lkml.org 
[lkml]   [2020]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH mm v10 37/42] kasan, arm64: implement HW_TAGS runtime
    From
    Provide implementation of KASAN functions required for the hardware
    tag-based mode. Those include core functions for memory and pointer
    tagging (tags_hw.c) and bug reporting (report_tags_hw.c). Also adapt
    common KASAN code to support the new mode.

    Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Reviewed-by: Alexander Potapenko <glider@google.com>
    ---
    Change-Id: I8a8689ba098174a4d0ef3f1d008178387c80ee1c
    ---
    arch/arm64/include/asm/memory.h | 4 +-
    arch/arm64/kernel/cpufeature.c | 3 ++
    arch/arm64/kernel/smp.c | 2 +
    include/linux/kasan.h | 24 ++++++---
    include/linux/mm.h | 2 +-
    include/linux/page-flags-layout.h | 2 +-
    mm/kasan/Makefile | 5 ++
    mm/kasan/common.c | 15 +++---
    mm/kasan/hw_tags.c | 89 +++++++++++++++++++++++++++++++
    mm/kasan/kasan.h | 19 +++++--
    mm/kasan/report_hw_tags.c | 42 +++++++++++++++
    mm/kasan/report_sw_tags.c | 2 +-
    mm/kasan/shadow.c | 2 +-
    mm/kasan/sw_tags.c | 2 +-
    14 files changed, 187 insertions(+), 26 deletions(-)
    create mode 100644 mm/kasan/hw_tags.c
    create mode 100644 mm/kasan/report_hw_tags.c

    diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
    index cd671fb6707c..18fce223b67b 100644
    --- a/arch/arm64/include/asm/memory.h
    +++ b/arch/arm64/include/asm/memory.h
    @@ -214,7 +214,7 @@ static inline unsigned long kaslr_offset(void)
    (__force __typeof__(addr))__addr; \
    })

    -#ifdef CONFIG_KASAN_SW_TAGS
    +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)
    #define __tag_shifted(tag) ((u64)(tag) << 56)
    #define __tag_reset(addr) __untagged_addr(addr)
    #define __tag_get(addr) (__u8)((u64)(addr) >> 56)
    @@ -222,7 +222,7 @@ static inline unsigned long kaslr_offset(void)
    #define __tag_shifted(tag) 0UL
    #define __tag_reset(addr) (addr)
    #define __tag_get(addr) 0
    -#endif /* CONFIG_KASAN_SW_TAGS */
    +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */

    static inline const void *__tag_set(const void *addr, u8 tag)
    {
    diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
    index bffcd55668c7..3f07af6d140c 100644
    --- a/arch/arm64/kernel/cpufeature.c
    +++ b/arch/arm64/kernel/cpufeature.c
    @@ -70,6 +70,7 @@
    #include <linux/types.h>
    #include <linux/mm.h>
    #include <linux/cpu.h>
    +#include <linux/kasan.h>
    #include <asm/cpu.h>
    #include <asm/cpufeature.h>
    #include <asm/cpu_ops.h>
    @@ -1711,6 +1712,8 @@ static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap)
    cleared_zero_page = true;
    mte_clear_page_tags(lm_alias(empty_zero_page));
    }
    +
    + kasan_init_hw_tags_cpu();
    }
    #endif /* CONFIG_ARM64_MTE */

    diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
    index 2499b895efea..19b1705ae5cb 100644
    --- a/arch/arm64/kernel/smp.c
    +++ b/arch/arm64/kernel/smp.c
    @@ -462,6 +462,8 @@ void __init smp_prepare_boot_cpu(void)
    /* Conditionally switch to GIC PMR for interrupt masking */
    if (system_uses_irq_prio_masking())
    init_gic_priority_masking();
    +
    + kasan_init_hw_tags();
    }

    static u64 __init of_get_cpu_mpidr(struct device_node *dn)
    diff --git a/include/linux/kasan.h b/include/linux/kasan.h
    index 118a57517281..0c89e6fdd29e 100644
    --- a/include/linux/kasan.h
    +++ b/include/linux/kasan.h
    @@ -189,25 +189,35 @@ static inline void kasan_record_aux_stack(void *ptr) {}

    #endif /* CONFIG_KASAN_GENERIC */

    -#ifdef CONFIG_KASAN_SW_TAGS
    -
    -void __init kasan_init_sw_tags(void);
    +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)

    void *kasan_reset_tag(const void *addr);

    bool kasan_report(unsigned long addr, size_t size,
    bool is_write, unsigned long ip);

