[linux.git] / mm / secretmem.c

// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright IBM Corporation, 2021
 *
 * Author: Mike Rapoport <[email protected]>
 */

#include <linux/mm.h>
#include <linux/fs.h>
#include <linux/swap.h>
#include <linux/mount.h>
#include <linux/memfd.h>
#include <linux/bitops.h>
#include <linux/printk.h>
#include <linux/pagemap.h>
#include <linux/syscalls.h>
#include <linux/pseudo_fs.h>
#include <linux/secretmem.h>
#include <linux/set_memory.h>
#include <linux/sched/signal.h>

#include <uapi/linux/magic.h>

#include <asm/tlbflush.h>

#include "internal.h"

#undef pr_fmt
#define pr_fmt(fmt) "secretmem: " fmt

/*
 * Define mode and flag masks to allow validation of the system call
 * parameters.
 */
#define SECRETMEM_MODE_MASK	(0x0)
#define SECRETMEM_FLAGS_MASK	SECRETMEM_MODE_MASK

static bool secretmem_enable __ro_after_init = 1;
module_param_named(enable, secretmem_enable, bool, 0400);
MODULE_PARM_DESC(secretmem_enable,
		 "Enable secretmem and memfd_secret(2) system call");

static atomic_t secretmem_users;

bool secretmem_active(void)
{
	return !!atomic_read(&secretmem_users);
}

static vm_fault_t secretmem_fault(struct vm_fault *vmf)
{
	struct address_space *mapping = vmf->vma->vm_file->f_mapping;
	struct inode *inode = file_inode(vmf->vma->vm_file);
	pgoff_t offset = vmf->pgoff;
	gfp_t gfp = vmf->gfp_mask;
	unsigned long addr;
	struct page *page;
	struct folio *folio;
	vm_fault_t ret;
	int err;

	if (((loff_t)vmf->pgoff << PAGE_SHIFT) >= i_size_read(inode))
		return vmf_error(-EINVAL);

	filemap_invalidate_lock_shared(mapping);

retry:
	page = find_lock_page(mapping, offset);
	if (!page) {
		folio = folio_alloc(gfp | __GFP_ZERO, 0);
		if (!folio) {
			ret = VM_FAULT_OOM;
			goto out;
		}

		page = &folio->page;
		err = set_direct_map_invalid_noflush(page);
		if (err) {
			folio_put(folio);
			ret = vmf_error(err);
			goto out;
		}

		__folio_mark_uptodate(folio);
		err = filemap_add_folio(mapping, folio, offset, gfp);
		if (unlikely(err)) {
			folio_put(folio);
			/*
			 * If a split of large page was required, it
			 * already happened when we marked the page invalid
			 * which guarantees that this call won't fail
			 */
			set_direct_map_default_noflush(page);
			if (err == -EEXIST)
				goto retry;

			ret = vmf_error(err);
			goto out;
		}

		addr = (unsigned long)page_address(page);
		flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
	}

	vmf->page = page;
	ret = VM_FAULT_LOCKED;

out:
	filemap_invalidate_unlock_shared(mapping);
	return ret;
}

static const struct vm_operations_struct secretmem_vm_ops = {
	.fault = secretmem_fault,
};

static int secretmem_release(struct inode *inode, struct file *file)
{
	atomic_dec(&secretmem_users);
	return 0;
}

static int secretmem_mmap(struct file *file, struct vm_area_struct *vma)
{
	unsigned long len = vma->vm_end - vma->vm_start;

	if ((vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) == 0)
		return -EINVAL;

	if (!mlock_future_ok(vma->vm_mm, vma->vm_flags | VM_LOCKED, len))
		return -EAGAIN;

	vm_flags_set(vma, VM_LOCKED | VM_DONTDUMP);
	vma->vm_ops = &secretmem_vm_ops;

	return 0;
}

bool vma_is_secretmem(struct vm_area_struct *vma)
{
	return vma->vm_ops == &secretmem_vm_ops;
}

