// SPDX-License-Identifier: GPL-2.0 /* * Standard user space access functions based on mvcp/mvcs and doing * interesting things in the secondary space mode. * * Copyright IBM Corp. 2006,2014 * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com), * Gerald Schaefer (gerald.schaefer@de.ibm.com) */ #include #include #include #include #include #include #include #ifdef CONFIG_DEBUG_ENTRY void debug_user_asce(int exit) { struct lowcore *lc = get_lowcore(); struct ctlreg cr1, cr7; local_ctl_store(1, &cr1); local_ctl_store(7, &cr7); if (cr1.val == lc->user_asce.val && cr7.val == lc->user_asce.val) return; panic("incorrect ASCE on kernel %s\n" "cr1: %016lx cr7: %016lx\n" "kernel: %016lx user: %016lx\n", exit ? "exit" : "entry", cr1.val, cr7.val, lc->kernel_asce.val, lc->user_asce.val); } #endif /*CONFIG_DEBUG_ENTRY */ union oac { unsigned int val; struct { struct { unsigned short key : 4; unsigned short : 4; unsigned short as : 2; unsigned short : 4; unsigned short k : 1; unsigned short a : 1; } oac1; struct { unsigned short key : 4; unsigned short : 4; unsigned short as : 2; unsigned short : 4; unsigned short k : 1; unsigned short a : 1; } oac2; }; }; static uaccess_kmsan_or_inline __must_check unsigned long raw_copy_from_user_key(void *to, const void __user *from, unsigned long size, unsigned long key) { unsigned long osize; union oac spec = { .oac2.key = key, .oac2.as = PSW_BITS_AS_SECONDARY, .oac2.k = 1, .oac2.a = 1, }; int cc; while (1) { osize = size; asm_inline volatile( " lr %%r0,%[spec]\n" "0: mvcos %[to],%[from],%[size]\n" "1: nopr %%r7\n" CC_IPM(cc) EX_TABLE_UA_MVCOS_FROM(0b, 0b) EX_TABLE_UA_MVCOS_FROM(1b, 0b) : CC_OUT(cc, cc), [size] "+d" (size), [to] "=Q" (*(char *)to) : [spec] "d" (spec.val), [from] "Q" (*(const char __user *)from) : CC_CLOBBER_LIST("memory", "0")); if (CC_TRANSFORM(cc) == 0) return osize - size; size -= 4096; to += 4096; from += 4096; } } unsigned long _copy_from_user_key(void *to, const void __user *from, unsigned long n, unsigned long key) { unsigned long res = n; might_fault(); if (!should_fail_usercopy()) { instrument_copy_from_user_before(to, from, n); res = raw_copy_from_user_key(to, from, n, key); instrument_copy_from_user_after(to, from, n, res); } if (unlikely(res)) memset(to + (n - res), 0, res); return res; } EXPORT_SYMBOL(_copy_from_user_key); static uaccess_kmsan_or_inline __must_check unsigned long raw_copy_to_user_key(void __user *to, const void *from, unsigned long size, unsigned long key) { unsigned long osize; union oac spec = { .oac1.key = key, .oac1.as = PSW_BITS_AS_SECONDARY, .oac1.k = 1, .oac1.a = 1, }; int cc; while (1) { osize = size; asm_inline volatile( " lr %%r0,%[spec]\n" "0: mvcos %[to],%[from],%[size]\n" "1: nopr %%r7\n" CC_IPM(cc) EX_TABLE_UA_MVCOS_TO(0b, 0b) EX_TABLE_UA_MVCOS_TO(1b, 0b) : CC_OUT(cc, cc), [size] "+d" (size), [to] "=Q" (*(char __user *)to) : [spec] "d" (spec.val), [from] "Q" (*(const char *)from) : CC_CLOBBER_LIST("memory", "0")); if (CC_TRANSFORM(cc) == 0) return osize - size; size -= 4096; to += 4096; from += 4096; } } unsigned long _copy_to_user_key(void __user *to, const void *from, unsigned long n, unsigned long key) { might_fault(); if (should_fail_usercopy()) return n; instrument_copy_to_user(to, from, n); return raw_copy_to_user_key(to, from, n, key); } EXPORT_SYMBOL(_copy_to_user_key); #define CMPXCHG_USER_KEY_MAX_LOOPS 128 static nokprobe_inline int __cmpxchg_user_key_small(unsigned long address, unsigned int *uval, unsigned int old, unsigned int new, unsigned int mask, unsigned long key) { unsigned long count; unsigned int prev; bool sacf_flag; int rc = 0; skey_regions_initialize(); sacf_flag = enable_sacf_uaccess(); asm_inline volatile( "20: spka 0(%[key])\n" " sacf 256\n" " llill %[count],%[max_loops]\n" "0: l %[prev],%[address]\n" "1: nr %[prev],%[mask]\n" " xilf %[mask],0xffffffff\n" " or %[new],%[prev]\n" " or %[prev],%[tmp]\n" "2: lr %[tmp],%[prev]\n" "3: cs %[prev],%[new],%[address]\n" "4: jnl 5f\n" " xr %[tmp],%[prev]\n" " xr %[new],%[tmp]\n" " nr %[tmp],%[mask]\n" " jnz 