1
2
3
4
5
6#include <linux/debugfs.h>
7#include <linux/mm_types.h>
8#include <linux/pkeys.h>
9#include <uapi/asm-generic/mman-common.h>
10
11#include <asm/cpufeature.h>
12#include <asm/mmu_context.h>
13
14int __execute_only_pkey(struct mm_struct *mm)
15{
16 bool need_to_set_mm_pkey = false;
17 int execute_only_pkey = mm->context.execute_only_pkey;
18 int ret;
19
20
21 if (execute_only_pkey == -1) {
22
23 execute_only_pkey = mm_pkey_alloc(mm);
24 if (execute_only_pkey < 0)
25 return -1;
26 need_to_set_mm_pkey = true;
27 }
28
29
30
31
32
33
34
35
36 if (!need_to_set_mm_pkey &&
37 !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
38 return execute_only_pkey;
39 }
40
41
42
43
44
45 ret = arch_set_user_pkey_access(current, execute_only_pkey,
46 PKEY_DISABLE_ACCESS);
47
48
49
50
51 if (ret) {
52 mm_set_pkey_free(mm, execute_only_pkey);
53 return -1;
54 }
55
56
57 if (need_to_set_mm_pkey)
58 mm->context.execute_only_pkey = execute_only_pkey;
59 return execute_only_pkey;
60}
61
62static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
63{
64
65 if ((vma->vm_flags & VM_ACCESS_FLAGS) != VM_EXEC)
66 return false;
67 if (vma_pkey(vma) != vma->vm_mm->context.execute_only_pkey)
68 return false;
69
70 return true;
71}
72
73
74
75
76int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey)
77{
78
79
80
81
82 if (pkey != -1)
83 return pkey;
84
85
86
87
88
89
90
91 if (prot == PROT_EXEC) {
92 pkey = execute_only_pkey(vma->vm_mm);
93 if (pkey > 0)
94 return pkey;
95 } else if (vma_is_pkey_exec_only(vma)) {
96
97
98
99
100
101
102 return ARCH_DEFAULT_PKEY;
103 }
104
105
106
107
108
109
110 return vma_pkey(vma);
111}
112
113#define PKRU_AD_KEY(pkey) (PKRU_AD_BIT << ((pkey) * PKRU_BITS_PER_PKEY))
114
115
116
117
118
119
120
121u32 init_pkru_value = PKRU_AD_KEY( 1) | PKRU_AD_KEY( 2) | PKRU_AD_KEY( 3) |
122 PKRU_AD_KEY( 4) | PKRU_AD_KEY( 5) | PKRU_AD_KEY( 6) |
123 PKRU_AD_KEY( 7) | PKRU_AD_KEY( 8) | PKRU_AD_KEY( 9) |
124 PKRU_AD_KEY(10) | PKRU_AD_KEY(11) | PKRU_AD_KEY(12) |
125 PKRU_AD_KEY(13) | PKRU_AD_KEY(14) | PKRU_AD_KEY(15);
126
127static ssize_t init_pkru_read_file(struct file *file, char __user *user_buf,
128 size_t count, loff_t *ppos)
129{
130 char buf[32];
131 unsigned int len;
132
133 len = sprintf(buf, "0x%x\n", init_pkru_value);
134 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
135}
136
137static ssize_t init_pkru_write_file(struct file *file,
138 const char __user *user_buf, size_t count, loff_t *ppos)
139{
140 char buf[32];
141 ssize_t len;
142 u32 new_init_pkru;
143
144 len = min(count, sizeof(buf) - 1);
145 if (copy_from_user(buf, user_buf, len))
146 return -EFAULT;
147
148
149 buf[len] = '\0';
150 if (kstrtouint(buf, 0, &new_init_pkru))
151 return -EINVAL;
152
153
154
155
156
157
158 if (new_init_pkru & (PKRU_AD_BIT|PKRU_WD_BIT))
159 return -EINVAL;
160
161 WRITE_ONCE(init_pkru_value, new_init_pkru);
162 return count;
163}
164
165static const struct file_operations fops_init_pkru = {
166 .read = init_pkru_read_file,
167 .write = init_pkru_write_file,
168 .llseek = default_llseek,
169};
170
171static int __init create_init_pkru_value(void)
172{
173
174 if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
175 return 0;
176
177 debugfs_create_file("init_pkru", S_IRUSR | S_IWUSR,
178 arch_debugfs_dir, NULL, &fops_init_pkru);
179 return 0;
180}
181late_initcall(create_init_pkru_value);
182
183static __init int setup_init_pkru(char *opt)
184{
185 u32 new_init_pkru;
186
187 if (kstrtouint(opt, 0, &new_init_pkru))
188 return 1;
189
190 WRITE_ONCE(init_pkru_value, new_init_pkru);
191
192 return 1;
193}
194__setup("init_pkru=", setup_init_pkru);
195