1 /* 2 * Intel Memory Protection Keys management 3 * Copyright (c) 2015, Intel Corporation. 4 * 5 * This program is free software; you can redistribute it and/or modify it 6 * under the terms and conditions of the GNU General Public License, 7 * version 2, as published by the Free Software Foundation. 8 * 9 * This program is distributed in the hope it will be useful, but WITHOUT 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 12 * more details. 13 */ 14 #include <linux/debugfs.h> /* debugfs_create_u32() */ 15 #include <linux/mm_types.h> /* mm_struct, vma, etc... */ 16 #include <linux/pkeys.h> /* PKEY_* */ 17 #include <uapi/asm-generic/mman-common.h> 18 19 #include <asm/cpufeature.h> /* boot_cpu_has, ... */ 20 #include <asm/mmu_context.h> /* vma_pkey() */ 21 #include <asm/fpu/internal.h> /* fpregs_active() */ 22 23 int __execute_only_pkey(struct mm_struct *mm) 24 { 25 bool need_to_set_mm_pkey = false; 26 int execute_only_pkey = mm->context.execute_only_pkey; 27 int ret; 28 29 /* Do we need to assign a pkey for mm's execute-only maps? */ 30 if (execute_only_pkey == -1) { 31 /* Go allocate one to use, which might fail */ 32 execute_only_pkey = mm_pkey_alloc(mm); 33 if (execute_only_pkey < 0) 34 return -1; 35 need_to_set_mm_pkey = true; 36 } 37 38 /* 39 * We do not want to go through the relatively costly 40 * dance to set PKRU if we do not need to. Check it 41 * first and assume that if the execute-only pkey is 42 * write-disabled that we do not have to set it 43 * ourselves. We need preempt off so that nobody 44 * can make fpregs inactive. 45 */ 46 preempt_disable(); 47 if (!need_to_set_mm_pkey && 48 fpregs_active() && 49 !__pkru_allows_read(read_pkru(), execute_only_pkey)) { 50 preempt_enable(); 51 return execute_only_pkey; 52 } 53 preempt_enable(); 54 55 /* 56 * Set up PKRU so that it denies access for everything 57 * other than execution. 58 */ 59 ret = arch_set_user_pkey_access(current, execute_only_pkey, 60 PKEY_DISABLE_ACCESS); 61 /* 62 * If the PKRU-set operation failed somehow, just return 63 * 0 and effectively disable execute-only support. 64 */ 65 if (ret) { 66 mm_set_pkey_free(mm, execute_only_pkey); 67 return -1; 68 } 69 70 /* We got one, store it and use it from here on out */ 71 if (need_to_set_mm_pkey) 72 mm->context.execute_only_pkey = execute_only_pkey; 73 return execute_only_pkey; 74 } 75 76 static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma) 77 { 78 /* Do this check first since the vm_flags should be hot */ 79 if ((vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) != VM_EXEC) 80 return false; 81 if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey) 82 return false; 83 84 return true; 85 } 86 87 /* 88 * This is only called for *plain* mprotect calls. 89 */ 90 int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey) 91 { 92 /* 93 * Is this an mprotect_pkey() call? If so, never 94 * override the value that came from the user. 95 */ 96 if (pkey != -1) 97 return pkey; 98 /* 99 * Look for a protection-key-drive execute-only mapping 100 * which is now being given permissions that are not 101 * execute-only. Move it back to the default pkey. 102 */ 103 if (vma_is_pkey_exec_only(vma) && 104 (prot & (PROT_READ|PROT_WRITE))) { 105 return 0; 106 } 107 /* 108 * The mapping is execute-only. Go try to get the 109 * execute-only protection key. If we fail to do that, 110 * fall through as if we do not have execute-only 111 * support. 112 */ 113 if (prot == PROT_EXEC) { 114 pkey = execute_only_pkey(vma->vm_mm); 115 if (pkey > 0) 116 return pkey; 117 } 118 /* 119 * This is a vanilla, non-pkey mprotect (or we failed to 120 * setup execute-only), inherit the pkey from the VMA we 121 * are working on. 122 */ 123 return vma_pkey(vma); 124 } 125 126 #define PKRU_AD_KEY(pkey) (PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY)) 127 128 /* 129 * Make the default PKRU value (at execve() time) as restrictive 130 * as possible. This ensures that any threads clone()'d early 131 * in the process's lifetime will not accidentally get access 132 * to data which is pkey-protected later on. 133 */ 134 u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) | 135 PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) | 136 PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) | 137 PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) | 138 PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15); 139 140 /* 141 * Called from the FPU code when creating a fresh set of FPU 142 * registers. This is called from a very specific context where 143 * we know the FPU regstiers are safe for use and we can use PKRU 144 * directly. 145 */ 146 void copy_init_pkru_to_fpregs(void) 147 { 148 u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value); 149 /* 150 * Any write to PKRU takes it out of the XSAVE 'init 151 * state' which increases context switch cost. Avoid 152 * writing 0 when PKRU was already 0. 153 */ 154 if (!init_pkru_value_snapshot && !read_pkru()) 155 return; 156 /* 157 * Override the PKRU state that came from 'init_fpstate' 158 * with the baseline from the process. 159 */ 160 write_pkru(init_pkru_value_snapshot); 161 } 162 163 static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf, 164 size_t count, loff_t *ppos) 165 { 166 char buf[32]; 167 unsigned int len; 168 169 len = sprintf(buf, "0x%x\n", init_pkru_value); 170 return simple_read_from_buffer(user_buf, count, ppos, buf, len); 171 } 172 173 static ssize_t init_pkru_write_file(struct file *file, 174 const char __user *user_buf, size_t count, loff_t *ppos) 175 { 176 char buf[32]; 177 ssize_t len; 178 u32 new_init_pkru; 179 180 len = min(count, sizeof(buf) - 1); 181 if (copy_from_user(buf, user_buf, len)) 182 return -EFAULT; 183 184 /* Make the buffer a valid string that we can not overrun */ 185 buf[len] = '\0'; 186 if (kstrtouint(buf, 0, &new_init_pkru)) 187 return -EINVAL; 188 189 /* 190 * Don't allow insane settings that will blow the system 191 * up immediately if someone attempts to disable access 192 * or writes to pkey 0. 193 */ 194 if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT)) 195 return -EINVAL; 196 197 WRITE_ONCE(init_pkru_value, new_init_pkru); 198 return count; 199 } 200 201 static const struct file_operations fops_init_pkru = { 202 .read = init_pkru_read_file, 203 .write = init_pkru_write_file, 204 .llseek = default_llseek, 205 }; 206 207 static int __init create_init_pkru_value(void) 208 { 209 debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR, 210 arch_debugfs_dir, NULL, &fops_init_pkru); 211 return 0; 212 } 213 late_initcall(create_init_pkru_value); 214 215 static __init int setup_init_pkru(char *opt) 216 { 217 u32 new_init_pkru; 218 219 if (kstrtouint(opt, 0, &new_init_pkru)) 220 return 1; 221 222 WRITE_ONCE(init_pkru_value, new_init_pkru); 223 224 return 1; 225 } 226 __setup("init_pkru=", setup_init_pkru); 227