[RFC] mm: extend memfd with ability to create "secret" memory areas

Message ID	20200130162340.GA14232@rapoport-lnx (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=SaG1=3T=kvack.org=owner-linux-mm@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 54C7621734 Date: Thu, 30 Jan 2020 18:23:41 +0200 From: Mike Rapoport <rppt@kernel.org> To: linux-kernel@vger.kernel.org Cc: Alan Cox <alan@linux.intel.com>, Andrew Morton <akpm@linux-foundation.org>, Andy Lutomirski <luto@kernel.org>, Christopher Lameter <cl@linux.com>, Dave Hansen <dave.hansen@linux.intel.com>, James Bottomley <jejb@linux.ibm.com>, "Kirill A. Shutemov" <kirill@shutemov.name>, Matthew Wilcox <willy@infradead.org>, Peter Zijlstra <peterz@infradead.org>, "Reshetova, Elena" <elena.reshetova@intel.com>, Thomas Gleixner <tglx@linutronix.de>, Tycho Andersen <tycho@tycho.ws>, linux-api@vger.kernel.org, linux-mm@kvack.org Subject: [RFC PATCH] mm: extend memfd with ability to create "secret" memory areas Message-ID: <20200130162340.GA14232@rapoport-lnx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) Sender: owner-linux-mm@kvack.org Precedence: bulk
Series	[RFC] mm: extend memfd with ability to create "secret" memory areas \| expand [RFC] mm: extend memfd with ability to create "secret" memory areas

