/*
 * Copyright (C) 2015 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#pragma once

#include <stdbool.h>

#if BUILD_STORAGE_TEST
#define FULL_ASSERT 1
#else
#define FULL_ASSERT 0
#endif
#if FULL_ASSERT
#define full_assert assert
#else
#define full_assert(x) \
    do {               \
    } while (0)
#endif

#include "block_mac.h"
#include "block_set.h"
#include "block_tree.h"

/**
 * struct super_block_backup - Backup of root block for file system state
 * @flags:          Super-block flags for the backup, with the bits in
 *                  SUPER_BLOCK_VERSION_MASK set to 0 (i.e. the backup does not
 *                  contain a version).
 * @free:           Block and mac of backup free set root node.
 * @files:          Block and mac of backup files tree root node.
 * @checkpoint:     Block and mac of the backup checkpoint metadata block, if
 *                  any.
 *
 * Block numbers and macs in @free and @files are packed as indicated by
 * @block_num_size and @mac_size, but unlike other on-disk data, the size of the
 * whole field is always the full 24 bytes needed for a 8 byte block number and
 * 16 byte mac so this structure is always a fixed size.
 */
struct super_block_backup {
    uint32_t flags;
    struct block_mac free;
    struct block_mac files;
    struct block_mac checkpoint;
};
STATIC_ASSERT(sizeof(struct super_block_backup) == 76);

/**
 * struct fs - File system state
 * @node:                           List node for fs_list.
 * @dev:                            Main block device.
 * @transactions:                   Transaction list.
 * @allocated:                      List of block sets containing blocks
 *                                  allocated by active transactions.
 * @free:                           Block set of free blocks.
 * @files:                          B+ tree of all files.
 * @checkpoint:                     Block and mac of the latest committed
 *                                  checkpoint metadata. Points to a block that
 *                                  holds the files root and free set at the
 *                                  time of the most recent checkpoint.
 * @checkpoint_free:                Block set of free blocks at the time of the
 *                                  last committed checkpoint. A block is only
 *                                  free if it is in both @free and
 *                                  @checkpoint_free.
 * @super_dev:                      Block device used to store super blocks.
 * @readable:                       %true if the file system is initialized and
 *                                  readable. If false, no reads are valid and
 *                                  @writable must be %false.
 * @writable:                       %true if the file system may be modified. If
 *                                  %false, filesystem contents may be readable,
 *                                  but no superblock or block changes are
 *                                  permitted.
 * @allow_tampering:                %false if the filesystem must detect
 *                                  tampering of read and write operations.
 *                                  %true otherwise. If %false, when a write
 *                                  operation is reported as successfully
 *                                  completed it should not be possible for
 *                                  non-secure code to modify the stored data.
 * @key:                            Key to use for encrypt, decrypt and mac.
 * @super_block:                    Block numbers in @super_dev to store
 *                                  super-block in.
 * @super_block_version:            Last read or written super block version.
 * @written_super_block_version:    Last written super block version.
 * @main_repaired:                  %true if main file system has been repaired
 *                                  since being wiped. In alternate state only
 *                                  used to persist this flag in the super
 *                                  block.
 * @alternate_data:                 If true, the current superblock is for a
 *                                  filesystem with a backing store in an
 *                                  alternate data location and @backup contains
 *                                  the superblock of the normal filesystem. If
 *                                  false, @backup may contain a backup of the
 *                                  superblock for an alternate filesystem, but
 *                                  it may be outdated.
 * @needs_full_scan:                %true if an error was detected in this file
 *                                  system data and the file system should be
 *                                  scanned on the next mount. Persisted to the
 *                                  super block so that we can initiate a scan
 *                                  the next time we mount the file system.
 * @checkpoint_required:            %true if a checkpoint must be created before
 *                                  committing any changes to the file system.
 * @backup:                         Backup superblock of other filesystem state
 *                                  (alternate if @alternate_data is false, main
 *                                  otherwise) Should be preserved across all
 *                                  filesystem operations after initialization.
 * @min_block_num:                  First block number that can store non
 *                                  super blocks.
 * @block_num_size:                 Number of bytes used to store block numbers.
 * @mac_size:                       Number of bytes used to store mac values.
 *                                  Must be 16 if @dev is not tamper_detecting.
 * @reserved_count:                 Number of free blocks reserved for active
 *                                  transactions.
 * @initial_super_block_tr:         Internal transaction containing initial
 *                                  super block that must be written before any
 *                                  other data. If %NULL superblock is already
 *                                  a safe state.
 * @name:                           File system name, used to identify the file
 *                                  system in debugging and error reporting
 *                                  messages.
 */