    -#else /* CONFIG_KASAN_SW_TAGS */
    -
    -static inline void kasan_init_sw_tags(void) { }
    +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */

    static inline void *kasan_reset_tag(const void *addr)
    {
    return (void *)addr;
    }

    -#endif /* CONFIG_KASAN_SW_TAGS */
    +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/
    +
    +#ifdef CONFIG_KASAN_SW_TAGS
    +void __init kasan_init_sw_tags(void);
    +#else
    +static inline void kasan_init_sw_tags(void) { }
    +#endif
    +
    +#ifdef CONFIG_KASAN_HW_TAGS
    +void kasan_init_hw_tags_cpu(void);
    +void __init kasan_init_hw_tags(void);
    +#else
    +static inline void kasan_init_hw_tags_cpu(void) { }
    +static inline void kasan_init_hw_tags(void) { }
    +#endif

    #ifdef CONFIG_KASAN_VMALLOC

    diff --git a/include/linux/mm.h b/include/linux/mm.h
    index 1ed52bae5142..947f4f1a6536 100644
    --- a/include/linux/mm.h
    +++ b/include/linux/mm.h
    @@ -1414,7 +1414,7 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid)
    }
    #endif /* CONFIG_NUMA_BALANCING */

    -#ifdef CONFIG_KASAN_SW_TAGS
    +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)
    static inline u8 page_kasan_tag(const struct page *page)
    {
    return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK;
    diff --git a/include/linux/page-flags-layout.h b/include/linux/page-flags-layout.h
    index e200eef6a7fd..7d4ec26d8a3e 100644
    --- a/include/linux/page-flags-layout.h
    +++ b/include/linux/page-flags-layout.h
    @@ -77,7 +77,7 @@
    #define LAST_CPUPID_SHIFT 0
    #endif

    -#ifdef CONFIG_KASAN_SW_TAGS
    +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)
    #define KASAN_TAG_WIDTH 8
    #else
    #define KASAN_TAG_WIDTH 0
    diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
    index f1d68a34f3c9..9fe39a66388a 100644
    --- a/mm/kasan/Makefile
    +++ b/mm/kasan/Makefile
    @@ -10,8 +10,10 @@ CFLAGS_REMOVE_init.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_quarantine.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_report.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_report_generic.o = $(CC_FLAGS_FTRACE)
    +CFLAGS_REMOVE_report_hw_tags.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_report_sw_tags.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_shadow.o = $(CC_FLAGS_FTRACE)
    +CFLAGS_REMOVE_hw_tags.o = $(CC_FLAGS_FTRACE)
    CFLAGS_REMOVE_sw_tags.o = $(CC_FLAGS_FTRACE)

    # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
    @@ -27,10 +29,13 @@ CFLAGS_init.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_quarantine.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_report.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_report_generic.o := $(CC_FLAGS_KASAN_RUNTIME)
    +CFLAGS_report_hw_tags.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_report_sw_tags.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_shadow.o := $(CC_FLAGS_KASAN_RUNTIME)
    +CFLAGS_hw_tags.o := $(CC_FLAGS_KASAN_RUNTIME)
    CFLAGS_sw_tags.o := $(CC_FLAGS_KASAN_RUNTIME)

    obj-$(CONFIG_KASAN) := common.o report.o
    obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o
    +obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o
    obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o
    diff --git a/mm/kasan/common.c b/mm/kasan/common.c
    index 52fa763d2169..998aede4d172 100644
    --- a/mm/kasan/common.c
    +++ b/mm/kasan/common.c
    @@ -119,7 +119,7 @@ void kasan_free_pages(struct page *page, unsigned int order)
    */
    static inline unsigned int optimal_redzone(unsigned int object_size)
    {
    - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
    + if (!IS_ENABLED(CONFIG_KASAN_GENERIC))
    return 0;

    return
    @@ -184,14 +184,14 @@ size_t kasan_metadata_size(struct kmem_cache *cache)
    struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache,
    const void *object)
    {
    - return (void *)object + cache->kasan_info.alloc_meta_offset;
    + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset;
    }

    struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
    const void *object)
    {
    BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32);
    - return (void *)object + cache->kasan_info.free_meta_offset;
    + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset;
    }

    void kasan_poison_slab(struct page *page)
    @@ -273,9 +273,8 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache,
    alloc_info = get_alloc_info(cache, object);
    __memset(alloc_info, 0, sizeof(*alloc_info));

    - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
    - object = set_tag(object,
    - assign_tag(cache, object, true, false));
    + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS))
    + object = set_tag(object, assign_tag(cache, object, true, false));

    return (void *)object;
    }
    @@ -349,10 +348,10 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
    redzone_end = round_up((unsigned long)object + cache->object_size,
    KASAN_GRANULE_SIZE);

    - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
    + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS))
    tag = assign_tag(cache, object, false, keep_tag);

    - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */
    + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */
    unpoison_range(set_tag(object, tag), size);
    poison_range((void *)redzone_start, redzone_end - redzone_start,
    KASAN_KMALLOC_REDZONE);
    diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c
    new file mode 100644
    index 000000000000..3f9232464ed4
    --- /dev/null
    +++ b/mm/kasan/hw_tags.c
    @@ -0,0 +1,89 @@
    +// SPDX-License-Identifier: GPL-2.0
    +/*
    + * This file contains core hardware tag-based KASAN code.
    + *
    + * Copyright (c) 2020 Google, Inc.
    + * Author: Andrey Konovalov <andreyknvl@google.com>
    + */
    +
    +#define pr_fmt(fmt) "kasan: " fmt
    +
    +#include <linux/kasan.h>
    +#include <linux/kernel.h>
    +#include <linux/kfence.h>
    +#include <linux/memory.h>
    +#include <linux/mm.h>
    +#include <linux/string.h>
    +#include <linux/types.h>
    +
    +#include "kasan.h"
    +
    +/* kasan_init_hw_tags_cpu() is called for each CPU. */
    +void kasan_init_hw_tags_cpu(void)
    +{
    + hw_init_tags(KASAN_TAG_MAX);
    + hw_enable_tagging();
    +}
    +
    +/* kasan_init_hw_tags() is called once on boot CPU. */
    +void __init kasan_init_hw_tags(void)
    +{
    + pr_info("KernelAddressSanitizer initialized\n");
    +}
    +
    +void *kasan_reset_tag(const void *addr)
    +{
    + return reset_tag(addr);
    +}
    +
    +void poison_range(const void *address, size_t size, u8 value)
    +{
    + /* Skip KFENCE memory if called explicitly outside of sl*b. */
    + if (is_kfence_address(address))
    + return;
    +
    + hw_set_mem_tag_range(reset_tag(address),
    + round_up(size, KASAN_GRANULE_SIZE), value);
    +}
    +
    +void unpoison_range(const void *address, size_t size)
    +{
    + /* Skip KFENCE memory if called explicitly outside of sl*b. */
    + if (is_kfence_address(address))
    + return;
    +
    + hw_set_mem_tag_range(reset_tag(address),
    + round_up(size, KASAN_GRANULE_SIZE), get_tag(address));
    +}
    +
    +u8 random_tag(void)
    +{
    + return hw_get_random_tag();
    +}
    +
    +bool check_invalid_free(void *addr)
    +{
    + u8 ptr_tag = get_tag(addr);
    + u8 mem_tag = hw_get_mem_tag(addr);
    +
    + return (mem_tag == KASAN_TAG_INVALID) ||
    + (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag);
    +}
    +
    +void kasan_set_free_info(struct kmem_cache *cache,
    + void *object, u8 tag)
    +{
    + struct kasan_alloc_meta *alloc_meta;
    +
    + alloc_meta = get_alloc_info(cache, object);
    + kasan_set_track(&alloc_meta->free_track[0], GFP_NOWAIT);
    +}
    +
    +struct kasan_track *kasan_get_free_track(struct kmem_cache *cache,
    + void *object, u8 tag)
    +{
    + struct kasan_alloc_meta *alloc_meta;
    +
    + alloc_meta = get_alloc_info(cache, object);
    + return &alloc_meta->free_track[0];
    +}
    diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
    index 92cb2c16e314..64560cc71191 100644
    --- a/mm/kasan/kasan.h
    +++ b/mm/kasan/kasan.h
    @@ -154,6 +154,11 @@ struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache,
    struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
    const void *object);

    +void poison_range(const void *address, size_t size, u8 value);
    +void unpoison_range(const void *address, size_t size);
    +
    +#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
    +
    static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
    {
    return (void *)(((unsigned long)shadow_addr - KASAN_SHADOW_OFFSET)
    @@ -165,9 +170,6 @@ static inline bool addr_has_metadata(const void *addr)
    return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START));
    }

