1/*
  2 * Intel Memory Protection Keys management
  3 * Copyright (c) 2015, Intel Corporation.
  4 *
  5 * This program is free software; you can redistribute it and/or modify it
  6 * under the terms and conditions of the GNU General Public License,
  7 * version 2, as published by the Free Software Foundation.
  8 *
  9 * This program is distributed in the hope it will be useful, but WITHOUT
 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 11 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 12 * more details.
 13 */
 14#include <linux/debugfs.h>		/* debugfs_create_u32()		*/
 15#include <linux/mm_types.h>             /* mm_struct, vma, etc...       */
 16#include <linux/pkeys.h>                /* PKEY_*                       */
 17#include <uapi/asm-generic/mman-common.h>
 18
 19#include <asm/cpufeature.h>             /* boot_cpu_has, ...            */
 20#include <asm/mmu_context.h>            /* vma_pkey()                   */
 
 21
 22int __execute_only_pkey(struct mm_struct *mm)
 23{
 24	bool need_to_set_mm_pkey = false;
 25	int execute_only_pkey = mm->context.execute_only_pkey;
 26	int ret;
 27
 28	/* Do we need to assign a pkey for mm's execute-only maps? */
 29	if (execute_only_pkey == -1) {
 30		/* Go allocate one to use, which might fail */
 31		execute_only_pkey = mm_pkey_alloc(mm);
 32		if (execute_only_pkey < 0)
 33			return -1;
 34		need_to_set_mm_pkey = true;
 35	}
 36
 37	/*
 38	 * We do not want to go through the relatively costly
 39	 * dance to set PKRU if we do not need to.  Check it
 40	 * first and assume that if the execute-only pkey is
 41	 * write-disabled that we do not have to set it
 42	 * ourselves.  We need preempt off so that nobody
 43	 * can make fpregs inactive.
 44	 */
 45	preempt_disable();
 46	if (!need_to_set_mm_pkey &&
 47	    current->thread.fpu.initialized &&
 48	    !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
 49		preempt_enable();
 50		return execute_only_pkey;
 51	}
 52	preempt_enable();
 53
 54	/*
 55	 * Set up PKRU so that it denies access for everything
 56	 * other than execution.
 57	 */
 58	ret = arch_set_user_pkey_access(current, execute_only_pkey,
 59			PKEY_DISABLE_ACCESS);
 60	/*
 61	 * If the PKRU-set operation failed somehow, just return
 62	 * 0 and effectively disable execute-only support.
 63	 */
 64	if (ret) {
 65		mm_set_pkey_free(mm, execute_only_pkey);
 66		return -1;
 67	}
 68
 69	/* We got one, store it and use it from here on out */
 70	if (need_to_set_mm_pkey)
 71		mm->context.execute_only_pkey = execute_only_pkey;
 72	return execute_only_pkey;
 73}
 74
 75static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
 76{
 77	/* Do this check first since the vm_flags should be hot */
 78	if ((vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) != VM_EXEC)
 79		return false;
 80	if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey)
 81		return false;
 82
 83	return true;
 84}
 85
 86/*
 87 * This is only called for *plain* mprotect calls.
 88 */
 89int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey)
 90{
 91	/*
 92	 * Is this an mprotect_pkey() call?  If so, never
 93	 * override the value that came from the user.
 94	 */
 95	if (pkey != -1)
 96		return pkey;
 97
 98	/*
 99	 * The mapping is execute-only.  Go try to get the
100	 * execute-only protection key.  If we fail to do that,
101	 * fall through as if we do not have execute-only
102	 * support in this mm.
103	 */
104	if (prot == PROT_EXEC) {
105		pkey = execute_only_pkey(vma->vm_mm);
106		if (pkey > 0)
107			return pkey;
108	} else if (vma_is_pkey_exec_only(vma)) {
109		/*
110		 * Protections are *not* PROT_EXEC, but the mapping
111		 * is using the exec-only pkey.  This mapping was
112		 * PROT_EXEC and will no longer be.  Move back to
113		 * the default pkey.
114		 */
115		return ARCH_DEFAULT_PKEY;
116	}
117
118	/*
119	 * This is a vanilla, non-pkey mprotect (or we failed to
120	 * setup execute-only), inherit the pkey from the VMA we
121	 * are working on.
122	 */
123	return vma_pkey(vma);
124}
125
126#define PKRU_AD_KEY(pkey)	(PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))
127
128/*
129 * Make the default PKRU value (at execve() time) as restrictive
130 * as possible.  This ensures that any threads clone()'d early
131 * in the process's lifetime will not accidentally get access
132 * to data which is pkey-protected later on.
133 */
134u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) |
135		      PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) |
136		      PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) |
137		      PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) |
138		      PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15);
139
140/*
141 * Called from the FPU code when creating a fresh set of FPU
142 * registers.  This is called from a very specific context where
143 * we know the FPU regstiers are safe for use and we can use PKRU
144 * directly.
145 */
146void copy_init_pkru_to_fpregs(void)
147{
148	u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value);
149	/*
150	 * Any write to PKRU takes it out of the XSAVE 'init
151	 * state' which increases context switch cost.  Avoid
152	 * writing 0 when PKRU was already 0.
153	 */
154	if (!init_pkru_value_snapshot && !read_pkru())
155		return;
156	/*
157	 * Override the PKRU state that came from 'init_fpstate'
158	 * with the baseline from the process.
159	 */
160	write_pkru(init_pkru_value_snapshot);
161}
162
163static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf,
164			     size_t count, loff_t *ppos)
165{
166	char buf[32];
167	unsigned int len;
168
169	len = sprintf(buf, "0x%x\n", init_pkru_value);
170	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
171}
172
173static ssize_t init_pkru_write_file(struct file *file,
174		 const char __user *user_buf, size_t count, loff_t *ppos)
175{
 