struct fs {
    struct list_node node;
    struct block_device* dev;
    struct list_node transactions;
    struct list_node allocated;
    struct block_set free;
    struct block_tree files;
    struct block_mac checkpoint;
    struct block_set checkpoint_free;
    struct block_device* super_dev;
    bool readable;
    bool writable;
    bool allow_tampering;
    const struct key* key;
    data_block_t super_block[2];
    unsigned int super_block_version;
    unsigned int written_super_block_version;
    bool main_repaired;
    bool alternate_data;
    bool needs_full_scan;
    bool checkpoint_required;
    struct super_block_backup backup;
    data_block_t min_block_num;
    size_t block_num_size;
    size_t mac_size;
    data_block_t reserved_count;
    struct transaction* initial_super_block_tr;
    const char* name;
};

bool update_super_block(struct transaction* tr,
                        const struct block_mac* free,
                        const struct block_mac* files,
                        const struct block_mac* checkpoint);

void fs_mark_scan_required(struct fs* fs);

/**
 * typedef fs_init_flags32_t - Flags that control filesystem clearing and
 * backups. These flags may be ORed together.
 *
 * %FS_INIT_FLAGS_NONE
 *   No flags set
 *
 * %FS_INIT_FLAGS_DO_CLEAR
 *   Unconditionally clear the filesystem, regardless of corruption state.
 *   %FS_INIT_FLAGS_RECOVERY_* flags are ignored when combined with this flag.
 *
 * %FS_INIT_FLAGS_RECOVERY_CLEAR_ALLOWED
 *   Allows clearing of corrupt filesystem.
 *
 * %FS_INIT_FLAGS_ALTERNATE_DATA
 *   Indicates that the filesystem is temporarily running on top of an alternate
 *   location for the @dev block device and rollback should be enforced
 *   separately from the normal mode.
 *
 * %FS_INIT_FLAGS_ALLOW_TAMPERING
 *   Allow this filesystem to be initialized with the super block not stored on
 *   a tamper-detecting block device. This filesystem WILL NOT detect any
 *   tampering and a malicious actor may arbitrarily roll it back to any
 *   previous state.
 *
 * %FS_INIT_FLAGS_RESTORE_CHECKPOINT
 *   Restore this filesystem to the current checkpointed state, discarding any
 *   changes since that checkpoint was made.
 *
 * %FS_INIT_FLAGS_AUTO_CHECKPOINT
 *   Automatically create a checkpoint of the filesystem state on mount.
 */
typedef uint32_t fs_init_flags32_t;
#define FS_INIT_FLAGS_NONE 0U
#define FS_INIT_FLAGS_DO_CLEAR (1U << 0)
#define FS_INIT_FLAGS_RECOVERY_CLEAR_ALLOWED (1U << 1)
#define FS_INIT_FLAGS_ALTERNATE_DATA (1U << 2)
#define FS_INIT_FLAGS_ALLOW_TAMPERING (1U << 3)
#define FS_INIT_FLAGS_RESTORE_CHECKPOINT (1U << 4)
#define FS_INIT_FLAGS_AUTO_CHECKPOINT (1U << 5)
#define FS_INIT_FLAGS_MASK                                           \
    (FS_INIT_FLAGS_DO_CLEAR | FS_INIT_FLAGS_RECOVERY_CLEAR_ALLOWED | \
     FS_INIT_FLAGS_ALTERNATE_DATA | FS_INIT_FLAGS_ALLOW_TAMPERING |  \
     FS_INIT_FLAGS_RESTORE_CHECKPOINT | FS_INIT_FLAGS_AUTO_CHECKPOINT)