diff --git a/include/linux/memfd.h b/include/linux/memfd.h index 4f1600413f91..d3ca7285f51a 100644 --- a/include/linux/memfd.h +++ b/include/linux/memfd.h @@ -13,4 +13,13 @@ static inline long memfd_fcntl(struct file *f, unsigned int c, unsigned long a) } #endif +#ifdef CONFIG_MEMFD_SECRETMEM +extern struct file *secretmem_file_create(const char *name, unsigned int flags); +#else +static inline struct file *secretmem_file_create(const char *name, unsigned int flags) +{ + return ERR_PTR(-EINVAL); +} +#endif + #endif /* __LINUX_MEMFD_H */ diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h index 3ac436376d79..c0104e6da894 100644 --- a/include/uapi/linux/magic.h +++ b/include/uapi/linux/magic.h @@ -95,5 +95,6 @@ #define DMA_BUF_MAGIC 0x444d4142 /* "DMAB" */ #define Z3FOLD_MAGIC 0x33 #define PPC_CMM_MAGIC 0xc7571590 +#define SECRETMEM_MAGIC 0x5345434d /* "SECM" */ #endif /* __LINUX_MAGIC_H__ */ diff --git a/include/uapi/linux/memfd.h b/include/uapi/linux/memfd.h index 7a8a26751c23..3320a79b638d 100644 --- a/include/uapi/linux/memfd.h +++ b/include/uapi/linux/memfd.h @@ -8,6 +8,12 @@ #define MFD_CLOEXEC 0x0001U #define MFD_ALLOW_SEALING 0x0002U #define MFD_HUGETLB 0x0004U +#define MFD_SECRET 0x0008U + +/* ioctls for secret memory */ +#define MFD_SECRET_IOCTL '-' +#define MFD_SECRET_EXCLUSIVE _IOW(MFD_SECRET_IOCTL, 0x13, unsigned long) +#define MFD_SECRET_UNCACHED _IOW(MFD_SECRET_IOCTL, 0x14, unsigned long) /* * Huge page size encoding when MFD_HUGETLB is specified, and a huge page diff --git a/mm/Kconfig b/mm/Kconfig index ab80933be65f..2a8956d9048d 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -739,4 +739,8 @@ config ARCH_HAS_HUGEPD config MAPPING_DIRTY_HELPERS bool +config MEMFD_SECRETMEM + def_bool MEMFD_CREATE && ARCH_HAS_SET_DIRECT_MAP + + endmenu diff --git a/mm/Makefile b/mm/Makefile index 1937cc251883..9399e823ccdb 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -108,3 +108,4 @@ obj-$(CONFIG_ZONE_DEVICE) += memremap.o obj-$(CONFIG_HMM_MIRROR) += hmm.o obj-$(CONFIG_MEMFD_CREATE) += memfd.o obj-$(CONFIG_MAPPING_DIRTY_HELPERS) += mapping_dirty_helpers.o +obj-$(CONFIG_MEMFD_SECRETMEM) += secretmem.o diff --git a/mm/memfd.c b/mm/memfd.c index 2647c898990c..3e1cc37e0389 100644 --- a/mm/memfd.c +++ b/mm/memfd.c @@ -245,7 +245,8 @@ long memfd_fcntl(struct file *file, unsigned int cmd, unsigned long arg) #define MFD_NAME_PREFIX_LEN (sizeof(MFD_NAME_PREFIX) - 1) #define MFD_NAME_MAX_LEN (NAME_MAX - MFD_NAME_PREFIX_LEN) -#define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_HUGETLB) +#define MFD_SECRET_MASK (MFD_CLOEXEC | MFD_SECRET) +#define MFD_ALL_FLAGS (MFD_CLOEXEC | MFD_ALLOW_SEALING | MFD_HUGETLB | MFD_SECRET) SYSCALL_DEFINE2(memfd_create, const char __user *, uname, @@ -257,6 +258,9 @@ SYSCALL_DEFINE2(memfd_create, char *name; long len; + if (flags & ~(unsigned int)MFD_SECRET_MASK) + return -EINVAL; + if (!(flags & MFD_HUGETLB)) { if (flags & ~(unsigned int)MFD_ALL_FLAGS) return -EINVAL; @@ -296,7 +300,9 @@ SYSCALL_DEFINE2(memfd_create, goto err_name; } - if (flags & MFD_HUGETLB) { + if (flags & MFD_SECRET) { + file = secretmem_file_create(name, flags); + } else if (flags & MFD_HUGETLB) { struct user_struct *user = NULL; file = hugetlb_file_setup(name, 0, VM_NORESERVE, &user, diff --git a/mm/secretmem.c b/mm/secretmem.c new file mode 100644 index 000000000000..ac67a67aa29c --- /dev/null +++ b/mm/secretmem.c @@ -0,0 +1,244 @@ +// SPDX-License-Identifier: GPL-2.0 +#include <linux/mm.h> +#include <linux/fs.h> +#include <linux/mount.h> +#include <linux/memfd.h> +#include <linux/printk.h> +#include <linux/pagemap.h> +#include <linux/pseudo_fs.h> +#include <linux/set_memory.h> +#include <linux/sched/signal.h> + +#include <uapi/linux/memfd.h> +#include <uapi/linux/magic.h> + +#include <asm/tlbflush.h> + +#define SECRETMEM_EXCLUSIVE 0x1 +#define SECRETMEM_UNCACHED 0x2 + +struct secretmem_state { + unsigned int mode; + unsigned long nr_pages; +}; + +static struct page *secretmem_alloc_page(gfp_t gfp) +{ + /* + * FIXME: use a cache of large pages to reduce the direct map + * fragmentation + */ + return alloc_page(gfp); +} + +static int secretmem_check_limits(struct vm_fault *vmf) +{ + struct secretmem_state *state = vmf->vma->vm_file->private_data; + struct inode *inode = file_inode(vmf->vma->vm_file); + unsigned long limit; + + if (((loff_t)vmf->pgoff << PAGE_SHIFT) >= i_size_read(inode)) + return -EINVAL; + + limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + