2 * Intel Memory Protection Keys management
3 * Copyright (c) 2015, Intel Corporation.
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms and conditions of the GNU General Public License,
7 * version 2, as published by the Free Software Foundation.
9 * This program is distributed in the hope it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 #include <linux/debugfs.h> /* debugfs_create_u32() */
15 #include <linux/mm_types.h> /* mm_struct, vma, etc... */
16 #include <linux/pkeys.h> /* PKEY_* */
17 #include <uapi/asm-generic/mman-common.h>
19 #include <asm/cpufeature.h> /* boot_cpu_has, ... */
20 #include <asm/mmu_context.h> /* vma_pkey() */
21 #include <asm/fpu/internal.h> /* init_fpstate */
23 int __execute_only_pkey(struct mm_struct *mm)
25 bool need_to_set_mm_pkey = false;
26 int execute_only_pkey = mm->context.execute_only_pkey;
29 /* Do we need to assign a pkey for mm's execute-only maps? */
30 if (execute_only_pkey == -1) {
31 /* Go allocate one to use, which might fail */
32 execute_only_pkey = mm_pkey_alloc(mm);
33 if (execute_only_pkey < 0)
35 need_to_set_mm_pkey = true;
39 * We do not want to go through the relatively costly
40 * dance to set PKRU if we do not need to. Check it
41 * first and assume that if the execute-only pkey is
42 * write-disabled that we do not have to set it
45 if (!need_to_set_mm_pkey &&
46 !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
47 return execute_only_pkey;
51 * Set up PKRU so that it denies access for everything
52 * other than execution.
54 ret = arch_set_user_pkey_access(current, execute_only_pkey,
57 * If the PKRU-set operation failed somehow, just return
58 * 0 and effectively disable execute-only support.
61 mm_set_pkey_free(mm, execute_only_pkey);
65 /* We got one, store it and use it from here on out */
66 if (need_to_set_mm_pkey)
67 mm->context.execute_only_pkey = execute_only_pkey;
68 return execute_only_pkey;
71 static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
73 /* Do this check first since the vm_flags should be hot */
74 if ((vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) != VM_EXEC)
76 if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey)
83 * This is only called for *plain* mprotect calls.
85 int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey)
88 * Is this an mprotect_pkey() call? If so, never
89 * override the value that came from the user.
95 * The mapping is execute-only. Go try to get the
96 * execute-only protection key. If we fail to do that,
97 * fall through as if we do not have execute-only
100 if (prot == PROT_EXEC) {
101 pkey = execute_only_pkey(vma->vm_mm);
104 } else if (vma_is_pkey_exec_only(vma)) {
106 * Protections are *not* PROT_EXEC, but the mapping
107 * is using the exec-only pkey. This mapping was
108 * PROT_EXEC and will no longer be. Move back to
111 return ARCH_DEFAULT_PKEY;
115 * This is a vanilla, non-pkey mprotect (or we failed to
116 * setup execute-only), inherit the pkey from the VMA we
119 return vma_pkey(vma);
122 #define PKRU_AD_KEY(pkey) (PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))
125 * Make the default PKRU value (at execve() time) as restrictive
126 * as possible. This ensures that any threads clone()'d early
127 * in the process's lifetime will not accidentally get access
128 * to data which is pkey-protected later on.
130 u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) |
131 PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) |
132 PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) |
133 PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) |
134 PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15);
137 * Called from the FPU code when creating a fresh set of FPU
138 * registers. This is called from a very specific context where
139 * we know the FPU regstiers are safe for use and we can use PKRU
142 void copy_init_pkru_to_fpregs(void)
144 u32 init_pkru_value_snapshot = READ_ONCE(init_pkru_value);
146 * Override the PKRU state that came from 'init_fpstate'
147 * with the baseline from the process.
149 write_pkru(init_pkru_value_snapshot);
152 static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf,
153 size_t count, loff_t *ppos)
158 len = sprintf(buf, "0x%x\n", init_pkru_value);
159 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
162 static ssize_t init_pkru_write_file(struct file *file,
163 const char __user *user_buf, size_t count, loff_t *ppos)
165 struct pkru_state *pk;
170 len = min(count, sizeof(buf) - 1);
171 if (copy_from_user(buf, user_buf, len))
174 /* Make the buffer a valid string that we can not overrun */
176 if (kstrtouint(buf, 0, &new_init_pkru))
180 * Don't allow insane settings that will blow the system
181 * up immediately if someone attempts to disable access
182 * or writes to pkey 0.
184 if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT))
187 WRITE_ONCE(init_pkru_value, new_init_pkru);
188 pk = get_xsave_addr(&init_fpstate.xsave, XFEATURE_PKRU);
191 pk->pkru = new_init_pkru;
195 static const struct file_operations fops_init_pkru = {
196 .read = init_pkru_read_file,
197 .write = init_pkru_write_file,
198 .llseek = default_llseek,
201 static int __init create_init_pkru_value(void)
203 debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR,
204 arch_debugfs_dir, NULL, &fops_init_pkru);
207 late_initcall(create_init_pkru_value);
209 static __init int setup_init_pkru(char *opt)
213 if (kstrtouint(opt, 0, &new_init_pkru))
216 WRITE_ONCE(init_pkru_value, new_init_pkru);
220 __setup("init_pkru=", setup_init_pkru);