From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2E89CE7CE6 for ; Tue, 1 Oct 2024 08:20:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3C08028005A; Tue, 1 Oct 2024 04:20:21 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 348B8280036; Tue, 1 Oct 2024 04:20:21 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1E95E28005A; Tue, 1 Oct 2024 04:20:21 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id F10E3280036 for ; Tue, 1 Oct 2024 04:20:20 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 76C8DA0593 for ; Tue, 1 Oct 2024 08:11:36 +0000 (UTC) X-FDA: 82624314192.10.682C083 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf16.hostedemail.com (Postfix) with ESMTP id CC0A318000E for ; Tue, 1 Oct 2024 08:11:33 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fIMN1muB; spf=pass (imf16.hostedemail.com: domain of rppt@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1727770167; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uD7TQ6shso2R5Z8/2DVnlxRHXn5Oactz8ouBDYlUjJ0=; b=xoTql7cnqhPgeqT2Ao6xoMFDia+TmKYYFzYl4/7lv4w2efh8LEiDKX8r/Fc68DS4CgQi2V U/GZYX73StfUBVO38vf0BTHTNm2KKUjev88uJuouKzbxig6/HkybXyGxX/7lYyTrH0ARje kV0yTfI/ENViFe+j483tcDZQue/o6IQ= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1727770167; a=rsa-sha256; cv=none; b=frK1t+8GuoDOz+CRZeCeScN+h3LZlmcvUZ8iko6dk2umJPUqWOXP4jwIVeBHvyQyTvOfUX BSbF3DJ7HkaGJJ1dzTcxqItm9EtEtNyGkY6Ftct1LvBWde/CDzaIkKiu9pRirUs9jelhb0 eqiR73uSZ+TaT4F37wYeU1Gm5yW54/o= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fIMN1muB; spf=pass (imf16.hostedemail.com: domain of rppt@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id A8B9C5C46EE; Tue, 1 Oct 2024 08:11:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E033C4CECD; Tue, 1 Oct 2024 08:11:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1727770292; bh=hYPoCmqYVOsA4MSW7XrikRkk5GBP8028e7wOQylmFbc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=fIMN1muBV6m/cicun+vVeJ3Anxk04puuWU8sJXtTnQMAc/TnrXLFXFezrJlOaqBWW h7vjhyEWdx0mu/1ATEm5YwsaKP3j8GD3p/Y3X/MARfWLsCGXlDdEJ0QxnaxMdkAYc0 KwKjm71jVapE2+PFMkUAwjPqe9Gk4cG5q9XZVxpNBtu3diyFldRMxYLRqPELLqxmm4 6Xrj2IbVV6tb7nr3dA3sr+09twXgCdrvLi2sHDC+AoCU6bYbiyFY1iDggpNRUV/E/b zIY54P3GnIGdWFIyphrx7O8SKDWsY4Q9dEcB/kDheNalcSVG0vYQ+os+uzXPT/DPtO WINE+xgTbzbTw== Date: Tue, 1 Oct 2024 11:08:14 +0300 From: Mike Rapoport To: Patrick Roy Cc: akpm@linux-foundation.org, david@redhat.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, graf@amazon.com, jgowans@amazon.com Subject: Re: [PATCH] secretmem: disable memfd_secret() if arch cannot set direct map Message-ID: References: <20241001080056.784735-1-roypat@amazon.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20241001080056.784735-1-roypat@amazon.co.uk> X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: CC0A318000E X-Stat-Signature: icm4yar4aiobhokrfwogaanoos1jbjft X-HE-Tag: 1727770293-959730 X-HE-Meta: U2FsdGVkX1+I06kZtLzWqtILdoY+e3Y2bvLkxQa+XEKb03/3GHZN4uvXkV/F8M+wqjuSd8lKHkmToozQzZ8p0+h2N3fzKij/yCykC44z7ZuwlWG5NJRMuuu7xtlP8ZAqYcgUWzN7Wy1EgoAdP9FWuSkAew5qj9DgpRwtkuQoDH4cMAaD2S9qEeGtBAQqTUnAmUpmPBAa6jwQLZJEbHLZGTLY9ETFMFGwJDBeE/cwUD6ZvhNlHsqRITY20OUngtn2wjOVZjK8Vh8dHazxAvlkz12kOhdjzO1bhiAgafTBk/mIIh+mxbB0JjGGAnpfudgzLukyZiruVyUq7pAE+uG4BQTsikLvPAgr8acpGJCI2GFqRDkR0VM4XOTBB6H1cL5VH2u4qiY16MQrk1ATZG0y7v4q0EK6+hN10Q1MGyjI3sNyXIePISWnalf4uI4w+3l42zUTuUunlop61L9e4fTNFsqNqP9bWwV88uEQQ+XdkH+w7FEuf0/PnASvOmRgoIvbiR+HUge56Q+/gywU/9806yjrwsCh5Y2U4JgEBuIo1PQZxt1ACN2cbssw9AD9ESRY8Bx5p0AERebZ8aWBHoUga2iRFOvb2XBzzvkpbc2ggLxfrf6xSkMbodEsuJiJrPEjjyQN055JXkyFkO9PdIBGKKS3WggNKpA4gYrln+BIJALPnIZQ9E4s5s8Hr2ycK1dHgBhF2J4axAeODSTxTOfFVkv1lntvO0DDHn/0Zw7Ij+U/jMgHkvtkt9QQnCHXmEy/sMix4xKT7XMNLlX2+eNcFGwoGBbDqcwxhnmHw9769H4pJz4ozdFesQywFj5Ip8Pr0Iv56CHslSszE9g3kxipvbR8eqbxaG4BnQ4mkjxXtPvipVmP+Xn3iYEx1wdQ3ePdJoy2ZL2fhek5VcxdMow+y3GKvvudyvHIzTKiOxsKXsebmQSzR/b0uDkp+nhYf92D61hO8qKNuqB3k9eB0eR