int fs_init(struct fs* fs,
            const char* name,
            const struct key* key,
            struct block_device* dev,
            struct block_device* super_dev,
            fs_init_flags32_t flags);

static inline bool fs_is_repaired(struct fs* fs) {
    return fs->main_repaired && !fs->alternate_data;
}

static inline bool fs_is_readable(struct fs* fs) {
    return fs->readable;
}

static inline bool fs_is_writable(struct fs* fs) {
    return fs->writable;
}

/**
 * enum fs_check_result - Result of a filesystem check
 * @FS_CHECK_NO_ERROR:      No error was enountered in the checked blocks.
 * @FS_CHECK_INVALID_BLOCK: A MAC mismatch error or invalid block was
 *                          encountered while trying to load a block in the
 *                          file-system. This type of error may indicate that
 *                          the non-secure data is out of sync with the RPMB
 *                          superblock. The file-system is likely corrupt.
 * @FS_CHECK_INVALID_FREE_SET:  The free set was not internally valid or invalid
 *                              blocks were encountered in the free set tree.
 * @FS_CHECK_INVALID_FILE_TREE: The file tree was not internally valid but no
 *                              invalid blocks were encountered.
 * @FS_CHECK_UNKNOWN:       An unknown error was encountered while checking the
 *                          file-system. The file-system may not be entirely
 *                          readable or valid.
 */
enum fs_check_result {
    FS_CHECK_NO_ERROR = 0,
    FS_CHECK_INVALID_BLOCK,
    FS_CHECK_INVALID_FREE_SET,
    FS_CHECK_INVALID_FILE_TREE,
    FS_CHECK_UNKNOWN,
};

/**
 * fs_check_full - Check the file system tree
 * @fs:                    File system state object.
 *
 * Walk the filesystem tree and visit each file, checking the file tree and each
 * file block map for consistency.
 *
 * Returns @fs_check_result.FS_CHECK_NO_ERROR if no corruption was encountered
 * or any encountered corruption was repaired. Returns another @fs_check_result
 * variant describing the error if the filesystem remains corrupted after this
 * operation. Errors are prioritized in the following order (highest to lowest):
 * %FS_CHECK_INVALID_BLOCK (except in the free set, which is reported
 * separately), %FS_CHECK_INVALID_FILE_TREE, %FS_CHECK_INVALID_FREE_SET,
 * %FS_CHECK_UNKNOWN. This ordering is intended to allow callers to
 * differentiate between invalid blocks that indicate corruption and possibly
 * transient communication errors with the storage proxy.
 */
enum fs_check_result fs_check_full(struct fs* fs);

/**
 * fs_check_quick - Quickly check the file-system tree
 * @fs:                    File system state object.
 *
 * Perform a basic check that the file-system roots are valid. Suitable for use
 * while mounting file-systems where we don't want to pay the cost to walk the
 * entire file-system tree.
 *
 * Returns @fs_check_result.FS_CHECK_NO_ERROR if no corruption was encountered,
 * or another @fs_check_result variant describing the error.
 */
enum fs_check_result fs_check_quick(struct fs* fs);

/**
 * fs_check - Check the file system tree
 * @fs:                    File system state object.
 *
 * If the filesystem was not previously marked as requiring a full scan, perform
 * a quick check (i.e. behave the same as fs_check_quick()). If the file system
 * has been marked as potentially having an error, do a full scan using
 * fs_check_full().
 *
 * Returns an @fs_check_result variant, see fs_check_quick() and fs_check_full()
 * for details.
 */
enum fs_check_result fs_check(struct fs* fs);

void fs_file_tree_init(const struct fs* fs, struct block_tree* tree);

void fs_unknown_super_block_state_all(void);
void write_current_super_block(struct fs* fs, bool reinitialize);

void fs_destroy(struct fs* fs);

/**
 * fs_fail_all_transactions - Fail all pending transactions in all filesystems
 *
 * This functions fails any pending transactions that have not already failed.
 */
void fs_fail_all_transactions(void);