From patchwork Tue Oct 17 20:24:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13426021 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EF6BCDB483 for ; Tue, 17 Oct 2023 20:25:34 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0204D8D0064; Tue, 17 Oct 2023 16:25:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F12598D00A8; Tue, 17 Oct 2023 16:25:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DB2BA8D0064; Tue, 17 Oct 2023 16:25:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id BDFC98D00A8 for ; Tue, 17 Oct 2023 16:25:32 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 97D51C0D49 for ; Tue, 17 Oct 2023 20:25:32 +0000 (UTC) X-FDA: 81356083704.22.70DACE0 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.7]) by imf05.hostedemail.com (Postfix) with ESMTP id 9D050100010 for ; Tue, 17 Oct 2023 20:25:30 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=R3fluf0f; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf05.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.198.163.7 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1697574330; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=bHJdVxLWL7tmOR6rkkqndFqpRDxEeh3UF9/QOQa3Rd0=; b=3/3rmYdKRyxhYTKk+51yRAbQA6vBg++kFBmiC4ag1bx6GKUKmqTK1R2vp+P8HGeg2B+TTm Emrz3VF1UjLxx8lW7mIcthqZek7t/IKwwFhvJT6PkPJKvVMikC5Wt3mFbjaeL8yWgOwZg4 6vWA2lJEHW7dMofwD+ZBOmhOzlHmz48= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=R3fluf0f; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf05.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.198.163.7 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1697574330; a=rsa-sha256; cv=none; b=MuoXLoGLaup2OwmxD5GNsLMXnx1Q5JGvuk9HYe6OJz09sFdDrR4wTikh4F1UMu95Yn1Qfr L3yTVi/Uo11rAFGuS2G+iW1Wlt6Fy5MwLHSlxdA0Fw7Vi8OltYaEsiC69AsQxW7w4RT91k NiXhFRHYPJLyY5SgyypKcra2uWac+XM= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1697574331; x=1729110331; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+c/mkJRcRl/HTZD+PEVBiG6EmvprrHB2jpk4jFyydb0=; b=R3fluf0fh/ATMZxj4QR1ar7WWyHbOheknHez2wUPcS/4wL8fgEMdAagD UAmyJm53leDNz0Swnlbm3Fsp5yfwJRnB6g1WeU0Bi7CMH3sHvGBscRoPA Cov+osfqIarWBE0v28llZxPmlWM/neB/ewtJjLsu0kLgjjjCTHw9DAiaw syuadEEWiZMxbZ7PWDHHxKwn8leR7BfhM4aZ3m8yBumDL5dRPam4SgFWg rK9yIXg4EkU+0ZDSK6whzeeJUpaMMGNno8URYlqfwOJR0JOAGi9fPDkaR /n/az3Cw6uzpwHpsXRohz5M2Y3GkXY45kri4wuliszj5r978K8BXajGAe Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10866"; a="7429485" X-IronPort-AV: E=Sophos;i="6.03,233,1694761200"; d="scan'208";a="7429485" Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Oct 2023 13:25:29 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10866"; a="900040434" X-IronPort-AV: E=Sophos;i="6.03,233,1694761200"; d="scan'208";a="900040434" Received: from rtdinh-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.intel.com) ([10.212.150.155]) by fmsmga001-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Oct 2023 13:23:25 -0700 From: Rick Edgecombe To: x86@kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, luto@kernel.org, peterz@infradead.org, kirill.shutemov@linux.intel.com, elena.reshetova@intel.com, isaku.yamahata@intel.com, seanjc@google.com, Michael Kelley , thomas.lendacky@amd.com, decui@microsoft.com, sathyanarayanan.kuppuswamy@linux.intel.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org Cc: rick.p.edgecombe@intel.com, Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Dave Hansen Subject: [PATCH 01/10] mm: Add helper for freeing decrypted memory Date: Tue, 17 Oct 2023 13:24:56 -0700 Message-Id: <20231017202505.340906-2-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231017202505.340906-1-rick.p.edgecombe@intel.com> References: <20231017202505.340906-1-rick.p.edgecombe@intel.