static const struct file_operations secretmem_fops = {
	.release	= secretmem_release,
	.mmap		= secretmem_mmap,
};

static int secretmem_migrate_folio(struct address_space *mapping,
		struct folio *dst, struct folio *src, enum migrate_mode mode)
{
	return -EBUSY;
}

static void secretmem_free_folio(struct folio *folio)
{
	set_direct_map_default_noflush(&folio->page);
	folio_zero_segment(folio, 0, folio_size(folio));
}

const struct address_space_operations secretmem_aops = {
	.dirty_folio	= noop_dirty_folio,
	.free_folio	= secretmem_free_folio,
	.migrate_folio	= secretmem_migrate_folio,
};

static int secretmem_setattr(struct mnt_idmap *idmap,
			     struct dentry *dentry, struct iattr *iattr)
{
	struct inode *inode = d_inode(dentry);
	struct address_space *mapping = inode->i_mapping;
	unsigned int ia_valid = iattr->ia_valid;
	int ret;

	filemap_invalidate_lock(mapping);

	if ((ia_valid & ATTR_SIZE) && inode->i_size)
		ret = -EINVAL;
	else
		ret = simple_setattr(idmap, dentry, iattr);

	filemap_invalidate_unlock(mapping);

	return ret;
}

static const struct inode_operations secretmem_iops = {
	.setattr = secretmem_setattr,
};

static struct vfsmount *secretmem_mnt;

static struct file *secretmem_file_create(unsigned long flags)
{
	struct file *file;
	struct inode *inode;
	const char *anon_name = "[secretmem]";
	const struct qstr qname = QSTR_INIT(anon_name, strlen(anon_name));
	int err;

	inode = alloc_anon_inode(secretmem_mnt->mnt_sb);
	if (IS_ERR(inode))
		return ERR_CAST(inode);

	err = security_inode_init_security_anon(inode, &qname, NULL);
	if (err) {
		file = ERR_PTR(err);
		goto err_free_inode;
	}

	file = alloc_file_pseudo(inode, secretmem_mnt, "secretmem",
				 O_RDWR, &secretmem_fops);
	if (IS_ERR(file))
		goto err_free_inode;

	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
	mapping_set_unevictable(inode->i_mapping);

	inode->i_op = &secretmem_iops;
	inode->i_mapping->a_ops = &secretmem_aops;

	/* pretend we are a normal file with zero size */
	inode->i_mode |= S_IFREG;
	inode->i_size = 0;

	return file;

err_free_inode:
	iput(inode);
	return file;
}

SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
{
	struct file *file;
	int fd, err;

	/* make sure local flags do not confict with global fcntl.h */
	BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC);

	if (!secretmem_enable)
		return -ENOSYS;

	if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC))
		return -EINVAL;
	if (atomic_read(&secretmem_users) < 0)
		return -ENFILE;

	fd = get_unused_fd_flags(flags & O_CLOEXEC);
	if (fd < 0)
		return fd;

	file = secretmem_file_create(flags);
	if (IS_ERR(file)) {
		err = PTR_ERR(file);
		goto err_put_fd;
	}

	file->f_flags |= O_LARGEFILE;

	atomic_inc(&secretmem_users);
	fd_install(fd, file);
	return fd;

err_put_fd:
	put_unused_fd(fd);
	return err;
}

static int secretmem_init_fs_context(struct fs_context *fc)
{
	return init_pseudo(fc, SECRETMEM_MAGIC) ? 0 : -ENOMEM;
}

static struct file_system_type secretmem_fs = {
	.name		= "secretmem",
	.init_fs_context = secretmem_init_fs_context,
	.kill_sb	= kill_anon_super,
};

static int __init secretmem_init(void)
{
	if (!secretmem_enable)
		return 0;

	secretmem_mnt = kern_mount(&secretmem_fs);
	if (IS_ERR(secretmem_mnt))
		return PTR_ERR(secretmem_mnt);

