Commit 39d114dd authored by Andrey Ryabinin's avatar Andrey Ryabinin Committed by Catalin Marinas
Browse files

arm64: add KASAN support 



This patch adds arch specific code for kernel address sanitizer
(see Documentation/kasan.txt).

1/8 of kernel addresses reserved for shadow memory. There was no
big enough hole for this, so virtual addresses for shadow were
stolen from vmalloc area.

At early boot stage the whole shadow region populated with just
one physical page (kasan_zero_page). Later, this page reused
as readonly zero shadow for some memory that KASan currently
don't track (vmalloc).
After mapping the physical memory, pages for shadow memory are
allocated and mapped.

Functions like memset/memmove/memcpy do a lot of memory accesses.
If bad pointer passed to one of these function it is important
to catch this. Compiler's instrumentation cannot do this since
these functions are written in assembly.
KASan replaces memory functions with manually instrumented variants.
Original functions declared as weak symbols so strong definitions
in mm/kasan/kasan.c could replace them. Original functions have aliases
with '__' prefix in name, so we could call non-instrumented variant
if needed.
Some files built without kasan instrumentation (e.g. mm/slub.c).
Original mem* function replaced (via #define) with prefixed variants
to disable memory access checks for such files.

Signed-off-by: default avatarAndrey Ryabinin <ryabinin.a.a@gmail.com>
Tested-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Reviewed-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent fd2203dd

arch/arm64/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -48,6 +48,7 @@ config ARM64 
	select HAVE_ARCH_AUDITSYSCALL

	select HAVE_ARCH_BITREVERSE

	select HAVE_ARCH_JUMP_LABEL

	select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP

	select HAVE_ARCH_KGDB

	select HAVE_ARCH_SECCOMP_FILTER

	select HAVE_ARCH_TRACEHOOK

arch/arm64/Makefile

+7 −0
Original line number Diff line number Diff line
@@ -55,6 +55,13 @@ else 
TEXT_OFFSET := 0x00080000

endif



# KASAN_SHADOW_OFFSET = VA_START + (1 << (VA_BITS - 3)) - (1 << 61)

# in 32-bit arithmetic

KASAN_SHADOW_OFFSET := $(shell printf "0x%08x00000000\n" $$(( \

			(0xffffffff & (-1 << ($(CONFIG_ARM64_VA_BITS) - 32))) \

			+ (1 << ($(CONFIG_ARM64_VA_BITS) - 32 - 3)) \

			- (1 << (64 - 32 - 3)) )) )



export	TEXT_OFFSET GZFLAGS



core-y		+= arch/arm64/kernel/ arch/arm64/mm/

arch/arm64/include/asm/kasan.h

0 → 100644
+36 −0
Original line number Diff line number Diff line 
#ifndef __ASM_KASAN_H

#define __ASM_KASAN_H



#ifndef __ASSEMBLY__



#ifdef CONFIG_KASAN



#include <asm/memory.h>



/*

 * KASAN_SHADOW_START: beginning of the kernel virtual addresses.

 * KASAN_SHADOW_END: KASAN_SHADOW_START + 1/8 of kernel virtual addresses.

 */

#define KASAN_SHADOW_START      (VA_START)

#define KASAN_SHADOW_END        (KASAN_SHADOW_START + (1UL << (VA_BITS - 3)))



/*

 * This value is used to map an address to the corresponding shadow

 * address by the following formula:

 *     shadow_addr = (address >> 3) + KASAN_SHADOW_OFFSET;

 *

 * (1 << 61) shadow addresses - [KASAN_SHADOW_OFFSET,KASAN_SHADOW_END]

 * cover all 64-bits of virtual addresses. So KASAN_SHADOW_OFFSET

 * should satisfy the following equation:

 *      KASAN_SHADOW_OFFSET = KASAN_SHADOW_END - (1ULL << 61)

 */

#define KASAN_SHADOW_OFFSET     (KASAN_SHADOW_END - (1ULL << (64 - 3)))



void kasan_init(void);



#else

static inline void kasan_init(void) { }

#endif



#endif

#endif

arch/arm64/include/asm/pgtable.h

+7 −0
Original line number Diff line number Diff line
@@ -41,7 +41,14 @@ 
 *	fixed mappings and modules

 */

#define VMEMMAP_SIZE		ALIGN((1UL << (VA_BITS - PAGE_SHIFT)) * sizeof(struct page), PUD_SIZE)



#ifndef CONFIG_KASAN

#define VMALLOC_START		(VA_START)

#else

#include <asm/kasan.h>

#define VMALLOC_START		(KASAN_SHADOW_END + SZ_64K)

#endif



#define VMALLOC_END		(PAGE_OFFSET - PUD_SIZE - VMEMMAP_SIZE - SZ_64K)



#define vmemmap			((struct page *)(VMALLOC_END + SZ_64K))

arch/arm64/include/asm/string.h

+16 −0
Original line number Diff line number Diff line
@@ -36,17 +36,33 @@ extern __kernel_size_t strnlen(const char *, __kernel_size_t); 


#define __HAVE_ARCH_MEMCPY

extern void *memcpy(void *, const void *, __kernel_size_t);

extern void *__memcpy(void *, const void *, __kernel_size_t);



#define __HAVE_ARCH_MEMMOVE

extern void *memmove(void *, const void *, __kernel_size_t);

extern void *__memmove(void *, const void *, __kernel_size_t);



#define __HAVE_ARCH_MEMCHR

extern void *memchr(const void *, int, __kernel_size_t);



#define __HAVE_ARCH_MEMSET

extern void *memset(void *, int, __kernel_size_t);

extern void *__memset(void *, int, __kernel_size_t);



#define __HAVE_ARCH_MEMCMP

extern int memcmp(const void *, const void *, size_t);





#if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)



/*

 * For files that are not instrumented (e.g. mm/slub.c) we

 * should use not instrumented version of mem* functions.

 */



#define memcpy(dst, src, len) __memcpy(dst, src, len)

#define memmove(dst, src, len) __memmove(dst, src, len)

#define memset(s, c, n) __memset(s, c, n)

#endif



#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE