NULL)
path_put(mount_path);
xpm_log_info("get / dev=%u:%u success", s_dev, MINOR(s_dev));
return s_dev;
}
static dev_t get_dm_verity_partition_dev(const char *dir, struct path *root_path)
{
int ret;
struct path path;
dev_t s_dev;
ret = vfs_path_lookup(root_path->dentry, root_path->mnt, dir, LOOKUP_DIRECTORY, &path);
if (ret) {
xpm_log_error("get %s path failed", dir);
return DM_VERITY_INVALID_DEV;
}
s_dev = get_partition_dev_form_mnt(path.mnt);
path_put(&path);
xpm_log_info("get %s dev=%u:%u success", dir, s_dev, MINOR(s_dev));
return s_dev;
}
static bool find_partition_dev(struct file *file, dev_t s_dev)
{
char *full_path = NULL;
char path[PATH_MAX] = {0};
struct dm_partition *dm_path;
int i;
for (i = 1; i < sizeof(dm_partition_table) / sizeof(struct dm_partition); i++) {
dm_path = &dm_partition_table[i];
if (dm_path->s_dev != DM_VERITY_INVALID_DEV)
continue;
if (full_path == NULL) {
full_path = file_path(file, path, PATH_MAX-1);
if (IS_ERR(full_path))
return false;
}
if (strncmp(dm_path->path, full_path, dm_path->len) != 0)
continue;
dm_path->s_dev = get_dm_verity_partition_dev(dm_path->path, &root_path);
if (dm_path->s_dev == DM_VERITY_INVALID_DEV)
return false;
if (dm_path->s_dev == s_dev)
return true;
return false;
}
return false;
}
static bool dm_verity_check_for_path(struct file *file)
{
static int system_startup_stage;
struct dm_partition *dm_path;
dev_t s_dev, root_dev;
int i;
s_dev = get_file_dev(file);
for (i = 0; i < sizeof(dm_partition_table) / sizeof(struct dm_partition); i++) {
dm_path = &dm_partition_table[i];
if (dm_path->s_dev == s_dev)
return true;
}
if (system_startup_stage)
return find_partition_dev(file, s_dev);
if (task_pid_nr(current) == 1) {
root_dev = get_root_partition_dev(NULL);
if (root_dev != dm_partition_table[0].s_dev) {
path_put(&root_path);
dm_partition_table[0].s_dev = get_root_partition_dev(&root_path);
for (i = 1; i < sizeof(dm_partition_table) / sizeof(struct dm_partition); i++)
dm_partition_table[i].s_dev = DM_VERITY_INVALID_DEV;
system_startup_stage = 1;
}
}
return find_partition_dev(file, s_dev);
}
#ifdef CONFIG_DM_VERITY
#define HVB_CMDLINE_VB_STATE "ohos.boot.hvb.enable"
static bool dm_verity_enable;
static int hvb_boot_param_cb(char *param, char *val,
const char *unused, void *arg)
{
if (param == NULL || val == NULL)
return 0;
if (strcmp(param, HVB_CMDLINE_VB_STATE) != 0)
return 0;
if (strcmp(val, "true") == 0 || strcmp(val, "green") == 0)
dm_verity_enable = true;
return 0;
}
static bool dm_verity_is_enable(void)
{
char *cmdline;
if (dm_verity_enable || dm_verity_enable_check)
return dm_verity_enable;
cmdline = kstrdup(saved_command_line, GFP_KERNEL);
if (cmdline == NULL)
return false;
parse_args("hvb.enable params", cmdline, NULL,
0, 0, 0, NULL, &hvb_boot_param_cb);
kfree(cmdline);
dm_verity_enable_check = true;
if (!dm_verity_enable) {
dm_partition_table[0].s_dev = get_root_partition_dev(&root_path);
report_init_event(DM_DISABLE);
}
return dm_verity_enable;
}
static bool dm_verity_check_for_mnt(struct file *file)
{
struct mapped_device *device;
device = dm_get_md(get_file_dev(file));
if (device == NULL)
return false;
dm_put(device);
return true;
}
#endif
static bool is_dm_verity(struct file *file)
{
#ifdef CONFIG_DM_VERITY
if (dm_verity_is_enable())
return dm_verity_check_for_mnt(file);
#endif
if (!dm_verity_enable_check) {
dm_partition_table[0].s_dev = get_root_partition_dev(&root_path);
dm_verity_enable_check = true;
report_init_event(DM_DISABLE);
}
return dm_verity_check_for_path(file);
}
#ifdef CONFIG_FS_VERITY
static bool is_fs_verity(struct file *file)
{
struct inode *file_node;
file_node = file_inode(file);
if (file_node == NULL)
return false;
if (file_node->i_verity_info == NULL)
return false;
return true;
}
#endif
static int check_exec_file_is_verity(struct file *file, bool is_exec)
{
#ifdef CONFIG_FS_VERITY
if (is_fs_verity(file))
return FILE_SIGNATURE_FS_VERITY;
#endif
if (is_dm_verity(file))
return FILE_SIGNATURE_DM_VERITY;
#ifdef CONFIG_SECURITY_CODE_SIGN
if (is_exec && !elf_file_enable_fs_verity(file))
return FILE_SIGNATURE_FS_VERITY;
#endif
return FILE_SIGNATURE_INVALID;
}
static struct exec_file_signature_info *rb_search_node(struct rb_root *root, uintptr_t file_inode)
