1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * This file contains KASAN shadow initialization code. |
4 | * |
5 | * Copyright (c) 2015 Samsung Electronics Co., Ltd. |
6 | * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> |
7 | */ |
8 | |
9 | #include <linux/memblock.h> |
10 | #include <linux/init.h> |
11 | #include <linux/kasan.h> |
12 | #include <linux/kernel.h> |
13 | #include <linux/mm.h> |
14 | #include <linux/pfn.h> |
15 | #include <linux/slab.h> |
16 | |
17 | #include <asm/page.h> |
18 | #include <asm/pgalloc.h> |
19 | |
20 | #include "kasan.h" |
21 | |
22 | /* |
23 | * This page serves two purposes: |
24 | * - It used as early shadow memory. The entire shadow region populated |
25 | * with this page, before we will be able to setup normal shadow memory. |
26 | * - Latter it reused it as zero shadow to cover large ranges of memory |
27 | * that allowed to access, but not handled by kasan (vmalloc/vmemmap ...). |
28 | */ |
29 | unsigned char kasan_early_shadow_page[PAGE_SIZE] __page_aligned_bss; |
30 | |
31 | #if CONFIG_PGTABLE_LEVELS > 4 |
32 | p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D] __page_aligned_bss; |
33 | static inline bool kasan_p4d_table(pgd_t pgd) |
34 | { |
35 | return pgd_page(pgd) == virt_to_page(lm_alias(kasan_early_shadow_p4d)); |
36 | } |
37 | #else |
38 | static inline bool kasan_p4d_table(pgd_t pgd) |
39 | { |
40 | return false; |
41 | } |
42 | #endif |
43 | #if CONFIG_PGTABLE_LEVELS > 3 |
44 | pud_t kasan_early_shadow_pud[MAX_PTRS_PER_PUD] __page_aligned_bss; |
45 | static inline bool kasan_pud_table(p4d_t p4d) |
46 | { |
47 | return p4d_page(p4d) == virt_to_page(lm_alias(kasan_early_shadow_pud)); |
48 | } |
49 | #else |
50 | static inline bool kasan_pud_table(p4d_t p4d) |
51 | { |
52 | return false; |
53 | } |
54 | #endif |
55 | #if CONFIG_PGTABLE_LEVELS > 2 |
56 | pmd_t kasan_early_shadow_pmd[MAX_PTRS_PER_PMD] __page_aligned_bss; |
57 | static inline bool kasan_pmd_table(pud_t pud) |
58 | { |
59 | return pud_page(pud) == virt_to_page(lm_alias(kasan_early_shadow_pmd)); |
60 | } |
61 | #else |
62 | static inline bool kasan_pmd_table(pud_t pud) |
63 | { |
64 | return false; |
65 | } |
66 | #endif |
67 | pte_t kasan_early_shadow_pte[MAX_PTRS_PER_PTE + PTE_HWTABLE_PTRS] |
68 | __page_aligned_bss; |
69 | |
70 | static inline bool kasan_pte_table(pmd_t pmd) |
71 | { |
72 | return pmd_page(pmd) == virt_to_page(lm_alias(kasan_early_shadow_pte)); |
73 | } |
74 | |
75 | static inline bool kasan_early_shadow_page_entry(pte_t pte) |
76 | { |
77 | return pte_page(pte) == virt_to_page(lm_alias(kasan_early_shadow_page)); |
78 | } |
79 | |
80 | static __init void *early_alloc(size_t size, int node) |
81 | { |
82 | void *ptr = memblock_alloc_try_nid(size, align: size, __pa(MAX_DMA_ADDRESS), |
83 | MEMBLOCK_ALLOC_ACCESSIBLE, nid: node); |
84 | |
85 | if (!ptr) |
86 | panic(fmt: "%s: Failed to allocate %zu bytes align=%zx nid=%d from=%llx\n" , |
87 | __func__, size, size, node, (u64)__pa(MAX_DMA_ADDRESS)); |
88 | |
89 | return ptr; |
90 | } |
91 | |
92 | static void __ref zero_pte_populate(pmd_t *pmd, unsigned long addr, |
93 | unsigned long end) |
94 | { |
95 | pte_t *pte = pte_offset_kernel(pmd, address: addr); |
96 | pte_t zero_pte; |
97 | |
98 | zero_pte = pfn_pte(PFN_DOWN(__pa_symbol(kasan_early_shadow_page)), |
99 | PAGE_KERNEL); |
