arch/arm64/mm/kasan_init.c

   1 /*
   2  * This file contains kasan initialization code for ARM64.
   3  *
   4  * Copyright (c) 2015 Samsung Electronics Co., Ltd.
   5  * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  */
  12
  13 #define pr_fmt(fmt) "kasan: " fmt
  14 #include <linux/kasan.h>
  15 #include <linux/kernel.h>
  16 #include <linux/sched/task.h>
  17 #include <linux/memblock.h>
  18 #include <linux/start_kernel.h>
  19 #include <linux/mm.h>
  20
  21 #include <asm/mmu_context.h>
  22 #include <asm/kernel-pgtable.h>
  23 #include <asm/page.h>
  24 #include <asm/pgalloc.h>
  25 #include <asm/pgtable.h>
  26 #include <asm/sections.h>
  27 #include <asm/tlbflush.h>
  28
  29 static pgd_t tmp_pg_dir[PTRS_PER_PGD] __initdata __aligned(PGD_SIZE);
  30
  31 /*
  32  * The p*d_populate functions call virt_to_phys implicitly so they can't be used
  33  * directly on kernel symbols (bm_p*d). All the early functions are called too
  34  * early to use lm_alias so __p*d_populate functions must be used to populate
  35  * with the physical address from __pa_symbol.
  36  */
  37
  38 static phys_addr_t __init kasan_alloc_zeroed_page(int node)
  39 {
  40         void *p = memblock_alloc_try_nid(PAGE_SIZE, PAGE_SIZE,
  41                                               __pa(MAX_DMA_ADDRESS),
  42                                               MEMBLOCK_ALLOC_ACCESSIBLE, node);
  43         return __pa(p);
  44 }
  45
  46 static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node,
  47                                       bool early)
  48 {
  49         if (pmd_none(READ_ONCE(*pmdp))) {
  50                 phys_addr_t pte_phys = early ? __pa_symbol(kasan_zero_pte)
  51                                              : kasan_alloc_zeroed_page(node);
  52                 __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
  53         }
  54
  55         return early ? pte_offset_kimg(pmdp, addr)
  56                      : pte_offset_kernel(pmdp, addr);
  57 }
  58
  59 static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node,
  60                                       bool early)
  61 {
  62         if (pud_none(READ_ONCE(*pudp))) {
  63                 phys_addr_t pmd_phys = early ? __pa_symbol(kasan_zero_pmd)
  64                                              : kasan_alloc_zeroed_page(node);
  65                 __pud_populate(pudp, pmd_phys, PMD_TYPE_TABLE);
  66         }
  67
  68         return early ? pmd_offset_kimg(pudp, addr) : pmd_offset(pudp, addr);
  69 }
  70
  71 static pud_t *__init kasan_pud_offset(pgd_t *pgdp, unsigned long addr, int node,
  72                                       bool early)
  73 {
  74         if (pgd_none(READ_ONCE(*pgdp))) {
  75                 phys_addr_t pud_phys = early ? __pa_symbol(kasan_zero_pud)
  76                                              : kasan_alloc_zeroed_page(node);
  77                 __pgd_populate(pgdp, pud_phys, PMD_TYPE_TABLE);
  78         }
  79
  80         return early ? pud_offset_kimg(pgdp, addr) : pud_offset(pgdp, addr);
  81 }
  82
  83 static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
  84                                       unsigned long end, int node, bool early)
  85 {
  86         unsigned long next;
  87         pte_t *ptep = kasan_pte_offset(pmdp, addr, node, early);
  88
  89         do {
  90                 phys_addr_t page_phys = early ? __pa_symbol(kasan_zero_page)
  91                                               : kasan_alloc_zeroed_page(node);
  92                 next = addr + PAGE_SIZE;
  93                 set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
  94         } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
  95 }
  96
  97 static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
  98                                       unsigned long end, int node, bool early)
  99 {
 100         unsigned long next;
 101         pmd_t *pmdp = kasan_pmd_offset(pudp, addr, node, early);
 102
 103         do {
 104                 next = pmd_addr_end(addr, end);
 105                 kasan_pte_populate(pmdp, addr, next, node, early);
 106         } while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp)));
 107 }
 108
 109 static void __init kasan_pud_populate(pgd_t *pgdp, unsigned long addr,
 110                                       unsigned long end, int node, bool early)
 111 {
 112         unsigned long next;
 113         pud_t *pudp = kasan_pud_offset(pgdp, addr, node, early);
 114
 115         do {
 116                 next = pud_addr_end(addr, end);
 117                 kasan_pmd_populate(pudp, addr, next, node, early);
 118         } while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp)));
 119 }
 120
 121 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
 122                                       int node, bool early)
 123 {
 124         unsigned long next;
 125         pgd_t *pgdp;
 126
 127         pgdp = pgd_offset_k(addr);
 128         do {
 129                 next = pgd_addr_end(addr, end);
 130                 kasan_pud_populate(pgdp, addr, next, node, early);
 131         } while (pgdp++, addr = next, addr != end);
 132 }
 133
 134 /* The early shadow maps everything to a single page of zeroes */
 135 asmlinkage void __init kasan_early_init(void)
 136 {
 137         BUILD_BUG_ON(KASAN_SHADOW_OFFSET !=
 138                 KASAN_SHADOW_END - (1UL << (64 - KASAN_SHADOW_SCALE_SHIFT)));
 139         BUILD_BUG_ON(!IS_ALIGNED(KASAN_SHADOW_START, PGDIR_SIZE));
 140         BUILD_BUG_ON(!IS_ALIGNED(KASAN_SHADOW_END, PGDIR_SIZE));
 141         kasan_pgd_populate(KASAN_SHADOW_START, KASAN_SHADOW_END, NUMA_NO_NODE,
 142                            true);
 143 }
 144
 145 /* Set up full kasan mappings, ensuring that the mapped pages are zeroed */
 146 static void __init kasan_map_populate(unsigned long start, unsigned long end,
 147                                       int node)
 148 {
 149         kasan_pgd_populate(start & PAGE_MASK, PAGE_ALIGN(end), node, false);
 150 }
 151
 152 /*
 153  * Copy the current shadow region into a new pgdir.