	/* prevent secretmem mappings from ever getting PROT_EXEC */
	secretmem_mnt->mnt_flags |= MNT_NOEXEC;

	return 0;
}
fs_initcall(secretmem_init);
Commit	Line	Data
1507f512 MR	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* Copyright IBM Corporation, 2021
	4	*
	5	* Author: Mike Rapoport <[email protected]>
	6	*/
	7
	8	#include <linux/mm.h>
	9	#include <linux/fs.h>
	10	#include <linux/swap.h>
	11	#include <linux/mount.h>
	12	#include <linux/memfd.h>
	13	#include <linux/bitops.h>
	14	#include <linux/printk.h>
	15	#include <linux/pagemap.h>
	16	#include <linux/syscalls.h>
	17	#include <linux/pseudo_fs.h>
	18	#include <linux/secretmem.h>
	19	#include <linux/set_memory.h>
	20	#include <linux/sched/signal.h>
	21
	22	#include <uapi/linux/magic.h>
	23
	24	#include <asm/tlbflush.h>
	25
	26	#include "internal.h"
	27
	28	#undef pr_fmt
	29	#define pr_fmt(fmt) "secretmem: " fmt
	30
	31	/*
	32	* Define mode and flag masks to allow validation of the system call
	33	* parameters.
	34	*/
	35	#define SECRETMEM_MODE_MASK (0x0)
	36	#define SECRETMEM_FLAGS_MASK SECRETMEM_MODE_MASK
	37
b758fe6d	38	static bool secretmem_enable __ro_after_init = 1;
1507f512 MR	39	module_param_named(enable, secretmem_enable, bool, 0400);
	40	MODULE_PARM_DESC(secretmem_enable,
	41	"Enable secretmem and memfd_secret(2) system call");
	42
87066fdd	43	static atomic_t secretmem_users;
9a436f8f MR	44
	45	bool secretmem_active(void)
	46	{
87066fdd	47	return !!atomic_read(&secretmem_users);
9a436f8f MR	48	}
9a436f8f MR	49
1507f512 MR	50	static vm_fault_t secretmem_fault(struct vm_fault *vmf)
	51	{
	52	struct address_space *mapping = vmf->vma->vm_file->f_mapping;
	53	struct inode *inode = file_inode(vmf->vma->vm_file);
	54	pgoff_t offset = vmf->pgoff;
	55	gfp_t gfp = vmf->gfp_mask;
	56	unsigned long addr;
	57	struct page *page;
7e2fca52	58	struct folio *folio;
84ac0130	59	vm_fault_t ret;
1507f512 MR	60	int err;
	61
	62	if (((loff_t)vmf->pgoff << PAGE_SHIFT) >= i_size_read(inode))
	63	return vmf_error(-EINVAL);
	64
84ac0130 MR	65	filemap_invalidate_lock_shared(mapping);
84ac0130 MR	66
1507f512 MR	67	retry:
	68	page = find_lock_page(mapping, offset);
	69	if (!page) {
7e2fca52 Z	70	folio = folio_alloc(gfp \| __GFP_ZERO, 0);
7e2fca52 Z	71	if (!folio) {
84ac0130 MR	72	ret = VM_FAULT_OOM;
	73	goto out;
	74	}
1507f512	75
7e2fca52	76	page = &folio->page;
1507f512 MR	77	err = set_direct_map_invalid_noflush(page);
1507f512 MR	78	if (err) {
7e2fca52	79	folio_put(folio);
84ac0130 MR	80	ret = vmf_error(err);
84ac0130 MR	81	goto out;
1507f512 MR	82	}
1507f512 MR	83
7e2fca52 Z	84	__folio_mark_uptodate(folio);
7e2fca52 Z	85	err = filemap_add_folio(mapping, folio, offset, gfp);
1507f512	86	if (unlikely(err)) {
7e2fca52	87	folio_put(folio);
1507f512 MR	88	/*
	89	* If a split of large page was required, it
	90	* already happened when we marked the page invalid
	91	* which guarantees that this call won't fail
	92	*/
	93	set_direct_map_default_noflush(page);