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 9D050100010 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: ms3u676fu8m6ubx43gbqo6h73s33oant X-HE-Tag: 1697574330-385154 X-HE-Meta: U2FsdGVkX1+BV2TfZPNmj2QWcuAmp8696xGPFiSBYzugo7TGHGr3Fvau7fYr8wDz6rPRTvscBeD6aHDRLmCoL8RdTtjZtuBT07r7k+UlZLTLHeLscROUyh6sBYhoBLMhSrclW5d9UQe9al6uqdHP6X8NUTEqWJRRUp08LvioJtROfQepxCuMdzI4CeTgycyur4xNEjfPxumUjhK7d+fx+fvbFWDcETYaIZNUPadbP0pT+siFqg1c40DECSWN9HqxuReIhaHC+mCed7hR76tMhqRKLAw/E0O+S2JBPpmRAnBaCcuHOD5J48rC0LSqwRYH7WY4qHyMDAFc1EmFWGwgpP85ybHHpTf/FtHAwFAqJPRdX3w9Qg0IsQPcQCYu+MBqsoSUnXkT9uXOtKBcFSZErit0NuRCBN5CtW3Vk599x4y9+sAzPN74IHs/7lwACbqhzWHjZrAZulfe1jKNAwT+NMbdHu0uS5ZeTr6iQ5PmmDr3BfbTCTMFTF1sFDyulb0jIXWPWwvDmFir1/j+ceYJSP+XWaaiUoKcxwe2+vP8mpMbu0E4FZNKB9CCUx4eBDhFmLzs89sBlAniL//MiQiR+VNEORz+RtXYtivVWelt6FA6yLWQEtO6lQCjow2Z+4k6gPrzraxRAmHDN4t1i0AY1Z4BJ3E+G9nH4AUzyDRKVd64McP+ERfZ86HHfONdZBrBIvrvF+GZa/md77JNY/5X5bGIyAiZEGL5FJ8W+XBIJuMgDhv4jp67S4TGU6d4AQrJ4ceaTS+X271SRZxEwcUVhcbUpFJqUpsvmnvqSffIc1XAF28+to2wtbs0A46zPMpl8qwxjUQIJQssDF/S9GBzJhgWFEOsbQQWfnB7tGqKHYf3DGARajJekUNvtpdBeWDk3LpC3/XKHBpaG8c1VjDYJNT27KHf5itStTVs+N7Yos4S/kAEZSeQBbO9k2j8ud4b87EEFef13krskQHHD2D e3yqBIPf gCan7vPJmsHdhnJHBwNNW8yEanw3TSOtoI2UXgjULS73aT2atxL2WqmMKh1kVm3cDLeLA9k5mxGf1OH8NG5rjQknDxiBTgUxhYFBulzBSZOS9Ho108buM+2dZx8RElnxkzMGVK+HMk4U6IBINEvdcVTi9WVjWkMM2IHYwG5DoJvmbMjK4ShaSVM1lFMLuU37f45pK+mud62nDo+mqlUUWylHiSgwTgGUumc4MTb54LV9/4Tc= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When freeing decrypted memory to the page allocator the memory needs to be manually re-encrypted beforehand. If this step is skipped, then the next user of those pages will have the contents inadvertently exposed to the guest, or cause the guest to crash if the page is used in way disallowed by HW (i.e. for executable code or as a page table). Unfortunately, there are many instance of patterns like: set_memory_encrypted(pages); free_pages(pages); ...or... if (set_memory_decrypted(addr, 1)) free_pages(pages); This is a problem because set_memory_encrypted() and set_memory_decrypted() can be failed by the untrusted host in such a way that an error is returned and the resulting memory is shared. To aid in a tree-wide cleanup of these callers, add a free_decrypted_pages() function that will first try to encrypt the pages before returning them. If it is not successful, have it leak the pages and warn about this. This is preferable to returning shared pages to allocator or panicking. In some cases the code path's for freeing decrypted memory handle both encrypted and decrypted pages. In this case, rely on set_memory() to handle being asked to convert memory to the state it is already in. Going forward, rely on cross-arch callers to find and use free_decrypted_pages() instead of resorting to more heavy handed solutions like terminating the guest when nasty VMM behavior is observed. To make s390's arch set_memory_XXcrypted() definitions available in linux/set_memory.h, add include for s390's asm version of set_memory.h. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: linux-s390@vger.kernel.org Suggested-by: Dave Hansen Signed-off-by: Rick Edgecombe --- arch/s390/include/asm/set_memory.h | 1 + include/linux/set_memory.h | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/arch/s390/include/asm/set_memory.h b/arch/s390/include/asm/set_memory.h index 06fbabe2f66c..09d36ebd64b5 100644 --- a/arch/s390/include/asm/set_memory.h +++ b/arch/s390/include/asm/set_memory.h @@ -3,6 +3,7 @@ #define _ASMS390_SET_MEMORY_H #include +#include extern struct mutex cpa_mutex; diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h index 95ac8398ee72..a898b14b6b1f 100644 --- a/include/linux/set_memory.h +++ b/include/linux/set_memory.h @@ -5,6 +5,8 @@ #ifndef _LINUX_SET_MEMORY_H_ #define _LINUX_SET_MEMORY_H_ +#include + #ifdef CONFIG_ARCH_HAS_SET_MEMORY #include #else @@ -78,4 +80,15 @@ static inline int set_memory_decrypted(unsigned long addr, int numpages) } #endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */ +static inline void free_decrypted_pages(unsigned long addr, int order) +{ + int ret = set_memory_encrypted(addr, 1 << order); + + if (ret) { + WARN_ONCE(1, "Failed to re-encrypt memory before freeing, leaking pages!\n"); + return; + } + free_pages(addr, order); +} + #endif /* _LINUX_SET_MEMORY_H_ */