 154  */
 155 void __init kasan_copy_shadow(pgd_t *pgdir)
 156 {
 157         pgd_t *pgdp, *pgdp_new, *pgdp_end;
 158
 159         pgdp = pgd_offset_k(KASAN_SHADOW_START);
 160         pgdp_end = pgd_offset_k(KASAN_SHADOW_END);
 161         pgdp_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
 162         do {
 163                 set_pgd(pgdp_new, READ_ONCE(*pgdp));
 164         } while (pgdp++, pgdp_new++, pgdp != pgdp_end);
 165 }
 166
 167 static void __init clear_pgds(unsigned long start,
 168                         unsigned long end)
 169 {
 170         /*
 171          * Remove references to kasan page tables from
 172          * swapper_pg_dir. pgd_clear() can't be used
 173          * here because it's nop on 2,3-level pagetable setups
 174          */
 175         for (; start < end; start += PGDIR_SIZE)
 176                 set_pgd(pgd_offset_k(start), __pgd(0));
 177 }
 178
 179 void __init kasan_init(void)
 180 {
 181         u64 kimg_shadow_start, kimg_shadow_end;
 182         u64 mod_shadow_start, mod_shadow_end;
 183         struct memblock_region *reg;
 184         int i;
 185
 186         kimg_shadow_start = (u64)kasan_mem_to_shadow(_text) & PAGE_MASK;
 187         kimg_shadow_end = PAGE_ALIGN((u64)kasan_mem_to_shadow(_end));
 188
 189         mod_shadow_start = (u64)kasan_mem_to_shadow((void *)MODULES_VADDR);
 190         mod_shadow_end = (u64)kasan_mem_to_shadow((void *)MODULES_END);
 191
 192         /*
 193          * We are going to perform proper setup of shadow memory.
 194          * At first we should unmap early shadow (clear_pgds() call below).
 195          * However, instrumented code couldn't execute without shadow memory.
 196          * tmp_pg_dir used to keep early shadow mapped until full shadow
 197          * setup will be finished.
 198          */
 199         memcpy(tmp_pg_dir, swapper_pg_dir, sizeof(tmp_pg_dir));
 200         dsb(ishst);
 201         cpu_replace_ttbr1(lm_alias(tmp_pg_dir));
 202
 203         clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 204
 205         kasan_map_populate(kimg_shadow_start, kimg_shadow_end,
 206                            early_pfn_to_nid(virt_to_pfn(lm_alias(_text))));
 207
 208         kasan_populate_zero_shadow((void *)KASAN_SHADOW_START,
 209                                    (void *)mod_shadow_start);
 210         kasan_populate_zero_shadow((void *)kimg_shadow_end,
 211                                    kasan_mem_to_shadow((void *)PAGE_OFFSET));
 212
 213         if (kimg_shadow_start > mod_shadow_end)
 214                 kasan_populate_zero_shadow((void *)mod_shadow_end,
 215                                            (void *)kimg_shadow_start);
 216
 217         for_each_memblock(memory, reg) {
 218                 void *start = (void *)__phys_to_virt(reg->base);
 219                 void *end = (void *)__phys_to_virt(reg->base + reg->size);
 220
 221                 if (start >= end)
 222                         break;
 223
 224                 kasan_map_populate((unsigned long)kasan_mem_to_shadow(start),
 225                                    (unsigned long)kasan_mem_to_shadow(end),
 226                                    early_pfn_to_nid(virt_to_pfn(start)));
 227         }
 228
 229         /*
 230          * KAsan may reuse the contents of kasan_zero_pte directly, so we
 231          * should make sure that it maps the zero page read-only.
 232          */
 233         for (i = 0; i < PTRS_PER_PTE; i++)
 234                 set_pte(&kasan_zero_pte[i],
 235                         pfn_pte(sym_to_pfn(kasan_zero_page), PAGE_KERNEL_RO));
 236
 237         memset(kasan_zero_page, 0, PAGE_SIZE);
 238         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 239
 240         /* At this point kasan is fully initialized. Enable error messages */
 241         init_task.kasan_depth = 0;
 242         pr_info("KernelAddressSanitizer initialized\n");
 243 }