176	char buf[32];
177	ssize_t len;
178	u32 new_init_pkru;
179
180	len = min(count, sizeof(buf) - 1);
181	if (copy_from_user(buf, user_buf, len))
182		return -EFAULT;
183
184	/* Make the buffer a valid string that we can not overrun */
185	buf[len] = '\0';
186	if (kstrtouint(buf, 0, &new_init_pkru))
187		return -EINVAL;
188
189	/*
190	 * Don't allow insane settings that will blow the system
191	 * up immediately if someone attempts to disable access
192	 * or writes to pkey 0.
193	 */
194	if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT))
195		return -EINVAL;
196
197	WRITE_ONCE(init_pkru_value, new_init_pkru);
 
 
 
 
198	return count;
199}
200
201static const struct file_operations fops_init_pkru = {
202	.read = init_pkru_read_file,
203	.write = init_pkru_write_file,
204	.llseek = default_llseek,
205};
206
207static int __init create_init_pkru_value(void)
208{
209	debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR,
210			arch_debugfs_dir, NULL, &fops_init_pkru);
211	return 0;
212}
213late_initcall(create_init_pkru_value);
214
215static __init int setup_init_pkru(char *opt)
216{
217	u32 new_init_pkru;
218
219	if (kstrtouint(opt, 0, &new_init_pkru))
220		return 1;
221
222	WRITE_ONCE(init_pkru_value, new_init_pkru);
223
224	return 1;
225}
226__setup("init_pkru=", setup_init_pkru);

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Intel Memory Protection Keys management
  4 * Copyright (c) 2015, Intel Corporation.
 
 
 
 
 
 
 
 
 
  5 */
  6#include <linux/debugfs.h>		/* debugfs_create_u32()		*/
  7#include <linux/mm_types.h>             /* mm_struct, vma, etc...       */
  8#include <linux/pkeys.h>                /* PKEY_*                       */
  9#include <uapi/asm-generic/mman-common.h>
 10
 11#include <asm/cpufeature.h>             /* boot_cpu_has, ...            */
 12#include <asm/mmu_context.h>            /* vma_pkey()                   */
 13#include <asm/fpu/internal.h>		/* init_fpstate			*/
 14
 15int __execute_only_pkey(struct mm_struct *mm)
 16{
 17	bool need_to_set_mm_pkey = false;
 18	int execute_only_pkey = mm->context.execute_only_pkey;
 19	int ret;
 20
 21	/* Do we need to assign a pkey for mm's execute-only maps? */
 22	if (execute_only_pkey == -1) {
 23		/* Go allocate one to use, which might fail */
 24		execute_only_pkey = mm_pkey_alloc(mm);
 25		if (execute_only_pkey < 0)
 26			return -1;
 27		need_to_set_mm_pkey = true;
 28	}
 29
 30	/*
 31	 * We do not want to go through the relatively costly
 32	 * dance to set PKRU if we do not need to.  Check it
 33	 * first and assume that if the execute-only pkey is
 34	 * write-disabled that we do not have to set it
 35	 * ourselves.
 
