{"id":2221444,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2221444/?format=json","web_url":"http://patchwork.ozlabs.org/project/linux-ext4/patch/20260409131404.1545834-11-aalbersh@kernel.org/","project":{"id":8,"url":"http://patchwork.ozlabs.org/api/1.2/projects/8/?format=json","name":"Linux ext4 filesystem development","link_name":"linux-ext4","list_id":"linux-ext4.vger.kernel.org","list_email":"linux-ext4@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260409131404.1545834-11-aalbersh@kernel.org>","list_archive_url":null,"date":"2026-04-09T13:13:42","name":"[v7,10/22] xfs: introduce fsverity on-disk changes","commit_ref":null,"pull_url":null,"state":"not-applicable","archived":false,"hash":"86d5bbbce1ef17fc116bc4f28bae72a704cabca7","submitter":{"id":92821,"url":"http://patchwork.ozlabs.org/api/1.2/people/92821/?format=json","name":"Andrey Albershteyn","email":"aalbersh@kernel.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/linux-ext4/patch/20260409131404.1545834-11-aalbersh@kernel.org/mbox/","series":[{"id":499292,"url":"http://patchwork.ozlabs.org/api/1.2/series/499292/?format=json","web_url":"http://patchwork.ozlabs.org/project/linux-ext4/list/?series=499292","date":"2026-04-09T13:13:34","name":"fs-verity support for XFS with post EOF merkle tree","version":7,"mbox":"http://patchwork.ozlabs.org/series/499292/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221444/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221444/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linux-ext4@vger.kernel.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","patchwork-incoming@ozlabs.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=B9A8HZ/z;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org\n (client-ip=2404:9400:2221:ea00::3; helo=mail.ozlabs.org;\n envelope-from=srs0=0lwr=ci=vger.kernel.org=linux-ext4+bounces-15707-patchwork-incoming=ozlabs.org@ozlabs.org;\n receiver=patchwork.ozlabs.org)","gandalf.ozlabs.org;\n arc=pass smtp.remote-ip=\"2600:3c09:e001:a7::12fc:5321\"\n arc.chain=subspace.kernel.org","gandalf.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=kernel.org","gandalf.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=B9A8HZ/z;\n\tdkim-atps=neutral","gandalf.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=linux-ext4+bounces-15707-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=\"B9A8HZ/z\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201"],"Received":["from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fs0qN58Gnz1yCv\n\tfor ; Thu, 09 Apr 2026 23:18:08 +1000 (AEST)","from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3])\n\tby gandalf.ozlabs.org (Postfix) with ESMTP id 4fs0qN4ghBz4wL4\n\tfor ; Thu, 09 Apr 2026 23:18:08 +1000 (AEST)","by