From patchwork Fri Nov 17 21:15:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Howells X-Patchwork-Id: 13459591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3599C5ACB3 for ; Fri, 17 Nov 2023 21:18:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 70C258D0059; Fri, 17 Nov 2023 16:18:12 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6BF6D8D001C; Fri, 17 Nov 2023 16:18:12 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5337C8D0059; Fri, 17 Nov 2023 16:18:12 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 3F9498D001C for ; Fri, 17 Nov 2023 16:18:12 -0500 (EST) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 1F9C81CA6DD for ; Fri, 17 Nov 2023 21:18:12 +0000 (UTC) X-FDA: 81468709224.01.BA0F98C Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf12.hostedemail.com (Postfix) with ESMTP id 5BA6140011 for ; Fri, 17 Nov 2023 21:18:10 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=XUVliCL7; spf=pass (imf12.hostedemail.com: domain of dhowells@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=dhowells@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1700255890; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=PmfXBVlMsm2chMbQyKBBe8+lheiIqsV1CsACyw5IYTE=; b=Q6gJbBKt2RwQlD75bI2YWYlbgyyenW9ssMVC2XxoHB+ytwF5QAWklNUJ1jt+bcThnnoQCs MmBMl7go1Qsv5EOVTmB8kk8zWfmWXf/fs3ZNnf5741Pp4UutWKIz8FSkflZ9UWBfJe1H+2 afvJI4TBZQGsXE4L9RFn7ec+U5lfW/0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1700255890; a=rsa-sha256; cv=none; b=x0LjaYTT0vxL9r1Nixo2B6YeCHlwqnDrtaMb4mghBu+HZjzELVPzdhxsN0EyiCoHKOBq0V P/YSUcfDgCGZQO9R/Z0KIxUBpgxxIlqlY8QZ2pXDx02rSEvXAMVzn8XeIsmP4YCOZmuG9h Ch3jFhdganlb36ExQul2iho1mr6ZUiQ= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=XUVliCL7; spf=pass (imf12.hostedemail.com: domain of dhowells@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=dhowells@redhat.com; dmarc=pass (policy=none) header.from=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1700255889; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PmfXBVlMsm2chMbQyKBBe8+lheiIqsV1CsACyw5IYTE=; b=XUVliCL7RzaUG2PGq+51Fs82SHZYhdGR5HW2oPcIyhKR8OdfCqMk6XiJilYrzw1zIfL4+n 5xEAfpDGptvHgaxWXs5pyOg0JozIuX9u99QafweaZj1LEjOhfKDGI95c8oxO/PvtmkmG/z GjFejagUamEk8bPvimx6gLmGskKpboQ= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-372-e8H8Un-WMimv7o6BGwG5zw-1; Fri, 17 Nov 2023 16:18:04 -0500 X-MC-Unique: e8H8Un-WMimv7o6BGwG5zw-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 77ACD185A784; Fri, 17 Nov 2023 21:18:03 +0000 (UTC) Received: from warthog.procyon.org.com (unknown [10.42.28.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id DBCAC5036; Fri, 17 Nov 2023 21:18:00 +0000 (UTC) From: David Howells To: Jeff Layton , Steve French Cc: David Howells , Matthew Wilcox , Marc Dionne , Paulo Alcantara , Shyam Prasad N , Tom Talpey , Dominique Martinet , Ilya Dryomov , Christian Brauner , linux-cachefs@redhat.com, linux-afs@lists.infradead.org, linux-cifs@vger.kernel.org, linux-nfs@vger.kernel.org, ceph-devel@vger.kernel.org, v9fs@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 34/51] netfs: Decrypt encrypted content Date: Fri, 17 Nov 2023 21:15:26 +0000 Message-ID: <20231117211544.1740466-35-dhowells@redhat.com> In-Reply-To: <20231117211544.1740466-1-dhowells@redhat.com> References: <20231117211544.1740466-1-dhowells@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.5 X-Rspamd-Queue-Id: 5BA6140011 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: nk7ggn3thzq7u9atne97q7prfc5xmkhm X-HE-Tag: 1700255890-569628 X-HE-Meta: U2FsdGVkX1/bXUsOFnCwt/Y2SG2S2ncyg5AYAdUgYwJ1ANld7FXRiTMurEeyQLNAwSUbIIp9j4QcNkWvMhWdx3Jn3oFX0PvP0ccmYGEV5KK4vtmB3ZHvS6AU3cbmsBrqnwY42c+x3mGyFU3zCt0GqTqMiEsBg+aFhXwsts+RmZhr5VKN1Oten67s78NiTv6CWAjCWBuLbIdB7x2UJTpKviMv304MQhiA4gUetwxNCaOtYt8AqkJn0kD9DN8AV8pbUwoyuIWIivwB/RW+uOeNfXYlU8qAcF5Zfngnhf5SbaRAP4JtMgftB+rvazd9IecKhHikIMgnIPJ0u1msE7adwDe877KURsoKctv3xAhBThGiC+LNmI+bB/uZJeo5hXdPyIlsaptahy0zRBn89c/h7O0KMxcrMrvBmVWDSkeCmV+gyGwv1bTylI/wHR5tFnPIE2KD1F83r9fKPy4XRh73QWZnH/TjZu/fXsp6jOJrcSel0CpKS25J7VXhudJ6uElmlcjjyDGXRHo8fXvqZJ88HMoUcVaSmoseUz6RSFK4PLsRJMZgMuN4uWtwIXSo24ppGkYnU4vkio6F4MSzNfEPapisruhHvEg34Xl47y9+AU+2WONlJXcO9Jvsu/X4st1TmI0yUcStcskhwG3tJhQvKKui6vCIbN/sR1UD8WlMfOO0wUjxAjw8h2wop8Xv0gBgWveiPJrwScweJcKmJfxTc9uqrQRriluN0b8Zef8sibAJCpCB5dwDWHhSDK+6zLWhT0u0WHVoAocNOqWP0+X6Qf7+ICPmgnt7ppixJZ+oAYwvWsOvKiqBMETRNjv9IUJ5m8JVSHGosNE8uyE8E/u60PNRDRdCdW4v5bulxlMbC/a8TMnYfn7M281Ugkj1ssxEcDQxkflFLVfPhEkRw8mWOwZ5fUOYQlq8wafX7nOZIigukCIBQ2pvPG4o542Bbl2E1JbD1IG4SLJk/mLr5E0 +jbUbM+5 YtoLQWNygjomJ651pXvaxtkPtU+p3wjWS+wZDXxs/OBQZ4gblsUXhmJDipCvl0DTmmC6luHJnN1NT9g9o5Ml/BVODg2n0nw/79iQHAogo8hCUqlFLNDsKXdHvgy9fgBpEwQh3IllGW6mNuPqDpYebVzkr+IowpcKiMmtwL7o3kpbGdz76S9fia0oKqfSiMJ71/e50TlBrQMaep2XLw6/0YjS3oNYw8SW1UAh0KKrcufdGjDDqICxURQ/tByQ65gDOlzFdyujxtyB9U5IUO3+tCRneYAYNH9AgjkVITN3yNzM5oso= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Implement a facility to provide decryption for encrypted content to a whole read-request in one go (which might have been stitched together from disparate sources with divisions that don't match page boundaries). Note that this doesn't necessarily gain the best throughput if the crypto block size is equal to or less than the size of a page (in which case we might be better doing it as pages become read), but it will handle crypto blocks larger than the size of a page. Signed-off-by: David Howells cc: Jeff Layton cc: linux-cachefs@redhat.com cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org --- fs/netfs/crypto.c | 59 ++++++++++++++++++++++++++++++++++++ fs/netfs/internal.h | 1 + fs/netfs/io.c | 6 +++- include/linux/netfs.h | 3 ++ include/trace/events/netfs.h | 2 ++ 5 files changed, 70 insertions(+), 1 deletion(-) diff --git a/fs/netfs/crypto.c b/fs/netfs/crypto.c index 943d01f430e2..6729bcda4f47 100644 --- a/fs/netfs/crypto.c +++ b/fs/netfs/crypto.c @@ -87,3 +87,62 @@ bool netfs_encrypt(struct netfs_io_request *wreq) wreq->error = ret; return false; } + +/* + * Decrypt the result of a read request. + */ +void netfs_decrypt(struct netfs_io_request *rreq) +{ + struct netfs_inode *ctx = netfs_inode(rreq->inode); + struct scatterlist source_sg[16], dest_sg[16]; + unsigned int n_source; + size_t n, chunk, bsize = 1UL << ctx->crypto_bshift; + loff_t pos; + int ret; + + trace_netfs_rreq(rreq, netfs_rreq_trace_decrypt); + if (rreq->start >= rreq->i_size) + return; + + n = min_t(unsigned long long, rreq->len, rreq->i_size - rreq->start); + + _debug("DECRYPT %llx-%llx f=%lx", + rreq->start, rreq->start + n, rreq->flags); + + pos = rreq->start; + for (; n > 0; n -= chunk, pos += chunk) { + chunk = min(n, bsize); + + ret = netfs_iter_to_sglist(&rreq->io_iter, chunk, + source_sg, ARRAY_SIZE(source_sg)); + if (ret < 0) + goto error; + n_source = ret; + + if (test_bit(NETFS_RREQ_CRYPT_IN_PLACE, &rreq->flags)) { + ret = ctx->ops->decrypt_block(rreq, pos, chunk, + source_sg, n_source, + source_sg, n_source); + } else { + ret = netfs_iter_to_sglist(&rreq->iter, chunk, + dest_sg, ARRAY_SIZE(dest_sg)); + if (ret < 0) + goto error; + ret = ctx->ops->decrypt_block(rreq, pos, chunk, + source_sg, n_source, + dest_sg, ret); + } + + if (ret < 0) + goto error_failed; + } + + return; + +error_failed: + trace_netfs_failure(rreq, NULL, ret, netfs_fail_decryption); +error: + rreq->error = ret; + set_bit(NETFS_RREQ_FAILED, &rreq->flags); + return; +} diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h index d3e74ad478ce..fbecfd9b3174 100644 --- a/fs/netfs/internal.h +++ b/fs/netfs/internal.h @@ -26,6 +26,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio, * crypto.c */ bool netfs_encrypt(struct netfs_io_request *wreq); +void netfs_decrypt(struct netfs_io_request *rreq); /* * direct_write.c diff --git a/fs/netfs/io.c b/fs/netfs/io.c index 36a3f720193a..9887b22e4cb3 100644 --- a/fs/netfs/io.c +++ b/fs/netfs/io.c @@ -398,6 +398,9 @@ static void netfs_rreq_assess(struct netfs_io_request *rreq, bool was_async) return; } + if (!test_bit(NETFS_RREQ_FAILED, &rreq->flags) && + test_bit(NETFS_RREQ_CONTENT_ENCRYPTION, &rreq->flags)) + netfs_decrypt(rreq); if (rreq->origin != NETFS_DIO_READ) netfs_rreq_unlock_folios(rreq); else @@ -427,7 +430,8 @@ static void netfs_rreq_work(struct work_struct *work) static void netfs_rreq_terminated(struct netfs_io_request *rreq, bool was_async) { - if (test_bit(NETFS_RREQ_INCOMPLETE_IO, &rreq->flags) && + if ((test_bit(NETFS_RREQ_INCOMPLETE_IO, &rreq->flags) || + test_bit(NETFS_RREQ_CONTENT_ENCRYPTION, &rreq->flags)) && was_async) { if (!queue_work(system_unbound_wq, &rreq->work)) BUG(); diff --git a/include/linux/netfs.h b/include/linux/netfs.h index 639f1f9cb7e0..364361cc93be 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -327,6 +327,9 @@ struct netfs_request_ops { int (*encrypt_block)(struct netfs_io_request *wreq, loff_t pos, size_t len, struct scatterlist *source_sg, unsigned int n_source, struct scatterlist *dest_sg, unsigned int n_dest); + int (*decrypt_block)(struct netfs_io_request *rreq, loff_t pos, size_t len, + struct scatterlist *source_sg, unsigned int n_source, + struct scatterlist *dest_sg, unsigned int n_dest); }; /* diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index 70e2f9a48f24..2f35057602fa 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -40,6 +40,7 @@ #define netfs_rreq_traces \ EM(netfs_rreq_trace_assess, "ASSESS ") \ EM(netfs_rreq_trace_copy, "COPY ") \ + EM(netfs_rreq_trace_decrypt, "DECRYPT") \ EM(netfs_rreq_trace_done, "DONE ") \ EM(netfs_rreq_trace_encrypt, "ENCRYPT") \ EM(netfs_rreq_trace_free, "FREE ") \ @@ -75,6 +76,7 @@ #define netfs_failures \ EM(netfs_fail_check_write_begin, "check-write-begin") \ EM(netfs_fail_copy_to_cache, "copy-to-cache") \ + EM(netfs_fail_decryption, "decryption") \ EM(netfs_fail_dio_read_short, "dio-read-short") \ EM(netfs_fail_dio_read_zero, "dio-read-zero") \ EM(netfs_fail_encryption, "encryption") \