| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <c55fc93d-270b-4b11-9b38-b54f350ea6c9@redhat.com>
Date: Tue, 6 Aug 2024 16:08:25 +0200
From: David Hildenbrand <david@...hat.com>
To: Elliot Berman <quic_eberman@...cinc.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Paolo Bonzini <pbonzini@...hat.com>, Sean Christopherson
<seanjc@...gle.com>, Fuad Tabba <tabba@...gle.com>,
Patrick Roy <roypat@...zon.co.uk>, qperret@...gle.com,
Ackerley Tng <ackerleytng@...gle.com>
Cc: linux-coco@...ts.linux.dev, linux-arm-msm@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-mm@...ck.org, kvm@...r.kernel.org
Subject: Re: [PATCH RFC 3/4] mm: guest_memfd: Add option to remove guest
private memory from direct map
On 05.08.24 20:34, Elliot Berman wrote:
> This patch was reworked from Patrick's patch:
> https://lore.kernel.org/all/20240709132041.3625501-6-roypat@amazon.co.uk/
>
> While guest_memfd is not available to be mapped by userspace, it is
> still accessible through the kernel's direct map. This means that in
> scenarios where guest-private memory is not hardware protected, it can
> be speculatively read and its contents potentially leaked through
> hardware side-channels. Removing guest-private memory from the direct
> map, thus mitigates a large class of speculative execution issues
> [1, Table 1].
I think you have to point out here that the speculative execution issues
are primarily only an issue when guest_memfd private memory is used
without TDX and friends where the memory would be encrypted either way.
Or am I wrong?
>
> Direct map removal do not reuse the `.prepare` machinery, since
> `prepare` can be called multiple time, and it is the responsibility of
> the preparation routine to not "prepare" the same folio twice [2]. Thus,
> instead explicitly check if `filemap_grab_folio` allocated a new folio,
> and remove the returned folio from the direct map only if this was the
> case.
>
> The patch uses release_folio instead of free_folio to reinsert pages
> back into the direct map as by the time free_folio is called,
> folio->mapping can already be NULL. This means that a call to
> folio_inode inside free_folio might deference a NULL pointer, leaving no
> way to access the inode which stores the flags that allow determining
> whether the page was removed from the direct map in the first place.
>
> [1]: https://download.vusec.net/papers/quarantine_raid23.pdf
>
> Cc: Patrick Roy <roypat@...zon.co.uk>
> Signed-off-by: Elliot Berman <quic_eberman@...cinc.com>
> ---
> include/linux/guest_memfd.h | 8 ++++++
> mm/guest_memfd.c | 65 ++++++++++++++++++++++++++++++++++++++++++++-
> 2 files changed, 72 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/guest_memfd.h b/include/linux/guest_memfd.h
> index be56d9d53067..f9e4a27aed67 100644
> --- a/include/linux/guest_memfd.h
> +++ b/include/linux/guest_memfd.h
> @@ -25,6 +25,14 @@ struct guest_memfd_operations {
> int (*release)(struct inode *inode);
> };
>
> +/**
> + * @GUEST_MEMFD_FLAG_NO_DIRECT_MAP: When making folios inaccessible by host, also
> + * remove them from the kernel's direct map.
> + */
Should we start introducing the concept of private and shared first,
such that we can then say that this only applies to private memory?
> +enum {
> + GUEST_MEMFD_FLAG_NO_DIRECT_MAP = BIT(0),
> +};
> +
> /**
> * @GUEST_MEMFD_GRAB_UPTODATE: Ensure pages are zeroed/up to date.
> * If trusted hyp will do it, can ommit this flag
> diff --git a/mm/guest_memfd.c b/mm/guest_memfd.c
> index 580138b0f9d4..e9d8cab72b28 100644
> --- a/mm/guest_memfd.c
> +++ b/mm/guest_memfd.c
> @@ -7,9 +7,55 @@
> #include <linux/falloc.h>
> #include <linux/guest_memfd.h>
> #include <linux/pagemap.h>
> +#include <linux/set_memory.h>
> +
> +static inline int guest_memfd_folio_private(struct folio *folio)
> +{
> + unsigned long nr_pages = folio_nr_pages(folio);
guest_memfd only supports small folios, this can be simplified.