    -void poison_range(const void *address, size_t size, u8 value);
    -void unpoison_range(const void *address, size_t size);
    -
    /**
    * check_memory_region - Check memory region, and report if invalid access.
    * @addr: the accessed address
    @@ -179,6 +181,15 @@ void unpoison_range(const void *address, size_t size);
    bool check_memory_region(unsigned long addr, size_t size, bool write,
    unsigned long ret_ip);

    +#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
    +
    +static inline bool addr_has_metadata(const void *addr)
    +{
    + return true;
    +}
    +
    +#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
    +
    bool check_invalid_free(void *addr);

    void *find_first_bad_addr(void *addr, size_t size);
    @@ -215,7 +226,7 @@ static inline void quarantine_reduce(void) { }
    static inline void quarantine_remove_cache(struct kmem_cache *cache) { }
    #endif

    -#ifdef CONFIG_KASAN_SW_TAGS
    +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)

    void print_tags(u8 addr_tag, const void *addr);

    diff --git a/mm/kasan/report_hw_tags.c b/mm/kasan/report_hw_tags.c
    new file mode 100644
    index 000000000000..da543eb832cd
    --- /dev/null
    +++ b/mm/kasan/report_hw_tags.c
    @@ -0,0 +1,42 @@
    +// SPDX-License-Identifier: GPL-2.0
    +/*
    + * This file contains hardware tag-based KASAN specific error reporting code.
    + *
    + * Copyright (c) 2020 Google, Inc.
    + * Author: Andrey Konovalov <andreyknvl@google.com>
    + */
    +
    +#include <linux/kasan.h>
    +#include <linux/kernel.h>
    +#include <linux/memory.h>
    +#include <linux/mm.h>
    +#include <linux/string.h>
    +#include <linux/types.h>
    +
    +#include "kasan.h"
    +
    +const char *get_bug_type(struct kasan_access_info *info)
    +{
    + return "invalid-access";
    +}
    +
    +void *find_first_bad_addr(void *addr, size_t size)
    +{
    + return reset_tag(addr);
    +}
    +
    +void metadata_fetch_row(char *buffer, void *row)
    +{
    + int i;
    +
    + for (i = 0; i < META_BYTES_PER_ROW; i++)
    + buffer[i] = hw_get_mem_tag(row + i * KASAN_GRANULE_SIZE);
    +}
    +
    +void print_tags(u8 addr_tag, const void *addr)
    +{
    + u8 memory_tag = hw_get_mem_tag((void *)addr);
    +
    + pr_err("Pointer tag: [%02x], memory tag: [%02x]\n",
    + addr_tag, memory_tag);
    +}
    diff --git a/mm/kasan/report_sw_tags.c b/mm/kasan/report_sw_tags.c
    index add2dfe6169c..aebc44a29e83 100644
    --- a/mm/kasan/report_sw_tags.c
    +++ b/mm/kasan/report_sw_tags.c
    @@ -1,6 +1,6 @@
    // SPDX-License-Identifier: GPL-2.0
    /*
    - * This file contains tag-based KASAN specific error reporting code.
    + * This file contains software tag-based KASAN specific error reporting code.
    *
    * Copyright (c) 2014 Samsung Electronics Co., Ltd.
    * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
    index 80522d2c447b..d8a122f887a0 100644
    --- a/mm/kasan/shadow.c
    +++ b/mm/kasan/shadow.c
    @@ -120,7 +120,7 @@ void unpoison_range(const void *address, size_t size)

    if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
    *shadow = tag;
    - else
    + else /* CONFIG_KASAN_GENERIC */
    *shadow = size & KASAN_GRANULE_MASK;
    }
    }
    diff --git a/mm/kasan/sw_tags.c b/mm/kasan/sw_tags.c
    index 7317d5229b2b..a518483f3965 100644
    --- a/mm/kasan/sw_tags.c
    +++ b/mm/kasan/sw_tags.c
    @@ -1,6 +1,6 @@
    // SPDX-License-Identifier: GPL-2.0
    /*
    - * This file contains core tag-based KASAN code.
    + * This file contains core software tag-based KASAN code.
    *
    * Copyright (c) 2018 Google, Inc.
    * Author: Andrey Konovalov <andreyknvl@google.com>
    --
    2.29.2.299.gdc1121823c-goog
    \
     
     \ /
      Last update: 2020-11-13 23:20    [W:2.919 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site