gandalf.ozlabs.org (Postfix)\n\tid 4fs0qN4Zk7z4wSp; Thu, 09 Apr 2026 23:18:08 +1000 (AEST)","from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby gandalf.ozlabs.org (Postfix) with ESMTPS id 4fs0qK0NvZz4wL4\n\tfor ; Thu, 09 Apr 2026 23:18:05 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 71F6830327AC\n\tfor ; Thu, 9 Apr 2026 13:16:30 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 7F0C53D3336;\n\tThu, 9 Apr 2026 13:14:41 +0000 (UTC)","from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id EDA863D332E;\n\tThu, 9 Apr 2026 13:14:40 +0000 (UTC)","by smtp.kernel.org (Postfix) with ESMTPSA id 3191EC4CEF7;\n\tThu, 9 Apr 2026 13:14:37 +0000 (UTC)"],"ARC-Seal":["i=2; a=rsa-sha256; d=ozlabs.org; s=201707; t=1775740688; cv=pass;\n\tb=L0FmUrQ/9Rnl1LO32k9SfqP6uEhnXaOmUTK2BtNeNMkbvCqBoEsDYz+u6lwEMQPaVas/WGKRYdnJX1W+5TUnCUrK4AQzgKCWXFlpxhdPLZlz7xHTFW9kQVGoq1eN4HHRfO9GIT0+LUzKLIN3WqiHJLWDFNTrUHFaNF1sx7/ujdw3nNf27Pkofj/jYmD0tpSzmPTcxmbqwkg+GNpKXESA1pDX9NcEIAPXS+WqIFjwjz2taJ8Akoax9br3JAvJI4q8xIFOZpj7SQWZ0PaRS7WIMnuJi5Z4S5m/EoKlbqJh8HQs6IQMF6UWZmhtm51NxqEYatzyQU75DS1ACOaLwwp9vg==","i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775740481; cv=none;\n b=b9eNOKDigaxKrTe9XFA86tcI6Z7L6KCkdh+rt+QdyV1cR1YhUW6s7rdQNGY8ieHP66DKS4g0mQWuGpxEwr25ATrGzssYDuzp1ddBbPxYosiSUg54XEJyKRhwYTio8L4LaToGPcXK0hoC4HeNglkZPn4CxiFXVYHkEh9oH7I0Y3E="],"ARC-Message-Signature":["i=2; a=rsa-sha256; d=ozlabs.org; s=201707;\n\tt=1775740688; c=relaxed/relaxed;\n\tbh=Q3hmgI8RXPzpZone4UiYjY5KNRPlAEbrOVp2LgcEy6U=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version:Content-Type;\n b=humkGXCe/BsPKBu/1HiHotJMmPyJ+AuGH/xSfsLfobGY/YE5ramdNGKDuh4HY6ppI0MatmsdmJ+cVQn1NVh+T2ai9ycwdMNcGW17Ikx1HsZtnGJSPcMVsPh74wbs86rSC0qzndrE3meOJfVVS9NcHT5M5c7fTwbikEddhBQTqAXNa1WN1XGfPimCKfBODGw30CGJuukUaDTHEemfvpkMpGBf9cHLU3vUTg2Sb+rljZvLDWDX9VdVJ1dEXp3ARGY55Mkuqb8WOfOSJ1q44RqBXP1rDuVBjY+WTrhsOOWybFUjrxHtjjkLOuH/6lElKZo6kREc7wn5K0j5lNiDQoW+ag==","i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775740481; c=relaxed/simple;\n\tbh=RZTePcZL49YR0MAouenDsHNhMRyMiw3LC4VY3V7qjps=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version:Content-Type;\n b=ptNsJGIofcE0NMnBfHg8ZqjIUqtfydLYy8cbpjLudhOgaWIZvHOZ6kK0FJ6L5EOiBngyfUHyJKIVdto8dMSBHXqaldpsrpLwGS/yZ11T6ypv4DEurTHclbYaW7xwl/Cp9cme1KIL0PnHqQyJAIQlev9n4QFsoLdP4F5RUu1wSb8="],"ARC-Authentication-Results":["i=2; gandalf.