 36	 */
 
 37	if (!need_to_set_mm_pkey &&
 
 38	    !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
 
 39		return execute_only_pkey;
 40	}
 
 41
 42	/*
 43	 * Set up PKRU so that it denies access for everything
 44	 * other than execution.
 45	 */
 46	ret = arch_set_user_pkey_access(current, execute_only_pkey,
 47			PKEY_DISABLE_ACCESS);
 48	/*
 49	 * If the PKRU-set operation failed somehow, just return
 50	 * 0 and effectively disable execute-only support.
 51	 */
 52	if (ret) {
 53		mm_set_pkey_free(mm, execute_only_pkey);
 54		return -1;
 55	}
 56
 57	/* We got one, store it and use it from here on out */
 58	if (need_to_set_mm_pkey)
 59		mm->context.execute_only_pkey = execute_only_pkey;
 60	return execute_only_pkey;
 61}
 62
 63static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
 64{
 65	/* Do this check first since the vm_flags should be hot */
 66	if ((vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) != VM_EXEC)
 67		return false;
 68	if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey)
 69		return false;
 70
 71	return true;
 72}
 73
 74/*
 75 * This is only called for *plain* mprotect calls.
 76 */
 77int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey)
 78{
 79	/*
 80	 * Is this an mprotect_pkey() call?  If so, never
 81	 * override the value that came from the user.
 82	 */
 83	if (pkey != -1)
 84		return pkey;
 85
 86	/*
 87	 * The mapping is execute-only.  Go try to get the
 88	 * execute-only protection key.  If we fail to do that,
 89	 * fall through as if we do not have execute-only
 90	 * support in this mm.
 91	 */
 92	if (prot == PROT_EXEC) {
 93		pkey = execute_only_pkey(vma->vm_mm);
 94		if (pkey > 0)
 95			return pkey;
 96	} else if (vma_is_pkey_exec_only(vma)) {
 97		/*
 98		 * Protections are *not* PROT_EXEC, but the mapping
 99		 * is using the exec-only pkey.  This mapping was
100		 * PROT_EXEC and will no longer be.  Move back to
101		 * the default pkey.
102		 */
103		return ARCH_DEFAULT_PKEY;
104	}
105
106	/*
107	 * This is a vanilla, non-pkey mprotect (or we failed to
108	 * setup execute-only), inherit the pkey from the VMA we
109	 * are working on.
110	 */
111	return vma_pkey(vma);
112}
113
114#define PKRU_AD_KEY(pkey)	(PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))
115
116/*
117 * Make the default PKRU value (at execve() time) as restrictive
118 * as possible.  This ensures that any threads clone()'d early
119 * in the process's lifetime will not accidentally get access
120 * to data which is pkey-protected later on.
121 */
122u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) |
123		      PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) |
124		      PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) |
125		      PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) |
126		      PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15);
127
128/*
129 * Called from the FPU code when creating a fresh set of FPU
130 * registers.  This is called from a very specific context where
131 * we know the FPU regstiers are safe for use and we can use PKRU
132 * directly.
133 */
134void copy_init_pkru_to_fpregs(void)
135{
136	u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value);
137	/*
 
 
 
 
 
 
 
138	 * Override the PKRU state that came from 'init_fpstate'
139	 * with the baseline from the process.
140	 */
141	write_pkru(init_pkru_value_snapshot);
142}
143
144static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf,
145			     size_t count, loff_t *ppos)
146{
147	char buf[32];
148	unsigned int len;
149
150	len = sprintf(buf, "0x%x\n", init_pkru_value);
151	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
152}
153
154static ssize_t init_pkru_write_file(struct file *file,
155		 const char __user *user_buf, size_t count, loff_t *ppos)
156{
157	struct pkru_state *pk;
158	char buf[32];
159	ssize_t len;
160	u32 new_init_pkru;
161
162	len = min(count, sizeof(buf) - 1);
163	if (copy_from_user(buf, user_buf, len))
164		return -EFAULT;
165
166	/* Make the buffer a valid string that we can not overrun */
167	buf[len] = '\0';
168	if (kstrtouint(buf, 0, &new_init_pkru))
169		return -EINVAL;
170
171	/*
172	 * Don't allow insane settings that will blow the system
173	 * up immediately if someone attempts to disable access
174	 * or writes to pkey 0.
175	 */
176	if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT))
177		return -EINVAL;
178
179	WRITE_ONCE(init_pkru_value, new_init_pkru);
180	pk = get_xsave_addr(&init_fpstate.xsave, XFEATURE_PKRU);
181	if (!pk)
182		return -EINVAL;
183	pk->pkru = new_init_pkru;
184	return count;
185}
186
187static const struct file_operations fops_init_pkru = {
188	.read = init_pkru_read_file,
189	.write = init_pkru_write_file,
190	.llseek = default_llseek,
191};
192
193static int __init create_init_pkru_value(void)
194{
195	debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR,
196			arch_debugfs_dir, NULL, &fops_init_pkru);
197	return 0;
198}
199late_initcall(create_init_pkru_value);
200
201static __init int setup_init_pkru(char *opt)
202{
203	u32 new_init_pkru;
204
205	if (kstrtouint(opt, 0, &new_init_pkru))
206		return 1;
207
208	WRITE_ONCE(init_pkru_value, new_init_pkru);
209
210	return 1;
211}
212__setup("init_pkru=", setup_init_pkru);