5f\n" " brct %[count],2b\n" "5: sacf 768\n" " spka %[default_key]\n" "21:\n" EX_TABLE_UA_LOAD_REG(0b, 5b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REG(1b, 5b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REG(3b, 5b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REG(4b, 5b, %[rc], %[prev]) SKEY_REGION(20b, 21b) : [rc] "+&d" (rc), [prev] "=&d" (prev), [address] "+Q" (*(int *)address), [tmp] "+&d" (old), [new] "+&d" (new), [mask] "+&d" (mask), [count] "=a" (count) : [key] "%[count]" (key << 4), [default_key] "J" (PAGE_DEFAULT_KEY), [max_loops] "J" (CMPXCHG_USER_KEY_MAX_LOOPS) : "memory", "cc"); disable_sacf_uaccess(sacf_flag); *uval = prev; if (!count) rc = -EAGAIN; return rc; } int __kprobes __cmpxchg_user_key1(unsigned long address, unsigned char *uval, unsigned char old, unsigned char new, unsigned long key) { unsigned int prev, shift, mask, _old, _new; int rc; shift = (3 ^ (address & 3)) << 3; address ^= address & 3; _old = (unsigned int)old << shift; _new = (unsigned int)new << shift; mask = ~(0xff << shift); rc = __cmpxchg_user_key_small(address, &prev, _old, _new, mask, key); *uval = prev >> shift; return rc; } EXPORT_SYMBOL(__cmpxchg_user_key1); int __kprobes __cmpxchg_user_key2(unsigned long address, unsigned short *uval, unsigned short old, unsigned short new, unsigned long key) { unsigned int prev, shift, mask, _old, _new; int rc; shift = (2 ^ (address & 2)) << 3; address ^= address & 2; _old = (unsigned int)old << shift; _new = (unsigned int)new << shift; mask = ~(0xffff << shift); rc = __cmpxchg_user_key_small(address, &prev, _old, _new, mask, key); *uval = prev >> shift; return rc; } EXPORT_SYMBOL(__cmpxchg_user_key2); int __kprobes __cmpxchg_user_key4(unsigned long address, unsigned int *uval, unsigned int old, unsigned int new, unsigned long key) { unsigned int prev = old; bool sacf_flag; int rc = 0; skey_regions_initialize(); sacf_flag = enable_sacf_uaccess(); asm_inline volatile( "20: spka 0(%[key])\n" " sacf 256\n" "0: cs %[prev],%[new],%[address]\n" "1: sacf 768\n" " spka %[default_key]\n" "21:\n" EX_TABLE_UA_LOAD_REG(0b, 1b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REG(1b, 1b, %[rc], %[prev]) SKEY_REGION(20b, 21b) : [rc] "+&d" (rc), [prev] "+&d" (prev), [address] "+Q" (*(int *)address) : [new] "d" (new), [key] "a" (key << 4), [default_key] "J" (PAGE_DEFAULT_KEY) : "memory", "cc"); disable_sacf_uaccess(sacf_flag); *uval = prev; return rc; } EXPORT_SYMBOL(__cmpxchg_user_key4); int __kprobes __cmpxchg_user_key8(unsigned long address, unsigned long *uval, unsigned long old, unsigned long new, unsigned long key) { unsigned long prev = old; bool sacf_flag; int rc = 0; skey_regions_initialize(); sacf_flag = enable_sacf_uaccess(); asm_inline volatile( "20: spka 0(%[key])\n" " sacf 256\n" "0: csg %[prev],%[new],%[address]\n" "1: sacf 768\n" " spka %[default_key]\n" "21:\n" EX_TABLE_UA_LOAD_REG(0b, 1b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REG(1b, 1b, %[rc], %[prev]) SKEY_REGION(20b, 21b) : [rc] "+&d" (rc), [prev] "+&d" (prev), [address] "+QS" (*(long *)address) : [new] "d" (new), [key] "a" (key << 4), [default_key] "J" (PAGE_DEFAULT_KEY) : "memory", "cc"); disable_sacf_uaccess(sacf_flag); *uval = prev; return rc; } EXPORT_SYMBOL(__cmpxchg_user_key8); int __kprobes __cmpxchg_user_key16(unsigned long address, __uint128_t *uval, __uint128_t old, __uint128_t new, unsigned long key) { __uint128_t prev = old; bool sacf_flag; int rc = 0; skey_regions_initialize(); sacf_flag = enable_sacf_uaccess(); asm_inline volatile( "20: spka 0(%[key])\n" " sacf 256\n" "0: cdsg %[prev],%[new],%[address]\n" "1: sacf 768\n" " spka %[default_key]\n" "21:\n" EX_TABLE_UA_LOAD_REGPAIR(0b, 1b, %[rc], %[prev]) EX_TABLE_UA_LOAD_REGPAIR(1b, 1b, %[rc], %[prev]) SKEY_REGION(20b, 21b) : [rc] "+&d" (rc), [prev] "+&d" (prev), [address] "+QS" (*(__int128_t *)address) : [new] "d" (new), [key] "a" (key << 4), [default_key] "J" (PAGE_DEFAULT_KEY) : "memory", "cc"); disable_sacf_uaccess(sacf_flag); *uval = prev; return rc; } EXPORT_SYMBOL(__cmpxchg_user_key16);