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=kernel.org;\n dkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=B9A8HZ/z; dkim-atps=neutral;\n spf=pass (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=linux-ext4+bounces-15707-patchwork-incoming=ozlabs.org@vger.kernel.org;\n receiver=ozlabs.org) smtp.mailfrom=vger.kernel.org","i=1; smtp.subspace.kernel.org;\n dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=B9A8HZ/z; arc=none smtp.client-ip=10.30.226.201"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;\n\ts=k20201202; t=1775740480;\n\tbh=RZTePcZL49YR0MAouenDsHNhMRyMiw3LC4VY3V7qjps=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=B9A8HZ/zF58xY1fXzQPPIPs5036vmr+EULEUuKCo+xoifAgEhbWXC3g62ljYJDfci\n\t E77OJTvfNkaQN+hEPkqolF/rMP03dMPDgKQVV5r0oH8rFBX0MiBARPLxr0MM9rzY1p\n\t 89dFyVFTI5fl33vura+8RcwGnztuPanw8TB5Od2xqyv7f9INvyOYlnVgE6xLu8/2Fj\n\t y1JqMVRML4er53qnGsDNbuF8oIEHVYHFFEH24aePeGiY8s+wEI6GLt8x+x4Yu1x28u\n\t eoLcv471l+Y1Wzbcr/Dg0fbxfm2C4oIz+Ctk+n5i6FKowqMj5jBoo9OToj1mfyxhLW\n\t E1EMyPio+/OrQ==","From":"Andrey Albershteyn ","To":"linux-xfs@vger.kernel.org,\n\tfsverity@lists.linux.dev,\n\tlinux-fsdevel@vger.kernel.org,\n\tebiggers@kernel.org","Cc":"Andrey Albershteyn ,\n\thch@lst.de,\n\tlinux-ext4@vger.kernel.org,\n\tlinux-f2fs-devel@lists.sourceforge.net,\n\tlinux-btrfs@vger.kernel.org,\n\tdjwong@kernel.org","Subject":"[PATCH v7 10/22] xfs: introduce fsverity on-disk changes","Date":"Thu, 9 Apr 2026 15:13:42 +0200","Message-ID":"<20260409131404.1545834-11-aalbersh@kernel.org>","X-Mailer":"git-send-email 2.51.2","In-Reply-To":"<20260409131404.1545834-1-aalbersh@kernel.org>","References":"<20260409131404.1545834-1-aalbersh@kernel.org>","Precedence":"bulk","X-Mailing-List":"linux-ext4@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"8bit","X-Spam-Status":"No, score=-1.2 required=5.0 tests=ARC_SIGNED,ARC_VALID,\n\tDKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,\n\tMAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=disabled\n\tversion=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on gandalf.ozlabs.org"},"content":"Introduce XFS_DIFLAG2_VERITY for inodes with fsverity. This flag\nindicates that inode has fs-verity enabled (i.e. descriptor exist,\ntree is built and file is read-only).\n\nIntroduce XFS_SB_FEAT_RO_COMPAT_VERITY for filesystems having\nfsverity inodes. As on-disk changes applies to fsverity inodes only, let\nolder kernels read-only access. This will be enabled in the further\npatch after full fsverity support.\n\nReviewed-by: Darrick J. Wong \nReviewed-by: Christoph Hellwig \nSigned-off-by: Andrey Albershteyn \n---\n fs/xfs/libxfs/xfs_format.h | 30 +++++++++++++++++++++++++++++-\n fs/xfs/libxfs/xfs_inode_buf.c | 8 ++++++++\n fs/xfs/libxfs/xfs_inode_util.c | 2 ++\n fs/xfs/libxfs/xfs_sb.c | 2 ++\n fs/xfs/xfs_iops.c | 2 ++\n fs/xfs/xfs_mount.h | 2 ++\n 6 files changed, 45 insertions(+), 1 deletion(-)","diff":"diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h\nindex 779dac59b1f3..4dff29659e40 100644\n--- a/fs/xfs/libxfs/xfs_format.h\n+++ b/fs/xfs/libxfs/xfs_format.h\n@@ -374,6 +374,7 @@ xfs_sb_has_compat_feature(\n #define XFS_SB_FEAT_RO_COMPAT_RMAPBT (1 << 1)\t\t/* reverse map btree */\n #define XFS_SB_FEAT_RO_COMPAT_REFLINK (1 << 2)\t\t/* reflinked files */\n #define XFS_SB_FEAT_RO_COMPAT_INOBTCNT (1 << 3)\t\t/* inobt block counts */\n+#define XFS_SB_FEAT_RO_COMPAT_VERITY (1 << 4)\t\t/* fs-verity */\n #define XFS_SB_FEAT_RO_COMPAT_ALL \\\n \t\t(XFS_SB_FEAT_RO_COMPAT_FINOBT | \\\n \t\t XFS_SB_FEAT_RO_COMPAT_RMAPBT | \\\n@@ -1230,16 +1231,21 @@ static inline void xfs_dinode_put_rdev(struct xfs_dinode *dip, xfs_dev_t rdev)\n */\n #define XFS_DIFLAG2_METADATA_BIT\t5\n \n+/* inodes sealed with fs-verity */\n+#define XFS_DIFLAG2_VERITY_BIT\t\t6\n+\n #define XFS_DIFLAG2_DAX\t\t(1ULL << XFS_DIFLAG2_DAX_BIT)\n #define XFS_DIFLAG2_REFLINK\t(1ULL << XFS_DIFLAG2_REFLINK_BIT)\n #define XFS_DIFLAG2_COWEXTSIZE\t(1ULL << XFS_DIFLAG2_COWEXTSIZE_BIT)\n #define XFS_DIFLAG2_BIGTIME\t(1ULL << XFS_DIFLAG2_BIGTIME_BIT)\n #define XFS_DIFLAG2_NREXT64\t(1ULL << XFS_DIFLAG2_NREXT64_BIT)\n #define XFS_DIFLAG2_METADATA\t(1ULL << XFS_DIFLAG2_METADATA_BIT)\n+#define XFS_DIFLAG2_VERITY\t(1ULL << XFS_DIFLAG2_VERITY_BIT)\n \n #define XFS_DIFLAG2_ANY \\\n \t(XFS_DIFLAG2_DAX | XFS_DIFLAG2_REFLINK | XFS_DIFLAG2_COWEXTSIZE | \\\n-\t XFS_DIFLAG2_BIGTIME | XFS_DIFLAG2_NREXT64 | XFS_DIFLAG2_METADATA)\n+\t XFS_DIFLAG2_BIGTIME | XFS_DIFLAG2_NREXT64 | XFS_DIFLAG2_METADATA | \\\n+\t XFS_DIFLAG2_VERITY)\n \n static inline bool xfs_dinode_has_bigtime(const struct xfs_dinode *dip)\n {\n@@ -2021,4 +2027,26 @@ struct xfs_acl {\n #define SGI_ACL_FILE_SIZE\t(sizeof(SGI_ACL_FILE)-1)\n #define SGI_ACL_DEFAULT_SIZE\t(sizeof(SGI_ACL_DEFAULT)-1)\n \n+/*\n+ * At maximum of 8 levels with 128 hashes per block (32 bytes SHA-256) maximum\n+ * tree size is ((128^8 − 1)/(128 − 1)) = 567*10^12 blocks. This should fit in\n+ * 53 bits address space.\n+ *\n+ * At this Merkle tree size we can cover 295EB large file. This is much larger\n+ * than the currently supported file size.\n+ *\n+ * For sha512 the largest file we can cover ends at 1 << 50 offset, this is also\n+ * good.\n+ */\n+#define XFS_FSVERITY_LARGEST_FILE\t((loff_t)1ULL << 53)\n+\n+/*\n+ * Alignment of the fsverity metadata placement. This is largest supported PAGE\n+ * SIZE for fsverity. This is used to space out data and metadata in page cache.\n+ * The spacing is necessary for non-exposure of metadata to userspace and\n+ * correct merkle tree synethesis in the iomap.