100 | zero_pte = pte_wrprotect(pte: zero_pte); |
101 | |
102 | while (addr + PAGE_SIZE <= end) { |
103 | set_pte_at(&init_mm, addr, pte, zero_pte); |
104 | addr += PAGE_SIZE; |
105 | pte = pte_offset_kernel(pmd, address: addr); |
106 | } |
107 | } |
108 | |
109 | static int __ref zero_pmd_populate(pud_t *pud, unsigned long addr, |
110 | unsigned long end) |
111 | { |
112 | pmd_t *pmd = pmd_offset(pud, address: addr); |
113 | unsigned long next; |
114 | |
115 | do { |
116 | next = pmd_addr_end(addr, end); |
117 | |
118 | if (IS_ALIGNED(addr, PMD_SIZE) && end - addr >= PMD_SIZE) { |
119 | pmd_populate_kernel(mm: &init_mm, pmd, |
120 | lm_alias(kasan_early_shadow_pte)); |
121 | continue; |
122 | } |
123 | |
124 | if (pmd_none(pmd: *pmd)) { |
125 | pte_t *p; |
126 | |
127 | if (slab_is_available()) |
128 | p = pte_alloc_one_kernel(mm: &init_mm); |
129 | else |
130 | p = early_alloc(PAGE_SIZE, NUMA_NO_NODE); |
131 | if (!p) |
132 | return -ENOMEM; |
133 | |
134 | pmd_populate_kernel(mm: &init_mm, pmd, pte: p); |
135 | } |
136 | zero_pte_populate(pmd, addr, end: next); |
137 | } while (pmd++, addr = next, addr != end); |
138 | |
139 | return 0; |
140 | } |
141 | |
142 | void __weak __meminit pmd_init(void *addr) |
143 | { |
144 | } |
145 | |
146 | static int __ref zero_pud_populate(p4d_t *p4d, unsigned long addr, |
147 | unsigned long end) |
148 | { |
149 | pud_t *pud = pud_offset(p4d, address: addr); |
150 | unsigned long next; |
151 | |
152 | do { |
153 | next = pud_addr_end(addr, end); |
154 | if (IS_ALIGNED(addr, PUD_SIZE) && end - addr >= PUD_SIZE) { |
155 | pmd_t *pmd; |
156 | |
157 | pud_populate(mm: &init_mm, pud, |
158 | lm_alias(kasan_early_shadow_pmd)); |
159 | pmd = pmd_offset(pud, address: addr); |
160 | pmd_populate_kernel(mm: &init_mm, pmd, |
161 | lm_alias(kasan_early_shadow_pte)); |
162 | continue; |
163 | } |
164 | |
165 | if (pud_none(pud: *pud)) { |
166 | pmd_t *p; |
167 | |
168 | if (slab_is_available()) { |
169 | p = pmd_alloc(mm: &init_mm, pud, address: addr); |
170 | if (!p) |
171 | return -ENOMEM; |
172 | } else { |
173 | p = early_alloc(PAGE_SIZE, NUMA_NO_NODE); |
174 | pmd_init(addr: p); |
175 | pud_populate(mm: &init_mm, pud, pmd: p); |
176 | } |
177 | } |
178 | zero_pmd_populate(pud, addr, end: next); |
179 | } while (pud++, addr = next, addr != end); |
180 | |
181 | return 0; |
182 | } |
183 | |
184 | void __weak __meminit pud_init(void *addr) |
185 | { |
186 | } |
187 | |
188 | static int __ref zero_p4d_populate(pgd_t *pgd, unsigned long addr, |
189 | unsigned long end) |
190 | { |
191 | p4d_t *p4d = p4d_offset(pgd, address: addr); |
192 | unsigned long next; |
193 | |
194 | do { |
195 | next = p4d_addr_end(addr, end); |
196 | if (IS_ALIGNED(addr, P4D_SIZE) && end - addr >= P4D_SIZE) { |
197 | pud_t *pud; |
198 | pmd_t *pmd; |
199 | |
200 | p4d_populate(mm: &init_mm, p4d, |
201 | lm_alias(kasan_early_shadow_pud)); |
202 | pud = pud_offset(p4d, address: addr); |
203 | pud_populate(mm: &init_mm, pud, |
204 | lm_alias(kasan_early_shadow_pmd)); |
205 | pmd = pmd_offset(pud, address: addr); |
206 | pmd_populate_kernel(mm: &init_mm, pmd, |
207 | lm_alias(kasan_early_shadow_pte)); |
208 | continue; |
209 | } |
210 | |
211 | if (p4d_none(p4d: *p4d)) { |
212 | pud_t *p; |
213 | |
214 | if (slab_is_available()) { |
215 | p = pud_alloc(mm: &init_mm, p4d, address: addr); |