mhtuxtRu L7ywnrzs6RjTEB5c3P+A5nLnkT02a1MirYmPaKMW0YnFT5m/BKT86SUrQ7hwxe+Aln31hkt5l8acppETkn+aIzuT8FJ44HzetK+WzHwW6QaTa+DGO0nP29oy3exVgHWWFAwudrf0dJZ1EjAhmOqwQwmAeck/MMEQgVdZGTcWWO7q0/wIkILNmX0Utv5bKXTln5U6GSFntvqx8jhSKcX5h42sLosVVxbCRoqdPGETwvwqGKW0aJCnUGECm0KeV1AznuEJNhrQ/yTVKP3IXAfZabUasveX1W0NCQ+pPvrTRR1IdK1RdEG4warVns523RIjR9pbUQiB25nozqXMBA/B60E44+eK/Ct7MmCbL X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Oct 01, 2024 at 09:00:41AM +0100, Patrick Roy wrote: > Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). > This is the case for example on some arm64 configurations, where marking > 4k PTEs in the direct map not present can only be done if the direct map > is set up at 4k granularity in the first place (as ARM's > break-before-make semantics do not easily allow breaking apart > large/gigantic pages). > > More precisely, on arm64 systems with !can_set_direct_map(), > set_direct_map_invalid_noflush() is a no-op, however it returns success > (0) instead of an error. This means that memfd_secret will seemingly > "work" (e.g. syscall succeeds, you can mmap the fd and fault in pages), > but it does not actually achieve its goal of removing its memory from > the direct map. > > Note that with this patch, memfd_secret() will start erroring on systems > where can_set_direct_map() returns false (arm64 with > CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and > CONFIG_KFENCE=n), but that still seems better than the current silent > failure. Since CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to 'y', most > arm64 systems actually have a working memfd_secret() and aren't be > affected. > > From going through the iterations of the original memfd_secret patch > series, it seems that disabling the syscall in these scenarios was the > intended behavior [1] (preferred over having > set_direct_map_invalid_noflush return an error as that would result in > SIGBUSes at page-fault time), however the check for it got dropped > between v16 [2] and v17 [3], when secretmem moved away from CMA > allocations. > > [1]: https://lore.kernel.org/lkml/20201124164930.GK8537@kernel.org/ > [2]: https://lore.kernel.org/lkml/20210121122723.3446-11-rppt@kernel.org/#t > [3]: https://lore.kernel.org/lkml/20201125092208.12544-10-rppt@kernel.org/ > > Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") > Signed-off-by: Patrick Roy Reviewed-by: Mike Rapoport (Microsoft) > --- > mm/secretmem.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/secretmem.c b/mm/secretmem.c > index 3afb5ad701e14..399552814fd0f 100644 > --- a/mm/secretmem.c > +++ b/mm/secretmem.c > @@ -238,7 +238,7 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags) > /* make sure local flags do not confict with global fcntl.h */ > BUILD_BUG_ON(SECRETMEM_FLAGS_MASK & O_CLOEXEC); > > - if (!secretmem_enable) > + if (!secretmem_enable || !can_set_direct_map()) > return -ENOSYS; > > if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC)) > @@ -280,7 +280,7 @@ static struct file_system_type secretmem_fs = { > > static int __init secretmem_init(void) > { > - if (!secretmem_enable) > + if (!secretmem_enable || !can_set_direct_map()) > return 0; > > secretmem_mnt = kern_mount(&secretmem_fs); > > base-commit: abf2050f51fdca0fd146388f83cddd95a57a008d > -- > 2.46.2 > -- Sincerely yours, Mike.