	94	if (err == -EEXIST)
	95	goto retry;
	96
84ac0130 MR	97	ret = vmf_error(err);
84ac0130 MR	98	goto out;
1507f512 MR	99	}
	100
	101	addr = (unsigned long)page_address(page);
	102	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
	103	}
	104
	105	vmf->page = page;
84ac0130 MR	106	ret = VM_FAULT_LOCKED;
	107
	108	out:
	109	filemap_invalidate_unlock_shared(mapping);
	110	return ret;
1507f512 MR	111	}
	112
	113	static const struct vm_operations_struct secretmem_vm_ops = {
	114	.fault = secretmem_fault,
	115	};
	116
9a436f8f MR	117	static int secretmem_release(struct inode inode, struct file file)
9a436f8f MR	118	{
87066fdd	119	atomic_dec(&secretmem_users);
9a436f8f MR	120	return 0;
	121	}
	122
1507f512 MR	123	static int secretmem_mmap(struct file file, struct vm_area_struct vma)
	124	{
	125	unsigned long len = vma->vm_end - vma->vm_start;
	126
	127	if ((vma->vm_flags & (VM_SHARED \| VM_MAYSHARE)) == 0)
	128	return -EINVAL;
	129
b0cc5e89	130	if (!mlock_future_ok(vma->vm_mm, vma->vm_flags \| VM_LOCKED, len))
1507f512 MR	131	return -EAGAIN;
1507f512 MR	132
1c71222e	133	vm_flags_set(vma, VM_LOCKED \| VM_DONTDUMP);
1507f512 MR	134	vma->vm_ops = &secretmem_vm_ops;
	135
	136	return 0;
	137	}
	138
	139	bool vma_is_secretmem(struct vm_area_struct *vma)
	140	{
	141	return vma->vm_ops == &secretmem_vm_ops;
	142	}
	143
	144	static const struct file_operations secretmem_fops = {
9a436f8f	145	.release = secretmem_release,
1507f512 MR	146	.mmap = secretmem_mmap,
	147	};
	148
5409548d MWO	149	static int secretmem_migrate_folio(struct address_space *mapping,
5409548d MWO	150	struct folio dst, struct folio src, enum migrate_mode mode)
1507f512 MR	151	{
	152	return -EBUSY;
	153	}
	154
6612ed24	155	static void secretmem_free_folio(struct folio *folio)
1507f512	156	{
6612ed24 MWO	157	set_direct_map_default_noflush(&folio->page);
6612ed24 MWO	158	folio_zero_segment(folio, 0, folio_size(folio));
1507f512 MR	159	}
	160
	161	const struct address_space_operations secretmem_aops = {
46de8b97	162	.dirty_folio = noop_dirty_folio,
6612ed24	163	.free_folio = secretmem_free_folio,
5409548d	164	.migrate_folio = secretmem_migrate_folio,
1507f512 MR	165	};
1507f512 MR	166
c1632a0f	167	static int secretmem_setattr(struct mnt_idmap *idmap,
f9b141f9 AR	168	struct dentry dentry, struct iattr iattr)
	169	{
	170	struct inode *inode = d_inode(dentry);
84ac0130	171	struct address_space *mapping = inode->i_mapping;
f9b141f9	172	unsigned int ia_valid = iattr->ia_valid;
84ac0130 MR	173	int ret;
	174
	175	filemap_invalidate_lock(mapping);
f9b141f9 AR	176
f9b141f9 AR	177	if ((ia_valid & ATTR_SIZE) && inode->i_size)
84ac0130 MR	178	ret = -EINVAL;
84ac0130 MR	179	else
c1632a0f	180	ret = simple_setattr(idmap, dentry, iattr);
84ac0130 MR	181
84ac0130 MR	182	filemap_invalidate_unlock(mapping);
f9b141f9	183
84ac0130	184	return ret;
f9b141f9 AR	185	}
	186
	187	static const struct inode_operations secretmem_iops = {
	188	.setattr = secretmem_setattr,
	189	};
