cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

uprobes.c (10057B)

      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 *  User-space Probes (UProbes) for s390
      4 *
      5 *    Copyright IBM Corp. 2014
      6 *    Author(s): Jan Willeke,
      7 */
      8
      9#include <linux/uaccess.h>
     10#include <linux/uprobes.h>
     11#include <linux/compat.h>
     12#include <linux/kdebug.h>
     13#include <linux/sched/task_stack.h>
     14
     15#include <asm/switch_to.h>
     16#include <asm/facility.h>
     17#include <asm/kprobes.h>
     18#include <asm/dis.h>
     19#include "entry.h"
     20
     21#define	UPROBE_TRAP_NR	UINT_MAX
     22
     23int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
     24			     unsigned long addr)
     25{
     26	return probe_is_prohibited_opcode(auprobe->insn);
     27}
     28
     29int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
     30{
     31	if (psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT)
     32		return -EINVAL;
     33	if (!is_compat_task() && psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT)
     34		return -EINVAL;
     35	clear_thread_flag(TIF_PER_TRAP);
     36	auprobe->saved_per = psw_bits(regs->psw).per;
     37	auprobe->saved_int_code = regs->int_code;
     38	regs->int_code = UPROBE_TRAP_NR;
     39	regs->psw.addr = current->utask->xol_vaddr;
     40	set_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
     41	update_cr_regs(current);
     42	return 0;
     43}
     44
     45bool arch_uprobe_xol_was_trapped(struct task_struct *tsk)
     46{
     47	struct pt_regs *regs = task_pt_regs(tsk);
     48
     49	if (regs->int_code != UPROBE_TRAP_NR)
     50		return true;
     51	return false;
     52}
     53
     54static int check_per_event(unsigned short cause, unsigned long control,
     55			   struct pt_regs *regs)
     56{
     57	if (!(regs->psw.mask & PSW_MASK_PER))
     58		return 0;
     59	/* user space single step */
     60	if (control == 0)
     61		return 1;
     62	/* over indication for storage alteration */
     63	if ((control & 0x20200000) && (cause & 0x2000))
     64		return 1;
     65	if (cause & 0x8000) {
     66		/* all branches */
     67		if ((control & 0x80800000) == 0x80000000)
     68			return 1;
     69		/* branch into selected range */
     70		if (((control & 0x80800000) == 0x80800000) &&
     71		    regs->psw.addr >= current->thread.per_user.start &&
     72		    regs->psw.addr <= current->thread.per_user.end)
     73			return 1;
     74	}
     75	return 0;
     76}
     77
     78int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
     79{
     80	int fixup = probe_get_fixup_type(auprobe->insn);
     81	struct uprobe_task *utask = current->utask;
     82
     83	clear_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
     84	update_cr_regs(current);
     85	psw_bits(regs->psw).per = auprobe->saved_per;
     86	regs->int_code = auprobe->saved_int_code;
     87
     88	if (fixup & FIXUP_PSW_NORMAL)
     89		regs->psw.addr += utask->vaddr - utask->xol_vaddr;
     90	if (fixup & FIXUP_RETURN_REGISTER) {
     91		int reg = (auprobe->insn[0] & 0xf0) >> 4;
     92
     93		regs->gprs[reg] += utask->vaddr - utask->xol_vaddr;
     94	}
     95	if (fixup & FIXUP_BRANCH_NOT_TAKEN) {
     96		int ilen = insn_length(auprobe->insn[0] >> 8);
     97
     98		if (regs->psw.addr - utask->xol_vaddr == ilen)
     99			regs->psw.addr = utask->vaddr + ilen;
    100	}
    101	if (check_per_event(current->thread.per_event.cause,
    102			    current->thread.per_user.control, regs)) {
    103		/* fix per address */
    104		current->thread.per_event.address = utask->vaddr;
    105		/* trigger per event */
    106		set_thread_flag(TIF_PER_TRAP);
    107	}
    108	return 0;
    109}
    110
    111int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val,
    112				 void *data)
    113{
    114	struct die_args *args = data;
    115	struct pt_regs *regs = args->regs;
    116
    117	if (!user_mode(regs))
    118		return NOTIFY_DONE;
    119	if (regs->int_code & 0x200) /* Trap during transaction */
    120		return NOTIFY_DONE;
    121	switch (val) {
    122	case DIE_BPT:
    123		if (uprobe_pre_sstep_notifier(regs))
