Commit | Line | Data |
---|---|---|
2025cf9e | 1 | // SPDX-License-Identifier: GPL-2.0-only |
62b5f7d0 DH |
2 | /* |
3 | * Intel Memory Protection Keys management | |
4 | * Copyright (c) 2015, Intel Corporation. | |
62b5f7d0 | 5 | */ |
76de9937 | 6 | #include <linux/debugfs.h> /* debugfs_create_u32() */ |
62b5f7d0 DH |
7 | #include <linux/mm_types.h> /* mm_struct, vma, etc... */ |
8 | #include <linux/pkeys.h> /* PKEY_* */ | |
9 | #include <uapi/asm-generic/mman-common.h> | |
10 | ||
11 | #include <asm/cpufeature.h> /* boot_cpu_has, ... */ | |
12 | #include <asm/mmu_context.h> /* vma_pkey() */ | |
a5eff725 | 13 | #include <asm/fpu/internal.h> /* init_fpstate */ |
62b5f7d0 DH |
14 | |
15 | int __execute_only_pkey(struct mm_struct *mm) | |
16 | { | |
e8c24d3a DH |
17 | bool need_to_set_mm_pkey = false; |
18 | int execute_only_pkey = mm->context.execute_only_pkey; | |
62b5f7d0 DH |
19 | int ret; |
20 | ||
e8c24d3a DH |
21 | /* Do we need to assign a pkey for mm's execute-only maps? */ |
22 | if (execute_only_pkey == -1) { | |
23 | /* Go allocate one to use, which might fail */ | |
24 | execute_only_pkey = mm_pkey_alloc(mm); | |
25 | if (execute_only_pkey < 0) | |
26 | return -1; | |
27 | need_to_set_mm_pkey = true; | |
28 | } | |
29 | ||
62b5f7d0 DH |
30 | /* |
31 | * We do not want to go through the relatively costly | |
32 | * dance to set PKRU if we do not need to. Check it | |
33 | * first and assume that if the execute-only pkey is | |
34 | * write-disabled that we do not have to set it | |
2722146e | 35 | * ourselves. |
62b5f7d0 | 36 | */ |
e8c24d3a | 37 | if (!need_to_set_mm_pkey && |
e8c24d3a | 38 | !__pkru_allows_read(read_pkru(), execute_only_pkey)) { |
e8c24d3a | 39 | return execute_only_pkey; |
62b5f7d0 | 40 | } |
e8c24d3a DH |
41 | |
42 | /* | |
43 | * Set up PKRU so that it denies access for everything | |
44 | * other than execution. | |
45 | */ | |
46 | ret = arch_set_user_pkey_access(current, execute_only_pkey, | |
62b5f7d0 DH |
47 | PKEY_DISABLE_ACCESS); |
48 | /* | |
49 | * If the PKRU-set operation failed somehow, just return | |
50 | * 0 and effectively disable execute-only support. | |
51 | */ | |
e8c24d3a DH |
52 | if (ret) { |
53 | mm_set_pkey_free(mm, execute_only_pkey); | |
54 | return -1; | |
55 | } | |
62b5f7d0 | 56 | |
e8c24d3a DH |
57 | /* We got one, store it and use it from here on out */ |
58 | if (need_to_set_mm_pkey) | |
59 | mm->context.execute_only_pkey = execute_only_pkey; | |
60 | return execute_only_pkey; | |
62b5f7d0 DH |
61 | } |
62 | ||
63 | static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma) | |
64 | { | |
65 | /* Do this check first since the vm_flags should be hot */ | |
66 | if ((vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) != VM_EXEC) | |
67 | return false; | |
e8c24d3a | 68 | if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey) |
62b5f7d0 DH |
69 | return false; |
70 | ||
71 | return true; | |
72 | } | |
73 | ||
74 | /* | |
75 | * This is only called for *plain* mprotect calls. | |
76 | */ | |
77 | int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey) | |
78 | { | |
79 | /* | |
80 | * Is this an mprotect_pkey() call? If so, never | |
81 | * override the value that came from the user. | |
82 | */ | |
83 | if (pkey != -1) | |
84 | return pkey; | |
0a0b1520 | 85 | |
62b5f7d0 DH |
86 | /* |
87 | * The mapping is execute-only. Go try to get the | |
88 | * execute-only protection key. If we fail to do that, | |
89 | * fall through as if we do not have execute-only | |
0a0b1520 | 90 | * support in this mm. |
62b5f7d0 DH |
91 | */ |
92 | if (prot == PROT_EXEC) { | |
93 | pkey = execute_only_pkey(vma->vm_mm); | |
94 | if (pkey > 0) | |
95 | return pkey; | |
0a0b1520 DH |
96 | } else if (vma_is_pkey_exec_only(vma)) { |
97 | /* | |
98 | * Protections are *not* PROT_EXEC, but the mapping | |
99 | * is using the exec-only pkey. This mapping was | |
100 | * PROT_EXEC and will no longer be. Move back to | |
101 | * the default pkey. | |
102 | */ | |
103 | return ARCH_DEFAULT_PKEY; | |
