x86/mm/pkeys.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Intel Memory Protection Keys management
0004  * Copyright (c) 2015, Intel Corporation.
0005  */
0006 #include <linux/debugfs.h>      /* debugfs_create_u32()     */
0007 #include <linux/mm_types.h>             /* mm_struct, vma, etc...       */
0008 #include <linux/pkeys.h>                /* PKEY_*                       */
0009 #include <uapi/asm-generic/mman-common.h>
0010
0011 #include <asm/cpufeature.h>             /* boot_cpu_has, ...            */
0012 #include <asm/mmu_context.h>            /* vma_pkey()                   */
0013
0014 int __execute_only_pkey(struct mm_struct *mm)
0015 {
0016     bool need_to_set_mm_pkey = false;
0017     int execute_only_pkey = mm->context.execute_only_pkey;
0018     int ret;
0019
0020     /* Do we need to assign a pkey for mm's execute-only maps? */
0021     if (execute_only_pkey == -1) {
0022         /* Go allocate one to use, which might fail */
0023         execute_only_pkey = mm_pkey_alloc(mm);
0024         if (execute_only_pkey < 0)
0025             return -1;
0026         need_to_set_mm_pkey = true;
0027     }
0028
0029     /*
0030      * We do not want to go through the relatively costly
0031      * dance to set PKRU if we do not need to.  Check it
0032      * first and assume that if the execute-only pkey is
0033      * write-disabled that we do not have to set it
0034      * ourselves.
0035      */
0036     if (!need_to_set_mm_pkey &&
0037         !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
0038         return execute_only_pkey;
0039     }
0040
0041     /*
0042      * Set up PKRU so that it denies access for everything
0043      * other than execution.
0044      */
0045     ret = arch_set_user_pkey_access(current, execute_only_pkey,
0046             PKEY_DISABLE_ACCESS);
0047     /*
0048      * If the PKRU-set operation failed somehow, just return
0049      * 0 and effectively disable execute-only support.
0050      */
0051     if (ret) {
0052         mm_set_pkey_free(mm, execute_only_pkey);
0053         return -1;
0054     }
0055
0056     /* We got one, store it and use it from here on out */
0057     if (need_to_set_mm_pkey)
0058         mm->context.execute_only_pkey = execute_only_pkey;
0059     return execute_only_pkey;
0060 }
0061
0062 static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
0063 {
0064     /* Do this check first since the vm_flags should be hot */
0065     if ((vma->vm_flags & VM_ACCESS_FLAGS) != VM_EXEC)
0066         return false;
0067     if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey)
0068         return false;
0069
0070     return true;
0071 }
0072
0073 /*
0074  * This is only called for *plain* mprotect calls.
0075  */
0076 int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey)
0077 {
0078     /*
0079      * Is this an mprotect_pkey() call?  If so, never
0080      * override the value that came from the user.
0081      */
0082     if (pkey != -1)
0083         return pkey;
0084
0085     /*
0086      * The mapping is execute-only.  Go try to get the
0087      * execute-only protection key.  If we fail to do that,
0088      * fall through as if we do not have execute-only
0089      * support in this mm.
0090      */
0091     if (prot == PROT_EXEC) {
0092         pkey = execute_only_pkey(vma->vm_mm);
0093         if (pkey > 0)
0094             return pkey;
0095     } else if (vma_is_pkey_exec_only(vma)) {
0096         /*
0097          * Protections are *not* PROT_EXEC, but the mapping
0098          * is using the exec-only pkey.  This mapping was
0099          * PROT_EXEC and will no longer be.  Move back to
0100          * the default pkey.
0101          */
0102         return ARCH_DEFAULT_PKEY;
0103     }
0104
0105     /*
0106      * This is a vanilla, non-pkey mprotect (or we failed to
0107      * setup execute-only), inherit the pkey from the VMA we
0108      * are working on.
0109      */
0110     return vma_pkey(vma);
0111 }
0112
0113 #define PKRU_AD_MASK(pkey)  (PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))
0114
0115 /*
0116  * Make the default PKRU value (at execve() time) as restrictive
0117  * as possible.  This ensures that any threads clone()'d early
0118  * in the process's lifetime will not accidentally get access
0119  * to data which is pkey-protected later on.
0120  */
0121 u32 init_pkru_value = PKRU_AD_MASK( 1) | PKRU_AD_MASK( 2) |
0122               PKRU_AD_MASK( 3) | PKRU_AD_MASK( 4) |
0123               PKRU_AD_MASK( 5) | PKRU_AD_MASK( 6) |
0124               PKRU_AD_MASK( 7) | PKRU_AD_MASK( 8) |
0125               PKRU_AD_MASK( 9) | PKRU_AD_MASK(10) |
0126               PKRU_AD_MASK(11) | PKRU_AD_MASK(12) |
0127               PKRU_AD_MASK(13) | PKRU_AD_MASK(14) |
0128               PKRU_AD_MASK(15);
0129
0130 static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf,
0131                  size_t count, loff_t *ppos)
0132 {
0133     char buf[32];
0134     unsigned int len;
0135
0136     len = sprintf(buf, "0x%x\n", init_pkru_value);
0137     return simple_read_from_buffer(user_buf, count, ppos, buf, len);
0138 }
0139
0140 static ssize_t init_pkru_write_file(struct file *file,
0141          const char __user *user_buf, size_t count, loff_t *ppos)
0142 {
0143     char buf[32];
0144     ssize_t len;
0145     u32 new_init_pkru;
0146
0147     len = min(count, sizeof(buf) - 1);
0148     if (copy_from_user(buf, user_buf, len))
0149         return -EFAULT;
0150
0151     /* Make the buffer a valid string that we can not overrun */
0152     buf[len] = '\0';
0153     if (kstrtouint(buf, 0, &new_init_pkru))
0154         return -EINVAL;
0155
0156     /*
0157      * Don't allow insane settings that will blow the system
0158      * up immediately if someone attempts to disable access
0159      * or writes to pkey 0.
0160      */
0161     if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT))
0162         return -EINVAL;
0163
0164     WRITE_ONCE(init_pkru_value, new_init_pkru);
0165     return count;
0166 }
0167
0168 static const struct file_operations fops_init_pkru = {
0169     .read = init_pkru_read_file,
0170     .write = init_pkru_write_file,
0171     .llseek = default_llseek,
0172 };
0173
0174 static int __init create_init_pkru_value(void)
0175 {
0176     /* Do not expose the file if pkeys are not supported. */
0177     if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
0178         return 0;
0179
0180     debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR,
0181             arch_debugfs_dir, NULL, &fops_init_pkru);
0182     return 0;
0183 }
0184 late_initcall(create_init_pkru_value);
0185
0186 static __init int setup_init_pkru(char *opt)
0187 {
0188     u32 new_init_pkru;
0189
0190     if (kstrtouint(opt, 0, &new_init_pkru))
0191         return 1;
0192
0193     WRITE_ONCE(init_pkru_value, new_init_pkru);
0194
0195     return 1;
0196 }
0197 __setup("init_pkru=", setup_init_pkru);