\n+ */\n+#define XFS_FSVERITY_START_ALIGN\t(65536)\n+\n+\n #endif /* __XFS_FORMAT_H__ */\ndiff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c\nindex 3794e5412eba..f2181c1bed54 100644\n--- a/fs/xfs/libxfs/xfs_inode_buf.c\n+++ b/fs/xfs/libxfs/xfs_inode_buf.c\n@@ -760,6 +760,14 @@ xfs_dinode_verify(\n \t !xfs_has_rtreflink(mp))\n \t\treturn __this_address;\n \n+\t/* only regular files can have fsverity */\n+\tif (flags2 & XFS_DIFLAG2_VERITY) {\n+\t\tif (!xfs_has_verity(mp))\n+\t\t\treturn __this_address;\n+\t\tif (!S_ISREG(mode))\n+\t\t\treturn __this_address;\n+\t}\n+\n \tif (xfs_has_zoned(mp) &&\n \t dip->di_metatype == cpu_to_be16(XFS_METAFILE_RTRMAP)) {\n \t\tif (be32_to_cpu(dip->di_used_blocks) > mp->m_sb.sb_rgextents)\ndiff --git a/fs/xfs/libxfs/xfs_inode_util.c b/fs/xfs/libxfs/xfs_inode_util.c\nindex 551fa51befb6..6b1e20a4bb9b 100644\n--- a/fs/xfs/libxfs/xfs_inode_util.c\n+++ b/fs/xfs/libxfs/xfs_inode_util.c\n@@ -126,6 +126,8 @@ xfs_ip2xflags(\n \t\t\tflags |= FS_XFLAG_DAX;\n \t\tif (ip->i_diflags2 & XFS_DIFLAG2_COWEXTSIZE)\n \t\t\tflags |= FS_XFLAG_COWEXTSIZE;\n+\t\tif (ip->i_diflags2 & XFS_DIFLAG2_VERITY)\n+\t\t\tflags |= FS_XFLAG_VERITY;\n \t}\n \n \tif (xfs_inode_has_attr_fork(ip))\ndiff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c\nindex 47322adb7690..a15510ebd2f1 100644\n--- a/fs/xfs/libxfs/xfs_sb.c\n+++ b/fs/xfs/libxfs/xfs_sb.c\n@@ -165,6 +165,8 @@ xfs_sb_version_to_features(\n \t\tfeatures |= XFS_FEAT_REFLINK;\n \tif (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_INOBTCNT)\n \t\tfeatures |= XFS_FEAT_INOBTCNT;\n+\tif (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_VERITY)\n+\t\tfeatures |= XFS_FEAT_VERITY;\n \tif (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_FTYPE)\n \t\tfeatures |= XFS_FEAT_FTYPE;\n \tif (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_SPINODES)\ndiff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c\nindex 208543e57eda..ca369eb96561 100644\n--- a/fs/xfs/xfs_iops.c\n+++ b/fs/xfs/xfs_iops.c\n@@ -1415,6 +1415,8 @@ xfs_diflags_to_iflags(\n \t\tflags |= S_NOATIME;\n \tif (init && xfs_inode_should_enable_dax(ip))\n \t\tflags |= S_DAX;\n+\tif (xflags & FS_XFLAG_VERITY)\n+\t\tflags |= S_VERITY;\n \n \t/*\n \t * S_DAX can only be set during inode initialization and is never set by\ndiff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h\nindex ddd4028be8d6..07f6aa3c3f26 100644\n--- a/fs/xfs/xfs_mount.h\n+++ b/fs/xfs/xfs_mount.h\n@@ -385,6 +385,7 @@ typedef struct xfs_mount {\n #define XFS_FEAT_EXCHANGE_RANGE\t(1ULL << 27)\t/* exchange range */\n #define XFS_FEAT_METADIR\t(1ULL << 28)\t/* metadata directory tree */\n #define XFS_FEAT_ZONED\t\t(1ULL << 29)\t/* zoned RT device */\n+#define XFS_FEAT_VERITY\t\t(1ULL << 30)\t/* fs-verity */\n \n /* Mount features */\n #define XFS_FEAT_NOLIFETIME\t(1ULL << 47)\t/* disable lifetime hints */\n@@ -442,6 +443,7 @@ __XFS_HAS_FEAT(exchange_range, EXCHANGE_RANGE)\n __XFS_HAS_FEAT(metadir, METADIR)\n __XFS_HAS_FEAT(zoned, ZONED)\n __XFS_HAS_FEAT(nolifetime, NOLIFETIME)\n+__XFS_HAS_FEAT(verity, VERITY)\n \n static inline bool xfs_has_rtgroups(const struct xfs_mount *mp)\n {\n","prefixes":["v7","10/22"]}