62b5f7d0 | 104 | } |
0a0b1520 | 105 | |
62b5f7d0 DH |
106 | /* |
107 | * This is a vanilla, non-pkey mprotect (or we failed to | |
108 | * setup execute-only), inherit the pkey from the VMA we | |
109 | * are working on. | |
110 | */ | |
111 | return vma_pkey(vma); | |
112 | } | |
acd547b2 DH |
113 | |
114 | #define PKRU_AD_KEY(pkey) (PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY)) | |
115 | ||
116 | /* | |
117 | * Make the default PKRU value (at execve() time) as restrictive | |
118 | * as possible. This ensures that any threads clone()'d early | |
119 | * in the process's lifetime will not accidentally get access | |
120 | * to data which is pkey-protected later on. | |
121 | */ | |
122 | u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) | | |
123 | PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) | | |
124 | PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) | | |
125 | PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) | | |
126 | PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15); | |
127 | ||
128 | /* | |
129 | * Called from the FPU code when creating a fresh set of FPU | |
130 | * registers. This is called from a very specific context where | |
131 | * we know the FPU regstiers are safe for use and we can use PKRU | |
e6365084 | 132 | * directly. |
acd547b2 DH |
133 | */ |
134 | void copy_init_pkru_to_fpregs(void) | |
135 | { | |
136 | u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value); | |
acd547b2 DH |
137 | /* |
138 | * Override the PKRU state that came from 'init_fpstate' | |
139 | * with the baseline from the process. | |
140 | */ | |
141 | write_pkru(init_pkru_value_snapshot); | |
142 | } | |
76de9937 DH |
143 | |
144 | static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf, | |
145 | size_t count, loff_t *ppos) | |
146 | { | |
147 | char buf[32]; | |
148 | unsigned int len; | |
149 | ||
150 | len = sprintf(buf, "0x%x\n", init_pkru_value); | |
151 | return simple_read_from_buffer(user_buf, count, ppos, buf, len); | |
152 | } | |
153 | ||
154 | static ssize_t init_pkru_write_file(struct file *file, | |
155 | const char __user *user_buf, size_t count, loff_t *ppos) | |
156 | { | |
a5eff725 | 157 | struct pkru_state *pk; |
76de9937 DH |
158 | char buf[32]; |
159 | ssize_t len; | |
160 | u32 new_init_pkru; | |
161 | ||
162 | len = min(count, sizeof(buf) - 1); | |
163 | if (copy_from_user(buf, user_buf, len)) | |
164 | return -EFAULT; | |
165 | ||
166 | /* Make the buffer a valid string that we can not overrun */ | |
167 | buf[len] = '\0'; | |
168 | if (kstrtouint(buf, 0, &new_init_pkru)) | |
169 | return -EINVAL; | |
170 | ||
171 | /* | |
172 | * Don't allow insane settings that will blow the system | |
173 | * up immediately if someone attempts to disable access | |
174 | * or writes to pkey 0. | |
175 | */ | |
176 | if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT)) | |
177 | return -EINVAL; | |
178 | ||
179 | WRITE_ONCE(init_pkru_value, new_init_pkru); | |
a5eff725 SAS |
180 | pk = get_xsave_addr(&init_fpstate.xsave, XFEATURE_PKRU); |
181 | if (!pk) | |
182 | return -EINVAL; | |
183 | pk->pkru = new_init_pkru; | |
76de9937 DH |
184 | return count; |
185 | } | |
186 | ||
187 | static const struct file_operations fops_init_pkru = { | |
188 | .read = init_pkru_read_file, | |
189 | .write = init_pkru_write_file, | |
190 | .llseek = default_llseek, | |
191 | }; | |
192 | ||
193 | static int __init create_init_pkru_value(void) | |
194 | { | |
195 | debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR, | |
196 | arch_debugfs_dir, NULL, &fops_init_pkru); | |
197 | return 0; | |
198 | } | |
199 | late_initcall(create_init_pkru_value); | |
200 | ||
201 | static __init int setup_init_pkru(char *opt) | |
202 | { | |
203 | u32 new_init_pkru; | |
204 | ||
205 | if (kstrtouint(opt, 0, &new_init_pkru)) | |
206 | return 1; | |
207 | ||
208 | WRITE_ONCE(init_pkru_value, new_init_pkru); | |
209 | ||
210 | return 1; | |
211 | } | |
212 | __setup("init_pkru=", setup_init_pkru); |