	190
1507f512 MR	191	static struct vfsmount *secretmem_mnt;
	192
	193	static struct file *secretmem_file_create(unsigned long flags)
	194	{
98001fd6	195	struct file *file;
1507f512	196	struct inode *inode;
2bfe15c5 CG	197	const char *anon_name = "[secretmem]";
	198	const struct qstr qname = QSTR_INIT(anon_name, strlen(anon_name));
	199	int err;
1507f512 MR	200
	201	inode = alloc_anon_inode(secretmem_mnt->mnt_sb);
	202	if (IS_ERR(inode))
	203	return ERR_CAST(inode);
	204
2bfe15c5 CG	205	err = security_inode_init_security_anon(inode, &qname, NULL);
	206	if (err) {
	207	file = ERR_PTR(err);
	208	goto err_free_inode;
	209	}
	210
1507f512 MR	211	file = alloc_file_pseudo(inode, secretmem_mnt, "secretmem",
	212	O_RDWR, &secretmem_fops);
	213	if (IS_ERR(file))
	214	goto err_free_inode;
	215
	216	mapping_set_gfp_mask(inode->i_mapping, GFP_HIGHUSER);
	217	mapping_set_unevictable(inode->i_mapping);
	218
f9b141f9	219	inode->i_op = &secretmem_iops;
1507f512 MR	220	inode->i_mapping->a_ops = &secretmem_aops;
	221
	222	/* pretend we are a normal file with zero size */
	223	inode->i_mode \|= S_IFREG;
	224	inode->i_size = 0;
	225
	226	return file;
	227
	228	err_free_inode:
	229	iput(inode);
	230	return file;
	231	}
	232
	233	SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
	234	{
	235	struct file *file;
	236	int fd, err;
	237
	238	/* make sure local flags do not confict with global fcntl.h */
	239	BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC);
	240
	241	if (!secretmem_enable)
	242	return -ENOSYS;
	243
	244	if (flags & ~(SECRETMEM_FLAGS_MASK \| O_CLOEXEC))
	245	return -EINVAL;
cb685432 MWO	246	if (atomic_read(&secretmem_users) < 0)
cb685432 MWO	247	return -ENFILE;
1507f512 MR	248
	249	fd = get_unused_fd_flags(flags & O_CLOEXEC);
	250	if (fd < 0)
	251	return fd;
	252
	253	file = secretmem_file_create(flags);
	254	if (IS_ERR(file)) {
	255	err = PTR_ERR(file);
	256	goto err_put_fd;
	257	}
	258
	259	file->f_flags \|= O_LARGEFILE;
	260
87066fdd	261	atomic_inc(&secretmem_users);
855d4443	262	fd_install(fd, file);
1507f512 MR	263	return fd;
	264
	265	err_put_fd:
	266	put_unused_fd(fd);
	267	return err;
	268	}
	269
	270	static int secretmem_init_fs_context(struct fs_context *fc)
	271	{
	272	return init_pseudo(fc, SECRETMEM_MAGIC) ? 0 : -ENOMEM;
	273	}
	274
	275	static struct file_system_type secretmem_fs = {
	276	.name = "secretmem",
	277	.init_fs_context = secretmem_init_fs_context,
	278	.kill_sb = kill_anon_super,
	279	};
	280
1ea41595	281	static int __init secretmem_init(void)
1507f512	282	{
1507f512	283	if (!secretmem_enable)
f7c5b1aa	284	return 0;
1507f512 MR	285
	286	secretmem_mnt = kern_mount(&secretmem_fs);
	287	if (IS_ERR(secretmem_mnt))
4eb5bbde	288	return PTR_ERR(secretmem_mnt);
1507f512 MR	289
	290	/* prevent secretmem mappings from ever getting PROT_EXEC */
	291	secretmem_mnt->mnt_flags \|= MNT_NOEXEC;
	292
f7c5b1aa	293	return 0;
1507f512 MR	294	}
1507f512 MR	295	fs_initcall(secretmem_init);