{
struct rb_node *node = root->rb_node;
struct exec_file_signature_info *file_node;
while (node != NULL) {
file_node = rb_entry(node, struct exec_file_signature_info, rb_node);
if (file_inode < file_node->inode) {
node = file_node->rb_node.rb_left;
} else if (file_inode > file_node->inode) {
node = file_node->rb_node.rb_right;
} else {
atomic_inc(&file_node->reference);
return file_node;
}
}
return NULL;
}
static struct exec_file_signature_info *rb_add_node(struct rb_root *root, int *node_count,
struct exec_file_signature_info *node)
{
struct rb_node **p = &root->rb_node;
struct rb_node *parent = NULL;
struct exec_file_signature_info *file;
while (*p != NULL) {
parent = *p;
file = rb_entry(parent, struct exec_file_signature_info, rb_node);
if (node->inode < file->inode) {
p = &(*p)->rb_left;
} else if (node->inode > file->inode) {
p = &(*p)->rb_right;
} else {
atomic_inc(&file->reference);
return file;
}
}
rb_link_node(&node->rb_node, parent, p);
rb_insert_color(&node->rb_node, root);
atomic_inc(&node->reference);
(*node_count)++;
return NULL;
}
static void rb_erase_node(struct rb_root *root, int *node_count,
struct exec_file_signature_info *node)
{
rb_erase(&node->rb_node, root);
(*node_count)--;
}
static int find_idle_nodes(struct rb_root *root, uintptr_t *ilde_nodes, int count)
{
int i = 0;
struct exec_file_signature_info *code_segment;
struct rb_node *node;
for (node = rb_first(root); node != NULL && i < count; node = rb_next(node)) {
code_segment = rb_entry(node, struct exec_file_signature_info, rb_node);
if (atomic_read(&code_segment->reference) > 0)
continue;
ilde_nodes[i++] = (uintptr_t)code_segment;
}
return i;
}
static void clear_code_segment_info_cache(struct rb_root *root, int *node_count)
{
struct exec_file_signature_info *code_segment_info;
uintptr_t *code_segments;
int i = 0;
int count = VERITY_NODE_CACHE_RECYCLE_NUM;
code_segments = kcalloc(count, sizeof(uintptr_t), GFP_KERNEL);
if (code_segments == NULL)
return;
count = find_idle_nodes(root, code_segments, count);
while (i < count) {
code_segment_info = (struct exec_file_signature_info *)code_segments[i];
rb_erase_node(root, node_count, code_segment_info);
kfree(code_segment_info);
i++;
}
kfree(code_segments);
}
#ifdef CONFIG_SECURITY_XPM_DEBUG
static size_t test_elf_code_segment_info_size(struct rb_root *root)
{
size_t size = 0;
struct exec_file_signature_info *file_node;
struct rb_node *node;
for (node = rb_first(root); node != NULL; node = rb_next(node)) {
file_node = rb_entry(node, struct exec_file_signature_info, rb_node);
size += sizeof(struct exec_file_signature_info) +
file_node->code_segment_count * sizeof(struct exec_segment_info);
}
return size;
}
static void test_printf_code_segment_cache_size(void)
{
size_t cache_size = 0;
int dm_count;
int fs_count;
read_lock(&dm_verity_tree_lock);
cache_size += test_elf_code_segment_info_size(&dm_verity_tree);
dm_count = dm_verity_node_count;
read_unlock(&dm_verity_tree_lock);
read_lock(&fs_verity_tree_lock);
cache_size += test_elf_code_segment_info_size(&fs_verity_tree);
fs_count = fs_verity_node_count;
read_unlock(&fs_verity_tree_lock);
xpm_log_info("cache dm count=%d, fs count=%d, cache size=%d KB\n", dm_count, fs_count, cache_size / 1024);
}
static void test_print_info(struct file *file, unsigned int type, const struct exec_file_signature_info *file_info)
{
char *full_path;
char path[PATH_MAX] = {0};
static int code_segment_test_count = 100;
int i;
code_segment_test_count--;
if (code_segment_test_count > 0)
return;
full_path = file_path(file, path, PATH_MAX - 1);
if (IS_ERR(full_path))
return;
for (i = 0; i < file_info->code_segment_count; i++)
xpm_log_info("%s -> type: %s, info: offset=0x%llx size=0x%lx\n",
full_path, type == FILE_SIGNATURE_DM_VERITY ? "dm" : "fs",
file_info->code_segments->file_offset, file_info->code_segments->size);
code_segment_test_count = 100;
}
#endif
static void rm_code_segment_info(void)
{
if (dm_verity_node_count + fs_verity_node_count < VERITY_NODE_CACHE_LIMITS)
return;
#ifdef CONFIG_SECURITY_XPM_DEBUG
test_printf_code_segment_cache_size();
#endif
if (dm_verity_node_count > fs_verity_node_count) {
write_lock(&dm_verity_tree_lock);