if (state->nr_pages + 1 >= limit) + return -EPERM; + + return 0; +} + +static vm_fault_t secretmem_fault(struct vm_fault *vmf) +{ + struct secretmem_state *state = vmf->vma->vm_file->private_data; + struct address_space *mapping = vmf->vma->vm_file->f_mapping; + pgoff_t offset = vmf->pgoff; + unsigned long addr; + struct page *page; + int ret; + + ret = secretmem_check_limits(vmf); + if (ret) + return vmf_error(ret); + + page = find_get_entry(mapping, offset); + if (!page) { + page = secretmem_alloc_page(vmf->gfp_mask); + if (!page) + return vmf_error(-ENOMEM); + + ret = add_to_page_cache_lru(page, mapping, offset, vmf->gfp_mask); + if (unlikely(ret)) { + put_page(page); + return vmf_error(ret); + } + + ret = set_direct_map_invalid_noflush(page); + if (ret) { + delete_from_page_cache(page); + return vmf_error(ret); + } + + addr = (unsigned long)page_address(page); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); + + __SetPageUptodate(page); + + state->nr_pages++; + ret = VM_FAULT_LOCKED; + } + + vmf->page = page; + return ret; +} + +static const struct vm_operations_struct secretmem_vm_ops = { + .fault = secretmem_fault, +}; + +static int secretmem_mmap(struct file *file, struct vm_area_struct *vma) +{ + struct secretmem_state *state = file->private_data; + unsigned long mode = state->mode; + + if (!mode) + return -EINVAL; + + switch (mode) { + case SECRETMEM_UNCACHED: + vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + /* fallthrough */ + case SECRETMEM_EXCLUSIVE: + vma->vm_ops = &secretmem_vm_ops; + break; + default: + return -EINVAL; + } + + return 0; +} + +static long secretmem_ioctl(struct file *file, unsigned cmd, unsigned long arg) +{ + struct secretmem_state *state = file->private_data; + unsigned long mode = state->mode; + + if (mode) + return -EINVAL; + + switch (cmd) { + case MFD_SECRET_EXCLUSIVE: + mode = SECRETMEM_EXCLUSIVE; + break; + case MFD_SECRET_UNCACHED: + mode = SECRETMEM_UNCACHED; + break; + default: + return -EINVAL; + } + + state->mode = mode; + + return 0; +} + +static int secretmem_release(struct inode *inode, struct file *file) +{ + struct secretmem_state *state = file->private_data; + + kfree(state); + + return 0; +} + +const struct file_operations secretmem_fops = { + .release = secretmem_release, + .mmap = secretmem_mmap, + .unlocked_ioctl = secretmem_ioctl, + .compat_ioctl = secretmem_ioctl, +}; + +static bool secretmem_isolate_page(struct page *page, isolate_mode_t mode) +{ + return false; +} + +static int secretmem_migratepage(struct address_space *mapping, + struct page *newpage, struct page *page, + enum migrate_mode mode) +{ + return -EBUSY; +} + +static void secretmem_freepage(struct page *page) +{ + set_direct_map_default_noflush(page); +} + +static const struct address_space_operations secretmem_aops = { + .freepage = secretmem_freepage, + .migratepage = secretmem_migratepage, + .isolate_page = secretmem_isolate_page, +}; + +static struct vfsmount *secretmem_mnt; + +struct file *secretmem_file_create(const char *name, unsigned int flags) +{ + struct inode *inode = alloc_anon_inode(secretmem_mnt->mnt_sb); + struct file *file = ERR_PTR(-ENOMEM); + struct secretmem_state *state; + + if (IS_ERR(inode)) + return ERR_CAST(inode); + + state = kzalloc(sizeof(*state), GFP_KERNEL); + if (!state) + goto err_free_inode; + + file = alloc_file_pseudo(inode, secretmem_mnt, "secretmem", + O_RDWR, &secretmem_fops); + if (IS_ERR(file)) + goto err_free_state; + + mapping_set_unevictable(inode->i_mapping); + + inode->i_mapping->private_data = state; + inode->i_mapping->a_ops = &secretmem_aops; + + /* pretend we are a normal file with zero size */ + inode->i_mode |= S_IFREG; + inode->i_size = 0; + + file->private_data = state; + + return file; + +err_free_state: + kfree(state); +err_free_inode: + iput(inode); + return file; +} + +static int secretmem_init_fs_context(struct fs_context *fc) +{ + return init_pseudo(fc, SECRETMEM_MAGIC) ? 0 : -ENOMEM; +} + +static struct file_system_type secretmem_fs = { + .name = "secretmem", + .init_fs_context = secretmem_init_fs_context, + .kill_sb = kill_anon_super, +}; + +static int secretmem_init(void) +{ + int ret = 0; + + secretmem_mnt = kern_mount(&secretmem_fs); + if (IS_ERR(secretmem_mnt)) + ret = PTR_ERR(secretmem_mnt); + + return ret; +} +fs_initcall(secretmem_init);

[RFC] mm: extend memfd with ability to create "secret" memory areas

Commit Message

Comments

Patch