    124			return NOTIFY_STOP;
    125		break;
    126	case DIE_SSTEP:
    127		if (uprobe_post_sstep_notifier(regs))
    128			return NOTIFY_STOP;
    129		break;
    130	default:
    131		break;
    132	}
    133	return NOTIFY_DONE;
    134}
    135
    136void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
    137{
    138	clear_thread_flag(TIF_UPROBE_SINGLESTEP);
    139	regs->int_code = auprobe->saved_int_code;
    140	regs->psw.addr = current->utask->vaddr;
    141	current->thread.per_event.address = current->utask->vaddr;
    142}
    143
    144unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
    145						struct pt_regs *regs)
    146{
    147	unsigned long orig;
    148
    149	orig = regs->gprs[14];
    150	regs->gprs[14] = trampoline;
    151	return orig;
    152}
    153
    154bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
    155			     struct pt_regs *regs)
    156{
    157	if (ctx == RP_CHECK_CHAIN_CALL)
    158		return user_stack_pointer(regs) <= ret->stack;
    159	else
    160		return user_stack_pointer(regs) < ret->stack;
    161}
    162
    163/* Instruction Emulation */
    164
    165static void adjust_psw_addr(psw_t *psw, unsigned long len)
    166{
    167	psw->addr = __rewind_psw(*psw, -len);
    168}
    169
    170#define EMU_ILLEGAL_OP		1
    171#define EMU_SPECIFICATION	2
    172#define EMU_ADDRESSING		3
    173
    174#define emu_load_ril(ptr, output)			\
    175({							\
    176	unsigned int mask = sizeof(*(ptr)) - 1;		\
    177	__typeof__(*(ptr)) input;			\
    178	int __rc = 0;					\
    179							\
    180	if ((u64 __force)ptr & mask)			\
    181		__rc = EMU_SPECIFICATION;		\
    182	else if (get_user(input, ptr))			\
    183		__rc = EMU_ADDRESSING;			\
    184	else						\
    185		*(output) = input;			\
    186	__rc;						\
    187})
    188
    189#define emu_store_ril(regs, ptr, input)			\
    190({							\
    191	unsigned int mask = sizeof(*(ptr)) - 1;		\
    192	__typeof__(ptr) __ptr = (ptr);			\
    193	int __rc = 0;					\
    194							\
    195	if ((u64 __force)__ptr & mask)			\
    196		__rc = EMU_SPECIFICATION;		\
    197	else if (put_user(*(input), __ptr))		\
    198		__rc = EMU_ADDRESSING;			\
    199	if (__rc == 0)					\
    200		sim_stor_event(regs,			\
    201			       (void __force *)__ptr,	\
    202			       mask + 1);		\
    203	__rc;						\
    204})
    205
    206#define emu_cmp_ril(regs, ptr, cmp)			\
    207({							\
    208	unsigned int mask = sizeof(*(ptr)) - 1;		\
    209	__typeof__(*(ptr)) input;			\
    210	int __rc = 0;					\
    211							\
    212	if ((u64 __force)ptr & mask)			\
    213		__rc = EMU_SPECIFICATION;		\
    214	else if (get_user(input, ptr))			\
    215		__rc = EMU_ADDRESSING;			\
    216	else if (input > *(cmp))			\
    217		psw_bits((regs)->psw).cc = 1;		\
    218	else if (input < *(cmp))			\
    219		psw_bits((regs)->psw).cc = 2;		\
    220	else						\
    221		psw_bits((regs)->psw).cc = 0;		\
    222	__rc;						\
    223})
    224
    225struct insn_ril {
    226	u8 opc0;
    227	u8 reg	: 4;
    228	u8 opc1 : 4;
    229	s32 disp;
    230} __packed;
    231
    232union split_register {
    233	u64 u64;
    234	u32 u32[2];
    235	u16 u16[4];
    236	s64 s64;
    237	s32 s32[2];
    238	s16 s16[4];
    239};
    240
    241/*
    242 * If user per registers are setup to trace storage alterations and an
    243 * emulated store took place on a fitting address a user trap is generated.
    244 */
    245static void sim_stor_event(struct pt_regs *regs, void *addr, int len)
    246{
    247	if (!(regs->psw.mask & PSW_MASK_PER))
    248		return;
    249	if (!(current->thread.per_user.control & PER_EVENT_STORE))
    250		return;
    251	if ((void *)current->thread.per_user.start > (addr + len))
    252		return;
    253	if ((void *)current->thread.per_user.end < addr)
    254		return;
    255	current->thread.per_event.address = regs->psw.addr;
    256	current->thread.per_event.cause = PER_EVENT_STORE >> 16;
    257	set_thread_flag(TIF_PER_TRAP);
    258}
    259
    260/*
    261 * pc relative instructions are emulated, since parameters may not be
    262 * accessible from the xol area due to range limitations.