clear_code_segment_info_cache(&dm_verity_tree, &dm_verity_node_count);
write_unlock(&dm_verity_tree_lock);
return;
}
write_lock(&fs_verity_tree_lock);
clear_code_segment_info_cache(&fs_verity_tree, &fs_verity_node_count);
write_unlock(&fs_verity_tree_lock);
}
static int get_verity_info(int type, struct verity_info *verity)
{
if (type == FILE_SIGNATURE_DM_VERITY) {
verity->root = &dm_verity_tree;
verity->lock = &dm_verity_tree_lock;
verity->node_count = &dm_verity_node_count;
return 0;
}
if (type == FILE_SIGNATURE_FS_VERITY) {
verity->lock = &fs_verity_tree_lock;
verity->root = &fs_verity_tree;
verity->node_count = &fs_verity_node_count;
return 0;
}
return -EINVAL;
}
static void insert_new_signature_info(struct inode *file_node, int type,
struct verity_info *verity, struct exec_file_signature_info *new_info, struct exec_file_signature_info **old_info)
{
new_info->type = (unsigned int)type;
new_info->inode = (uintptr_t)file_node;
RB_CLEAR_NODE(&new_info->rb_node);
if ((*old_info) != NULL) {
write_lock(verity->lock);
if ((*old_info) != NULL) {
if (atomic_sub_return(1, &(*old_info)->reference) <= 0) {
rb_erase_node(verity->root, verity->node_count, *old_info);
(*old_info)->type |= FILE_SIGNATURE_DELETE;
kfree(*old_info);
*old_info = NULL;
}
}
write_unlock(verity->lock);
}
write_lock(verity->lock);
*old_info = rb_add_node(verity->root, verity->node_count, new_info);
write_unlock(verity->lock);
}
static int get_elf_code_segment_info(struct file *file, bool is_exec, int type,
struct exec_file_signature_info **code_segment_info)
{
int ret;
struct verity_info verity;
struct inode *file_node;
struct exec_file_signature_info *new_info;
struct exec_file_signature_info *old_info;
if (get_verity_info(type, &verity) < 0)
return -EINVAL;
file_node = file_inode(file);
if (file_node == NULL)
return -EINVAL;
read_lock(verity.lock);
old_info = rb_search_node(verity.root, (uintptr_t)file_node);
read_unlock(verity.lock);
if (old_info != NULL) {
if (is_exec && old_info->code_segments == NULL)
goto need_parse;
*code_segment_info = old_info;
return 0;
}
need_parse:
rm_code_segment_info();
if (!is_exec) {
new_info = kzalloc(sizeof(struct exec_file_signature_info), GFP_KERNEL);
if (new_info == NULL)
return -ENOMEM;
} else {
ret = parse_elf_code_segment_info(file, &new_info);
if (ret < 0) {
report_file_event(FORMAT_UNDEF, file);
return ret;
}
#ifdef CONFIG_SECURITY_XPM_DEBUG
test_print_info(file, type, new_info);
#endif
}
insert_new_signature_info(file_node, type, &verity, new_info, &old_info);
if (old_info != NULL) {
kfree(new_info);
new_info = old_info;
}
*code_segment_info = new_info;
return 0;
}
int get_exec_file_signature_info(struct file *file, bool is_exec,
struct exec_file_signature_info **info_ptr)
{
int type;
if (file == NULL || info_ptr == NULL)
return -EINVAL;
type = check_exec_file_is_verity(file, is_exec);
return get_elf_code_segment_info(file, is_exec, type, info_ptr);
}
int put_exec_file_signature_info(struct exec_file_signature_info *exec_info)
{
if ((exec_info == NULL) ||
!exec_file_signature_is_verity(exec_info))
return -EINVAL;
if (atomic_sub_return(1, &exec_info->reference) <= 0 &&
exec_file_signature_is_delete(exec_info))
kfree(exec_info);
return 0;
}
* caller can skip searching the other tree; false if not present.
*/
static bool elf_code_segment_info_delete(struct rb_root *root,
int *node_count, struct inode *file_node)
{
struct exec_file_signature_info *signature_info;
signature_info = rb_search_node(root, (uintptr_t)file_node);
if (signature_info == NULL)
return false;
rb_erase_node(root, node_count, signature_info);
if (atomic_sub_return(1, &signature_info->reference) > 0)
signature_info->type |= FILE_SIGNATURE_DELETE;
else
kfree(signature_info);
return true;
}
void delete_exec_file_signature_info(struct inode *file_node)
{
bool found;
if (file_node == NULL)
return;
write_lock(&fs_verity_tree_lock);
found = elf_code_segment_info_delete(&fs_verity_tree, &fs_verity_node_count, file_node);
write_unlock(&fs_verity_tree_lock);
if (found)
return;
write_lock(&dm_verity_tree_lock);
elf_code_segment_info_delete(&dm_verity_tree, &dm_verity_node_count, file_node);
write_unlock(&dm_verity_tree_lock);
}