> + unsigned long i;
> + int r;
> +
> + for (i = 0; i < nr_pages; i++) {
> + struct page *page = folio_page(folio, i);
> +
> + r = set_direct_map_invalid_noflush(page);
> + if (r < 0)
> + goto out_remap;
> + }
> +
> + folio_set_private(folio);
> + return 0;
> +out_remap:
> + for (; i > 0; i--) {
> + struct page *page = folio_page(folio, i - 1);
> +
> + BUG_ON(set_direct_map_default_noflush(page));
> + }
> + return r;
> +}
> +
> +static inline void guest_memfd_folio_clear_private(struct folio *folio)
Set set/clear private semantics in this context are a bit confusing. I
assume you mean "make inaccessible" "make accessible" and using the
PG_private flag is just an implementation detail.
> +{
> + unsigned long start = (unsigned long)folio_address(folio);
> + unsigned long nr = folio_nr_pages(folio);
> + unsigned long i;
> +
> + if (!folio_test_private(folio))
> + return;
> +
> + for (i = 0; i < nr; i++) {
> + struct page *page = folio_page(folio, i);
> +
> + BUG_ON(set_direct_map_default_noflush(page));
> + }
> + flush_tlb_kernel_range(start, start + folio_size(folio));
> +
> + folio_clear_private(folio);
> +}
>
> struct folio *guest_memfd_grab_folio(struct file *file, pgoff_t index, u32 flags)
> {
> + unsigned long gmem_flags = (unsigned long)file->private_data;
> struct inode *inode = file_inode(file);
> struct guest_memfd_operations *ops = inode->i_private;
> struct folio *folio;
> @@ -43,6 +89,12 @@ struct folio *guest_memfd_grab_folio(struct file *file, pgoff_t index, u32 flags
> goto out_err;
> }
>
> + if (gmem_flags & GUEST_MEMFD_FLAG_NO_DIRECT_MAP) {
> + r = guest_memfd_folio_private(folio);
> + if (r)
> + goto out_err;
> + }
> +
> /*
> * Ignore accessed, referenced, and dirty flags. The memory is
> * unevictable and there is no storage to write back to.
> @@ -213,14 +265,25 @@ static bool gmem_release_folio(struct folio *folio, gfp_t gfp)
> if (ops->invalidate_end)
> ops->invalidate_end(inode, offset, nr);
>
> + guest_memfd_folio_clear_private(folio);
> +
> return true;
> }
>
> +static void gmem_invalidate_folio(struct folio *folio, size_t offset, size_t len)
> +{
> + /* not yet supported */
> + BUG_ON(offset || len != folio_size(folio));
> +
> + BUG_ON(!gmem_release_folio(folio, 0));
In general, no BUG_ON please. WARN_ON_ONCE() is sufficient.
> +}
> +
> static const struct address_space_operations gmem_aops = {
> .dirty_folio = noop_dirty_folio,
> .migrate_folio = gmem_migrate_folio,
> .error_remove_folio = gmem_error_folio,
> .release_folio = gmem_release_folio,
> + .invalidate_folio = gmem_invalidate_folio,
> };
>
> static inline bool guest_memfd_check_ops(const struct guest_memfd_operations *ops)
> @@ -241,7 +304,7 @@ struct file *guest_memfd_alloc(const char *name,
> if (!guest_memfd_check_ops(ops))
> return ERR_PTR(-EINVAL);
>
> - if (flags)
> + if (flags & ~GUEST_MEMFD_FLAG_NO_DIRECT_MAP)
> return ERR_PTR(-EINVAL);
>
> /*
>
--
Cheers,
David / dhildenb
Powered by blists - more mailing lists