    263 */
    264static void handle_insn_ril(struct arch_uprobe *auprobe, struct pt_regs *regs)
    265{
    266	union split_register *rx;
    267	struct insn_ril *insn;
    268	unsigned int ilen;
    269	void *uptr;
    270	int rc = 0;
    271
    272	insn = (struct insn_ril *) &auprobe->insn;
    273	rx = (union split_register *) &regs->gprs[insn->reg];
    274	uptr = (void *)(regs->psw.addr + (insn->disp * 2));
    275	ilen = insn_length(insn->opc0);
    276
    277	switch (insn->opc0) {
    278	case 0xc0:
    279		switch (insn->opc1) {
    280		case 0x00: /* larl */
    281			rx->u64 = (unsigned long)uptr;
    282			break;
    283		}
    284		break;
    285	case 0xc4:
    286		switch (insn->opc1) {
    287		case 0x02: /* llhrl */
    288			rc = emu_load_ril((u16 __user *)uptr, &rx->u32[1]);
    289			break;
    290		case 0x04: /* lghrl */
    291			rc = emu_load_ril((s16 __user *)uptr, &rx->u64);
    292			break;
    293		case 0x05: /* lhrl */
    294			rc = emu_load_ril((s16 __user *)uptr, &rx->u32[1]);
    295			break;
    296		case 0x06: /* llghrl */
    297			rc = emu_load_ril((u16 __user *)uptr, &rx->u64);
    298			break;
    299		case 0x08: /* lgrl */
    300			rc = emu_load_ril((u64 __user *)uptr, &rx->u64);
    301			break;
    302		case 0x0c: /* lgfrl */
    303			rc = emu_load_ril((s32 __user *)uptr, &rx->u64);
    304			break;
    305		case 0x0d: /* lrl */
    306			rc = emu_load_ril((u32 __user *)uptr, &rx->u32[1]);
    307			break;
    308		case 0x0e: /* llgfrl */
    309			rc = emu_load_ril((u32 __user *)uptr, &rx->u64);
    310			break;
    311		case 0x07: /* sthrl */
    312			rc = emu_store_ril(regs, (u16 __user *)uptr, &rx->u16[3]);
    313			break;
    314		case 0x0b: /* stgrl */
    315			rc = emu_store_ril(regs, (u64 __user *)uptr, &rx->u64);
    316			break;
    317		case 0x0f: /* strl */
    318			rc = emu_store_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
    319			break;
    320		}
    321		break;
    322	case 0xc6:
    323		switch (insn->opc1) {
    324		case 0x04: /* cghrl */
    325			rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s64);
    326			break;
    327		case 0x05: /* chrl */
    328			rc = emu_cmp_ril(regs, (s16 __user *)uptr, &rx->s32[1]);
    329			break;
    330		case 0x06: /* clghrl */
    331			rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u64);
    332			break;
    333		case 0x07: /* clhrl */
    334			rc = emu_cmp_ril(regs, (u16 __user *)uptr, &rx->u32[1]);
    335			break;
    336		case 0x08: /* cgrl */
    337			rc = emu_cmp_ril(regs, (s64 __user *)uptr, &rx->s64);
    338			break;
    339		case 0x0a: /* clgrl */
    340			rc = emu_cmp_ril(regs, (u64 __user *)uptr, &rx->u64);
    341			break;
    342		case 0x0c: /* cgfrl */
    343			rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s64);
    344			break;
    345		case 0x0d: /* crl */
    346			rc = emu_cmp_ril(regs, (s32 __user *)uptr, &rx->s32[1]);
    347			break;
    348		case 0x0e: /* clgfrl */
    349			rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u64);
    350			break;
    351		case 0x0f: /* clrl */
    352			rc = emu_cmp_ril(regs, (u32 __user *)uptr, &rx->u32[1]);
    353			break;
    354		}
    355		break;
    356	}
    357	adjust_psw_addr(&regs->psw, ilen);
    358	switch (rc) {
    359	case EMU_ILLEGAL_OP:
    360		regs->int_code = ilen << 16 | 0x0001;
    361		do_report_trap(regs, SIGILL, ILL_ILLOPC, NULL);
    362		break;
    363	case EMU_SPECIFICATION:
    364		regs->int_code = ilen << 16 | 0x0006;
    365		do_report_trap(regs, SIGILL, ILL_ILLOPC , NULL);
    366		break;
    367	case EMU_ADDRESSING:
    368		regs->int_code = ilen << 16 | 0x0005;
    369		do_report_trap(regs, SIGSEGV, SEGV_MAPERR, NULL);
    370		break;
    371	}
    372}
    373
    374bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
    375{
    376	if ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT) ||
    377	    ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT) &&
    378	     !is_compat_task())) {
    379		regs->psw.addr = __rewind_psw(regs->psw, UPROBE_SWBP_INSN_SIZE);
    380		do_report_trap(regs, SIGILL, ILL_ILLADR, NULL);
    381		return true;
    382	}
    383	if (probe_is_insn_relative_long(auprobe->insn)) {
    384		handle_insn_ril(auprobe, regs);
    385		return true;
    386	}
    387	return false;
    388}