qiurui
/
glibc
mirror of git://sourceware.org/git/glibc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
glibc/sysdeps/unix/sysv/linux/aarch64/pkey_set.c

114 lines
3.9 KiB
C
Raw Normal View History

AArch64: Add support for memory protection keys This patch adds support for memory protection keys on AArch64 systems with enabled Stage 1 permission overlays feature introduced in Armv8.9 / 9.4 (FEAT_S1POE) [1]. 1. Internal functions "pkey_read" and "pkey_write" to access data associated with memory protection keys. 2. Implementation of API functions "pkey_get" and "pkey_set" for the AArch64 target. 3. AArch64-specific PKEY flags for READ and EXECUTE (see below). 4. New target-specific test that checks behaviour of pkeys on AArch64 targets. 5. This patch also extends existing generic test for pkeys. 6. HWCAP constant for Permission Overlay Extension feature. To support more accurate mapping of underlying permissions to the PKEY flags, we introduce additional AArch64-specific flags. The full list of flags is: - PKEY_UNRESTRICTED: 0x0 (for completeness) - PKEY_DISABLE_ACCESS: 0x1 (existing flag) - PKEY_DISABLE_WRITE: 0x2 (existing flag) - PKEY_DISABLE_EXECUTE: 0x4 (new flag, AArch64 specific) - PKEY_DISABLE_READ: 0x8 (new flag, AArch64 specific) The problem here is that PKEY_DISABLE_ACCESS has unusual semantics as it overlaps with existing PKEY_DISABLE_WRITE and new PKEY_DISABLE_READ. For this reason mapping between permission bits RWX and "restrictions" bits awxr (a for disable access, etc) becomes complicated: - PKEY_DISABLE_ACCESS disables both R and W - PKEY_DISABLE_{WRITE,READ} disables W and R respectively - PKEY_DISABLE_EXECUTE disables X Combinations like the one below are accepted although they are redundant: - PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ | PKEY_DISABLE_WRITE Reverse mapping tries to retain backward compatibility and ORs PKEY_DISABLE_ACCESS whenever both flags PKEY_DISABLE_READ and PKEY_DISABLE_WRITE would be present. This will break code that compares pkey_get output with == instead of using bitwise operations. The latter is more correct since PKEY_* constants are essentially bit flags. It should be noted that PKEY_DISABLE_ACCESS does not prevent execution. [1] https://developer.arm.com/documentation/ddi0487/ka/ section D8.4.1.4 Co-authored-by: Szabolcs Nagy <szabolcs.nagy@arm.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2024-11-20 11:16:36 +00:00
/* Changing the per-thread memory protection key, AArch64 version.
Update copyright dates with scripts/update-copyrights
2025-01-01 18:14:45 +00:00
Copyright (C) 2024-2025 Free Software Foundation, Inc.
AArch64: Add support for memory protection keys This patch adds support for memory protection keys on AArch64 systems with enabled Stage 1 permission overlays feature introduced in Armv8.9 / 9.4 (FEAT_S1POE) [1]. 1. Internal functions "pkey_read" and "pkey_write" to access data associated with memory protection keys. 2. Implementation of API functions "pkey_get" and "pkey_set" for the AArch64 target. 3. AArch64-specific PKEY flags for READ and EXECUTE (see below). 4. New target-specific test that checks behaviour of pkeys on AArch64 targets. 5. This patch also extends existing generic test for pkeys. 6. HWCAP constant for Permission Overlay Extension feature. To support more accurate mapping of underlying permissions to the PKEY flags, we introduce additional AArch64-specific flags. The full list of flags is: - PKEY_UNRESTRICTED: 0x0 (for completeness) - PKEY_DISABLE_ACCESS: 0x1 (existing flag) - PKEY_DISABLE_WRITE: 0x2 (existing flag) - PKEY_DISABLE_EXECUTE: 0x4 (new flag, AArch64 specific) - PKEY_DISABLE_READ: 0x8 (new flag, AArch64 specific) The problem here is that PKEY_DISABLE_ACCESS has unusual semantics as it overlaps with existing PKEY_DISABLE_WRITE and new PKEY_DISABLE_READ. For this reason mapping between permission bits RWX and "restrictions" bits awxr (a for disable access, etc) becomes complicated: - PKEY_DISABLE_ACCESS disables both R and W - PKEY_DISABLE_{WRITE,READ} disables W and R respectively - PKEY_DISABLE_EXECUTE disables X Combinations like the one below are accepted although they are redundant: - PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ | PKEY_DISABLE_WRITE Reverse mapping tries to retain backward compatibility and ORs PKEY_DISABLE_ACCESS whenever both flags PKEY_DISABLE_READ and PKEY_DISABLE_WRITE would be present. This will break code that compares pkey_get output with == instead of using bitwise operations. The latter is more correct since PKEY_* constants are essentially bit flags. It should be noted that PKEY_DISABLE_ACCESS does not prevent execution. [1] https://developer.arm.com/documentation/ddi0487/ka/ section D8.4.1.4 Co-authored-by: Szabolcs Nagy <szabolcs.nagy@arm.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2024-11-20 11:16:36 +00:00
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <arch-pkey.h>
#include <errno.h>
#include <sys/mman.h>
#define MAX_PKEY_RIGHTS (PKEY_DISABLE_ACCESS | \
PKEY_DISABLE_WRITE | PKEY_DISABLE_EXECUTE | PKEY_DISABLE_READ)
int
pkey_set (int key, unsigned int restrictions)
{
if (key < 0 || key > 15 || restrictions > MAX_PKEY_RIGHTS)
{
__set_errno (EINVAL);
return -1;
}
unsigned long mask = S1POE_PERM_MASK << (S1POE_BITS_PER_POI * key);
unsigned long por_el0 = pkey_read ();
unsigned long perm;
/* POR ot PKEY mapping: -WXR
PKEY_UNRESTRICTED => 0111 (read-write-execute)
PKEY_DISABLE_ACCESS => removes R and W access
PKEY_DISABLE_READ => removes R access
PKEY_DISABLE_WRITE => removes W access
PKEY_DISABLE_EXECUTE => removes X access
Either of PKEY_DISABLE_ACCESS or PKEY_DISABLE_READ removes R access.
Either of PKEY_DISABLE_ACCESS or PKEY_DISABLE_WRITE removes W access.
Using PKEY_DISABLE_ACCESS along with only one of PKEY_DISABLE_READ or
PKEY_DISABLE_WRITE is considered to be in error.
Furthermore, for avoidance of doubt:
PKEY flags Permissions
rxwa -WXR
1111 => 0000 S1POE_PERM_NO_ACCESS
1110 => 0000 S1POE_PERM_NO_ACCESS
1101 => EINVAL
1100 => 0100 S1POE_PERM_W
1011 => 0010 S1POE_PERM_X
1010 => 0010 S1POE_PERM_X
1001 => EINVAL
1000 => 0110 S1POE_PERM_WX
0111 => EINVAL
0110 => 0001 S1POE_PERM_R
0101 => 0000 S1POE_PERM_NO_ACCESS
0100 => 0101 S1POE_PERM_RW
0011 => EINVAL
0010 => 0011 S1POE_PERM_RX
0001 => 0010 S1POE_PERM_X
0000 => 0111 S1POE_PERM_RWX */
switch (restrictions)
{
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ | PKEY_DISABLE_WRITE
| PKEY_DISABLE_EXECUTE:
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_EXECUTE:
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ | PKEY_DISABLE_EXECUTE:
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE | PKEY_DISABLE_EXECUTE:
case PKEY_DISABLE_READ | PKEY_DISABLE_WRITE | PKEY_DISABLE_EXECUTE:
perm = S1POE_PERM_NO_ACCESS;
break;
case PKEY_DISABLE_READ | PKEY_DISABLE_EXECUTE:
perm = S1POE_PERM_W;
break;
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ:
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE:
case PKEY_DISABLE_ACCESS | PKEY_DISABLE_READ | PKEY_DISABLE_WRITE:
case PKEY_DISABLE_READ | PKEY_DISABLE_WRITE:
case PKEY_DISABLE_ACCESS:
perm = S1POE_PERM_X;
break;
case PKEY_DISABLE_READ:
perm = S1POE_PERM_WX;
break;
case PKEY_DISABLE_WRITE | PKEY_DISABLE_EXECUTE:
perm = S1POE_PERM_R;
break;
case PKEY_DISABLE_EXECUTE:
perm = S1POE_PERM_RW;
break;
case PKEY_DISABLE_WRITE:
perm = S1POE_PERM_RX;
break;
case PKEY_UNRESTRICTED:
perm = S1POE_PERM_RWX;
break;
default:
__set_errno (EINVAL);
return -1;
}
por_el0 = (por_el0 & ~mask) | (perm << (S1POE_BITS_PER_POI * key));
pkey_write (por_el0);
return 0;
}