216 | if (!p) |
217 | return -ENOMEM; |
218 | } else { |
219 | p = early_alloc(PAGE_SIZE, NUMA_NO_NODE); |
220 | pud_init(addr: p); |
221 | p4d_populate(mm: &init_mm, p4d, pud: p); |
222 | } |
223 | } |
224 | zero_pud_populate(p4d, addr, end: next); |
225 | } while (p4d++, addr = next, addr != end); |
226 | |
227 | return 0; |
228 | } |
229 | |
230 | /** |
231 | * kasan_populate_early_shadow - populate shadow memory region with |
232 | * kasan_early_shadow_page |
233 | * @shadow_start: start of the memory range to populate |
234 | * @shadow_end: end of the memory range to populate |
235 | */ |
236 | int __ref kasan_populate_early_shadow(const void *shadow_start, |
237 | const void *shadow_end) |
238 | { |
239 | unsigned long addr = (unsigned long)shadow_start; |
240 | unsigned long end = (unsigned long)shadow_end; |
241 | pgd_t *pgd = pgd_offset_k(addr); |
242 | unsigned long next; |
243 | |
244 | do { |
245 | next = pgd_addr_end(addr, end); |
246 | |
247 | if (IS_ALIGNED(addr, PGDIR_SIZE) && end - addr >= PGDIR_SIZE) { |
248 | p4d_t *p4d; |
249 | pud_t *pud; |
250 | pmd_t *pmd; |
251 | |
252 | /* |
253 | * kasan_early_shadow_pud should be populated with pmds |
254 | * at this moment. |
255 | * [pud,pmd]_populate*() below needed only for |
256 | * 3,2 - level page tables where we don't have |
257 | * puds,pmds, so pgd_populate(), pud_populate() |
258 | * is noops. |
259 | */ |
260 | pgd_populate(mm: &init_mm, pgd, |
261 | lm_alias(kasan_early_shadow_p4d)); |
262 | p4d = p4d_offset(pgd, address: addr); |
263 | p4d_populate(mm: &init_mm, p4d, |
264 | lm_alias(kasan_early_shadow_pud)); |
265 | pud = pud_offset(p4d, address: addr); |
266 | pud_populate(mm: &init_mm, pud, |
267 | lm_alias(kasan_early_shadow_pmd)); |
268 | pmd = pmd_offset(pud, address: addr); |
269 | pmd_populate_kernel(mm: &init_mm, pmd, |
270 | lm_alias(kasan_early_shadow_pte)); |
271 | continue; |
272 | } |
273 | |
274 | if (pgd_none(pgd: *pgd)) { |
275 | p4d_t *p; |
276 | |
277 | if (slab_is_available()) { |
278 | p = p4d_alloc(mm: &init_mm, pgd, address: addr); |
279 | if (!p) |
280 | return -ENOMEM; |
281 | } else { |
282 | pgd_populate(mm: &init_mm, pgd, |
283 | p4d: early_alloc(PAGE_SIZE, NUMA_NO_NODE)); |
284 | } |
285 | } |
286 | zero_p4d_populate(pgd, addr, end: next); |
287 | } while (pgd++, addr = next, addr != end); |
288 | |
289 | return 0; |
290 | } |
291 | |
292 | static void kasan_free_pte(pte_t *pte_start, pmd_t *pmd) |
293 | { |
294 | pte_t *pte; |
295 | int i; |
296 | |
297 | for (i = 0; i < PTRS_PER_PTE; i++) { |
298 | pte = pte_start + i; |
299 | if (!pte_none(pte: ptep_get(ptep: pte))) |
300 | return; |
301 | } |
302 | |
303 | pte_free_kernel(mm: &init_mm, pte: (pte_t *)page_to_virt(pmd_page(*pmd))); |
304 | pmd_clear(pmdp: pmd); |
305 | } |
306 | |
307 | static void kasan_free_pmd(pmd_t *pmd_start, pud_t *pud) |
308 | { |
309 | pmd_t *pmd; |
310 | int i; |
311 | |
312 | for (i = 0; i < PTRS_PER_PMD; i++) { |
313 | pmd = pmd_start + i; |
314 | if (!pmd_none(pmd: *pmd)) |
315 | return; |
316 | } |
317 | |
318 | pmd_free(mm: &init_mm, pmd: (pmd_t *)page_to_virt(pud_page(*pud))); |
319 | pud_clear(pudp: pud); |
320 | } |
321 | |
322 | static void kasan_free_pud(pud_t *pud_start, p4d_t *p4d) |
323 | { |
324 | pud_t *pud; |
325 | int i; |
326 | |
327 | for (i = 0; i < PTRS_PER_PUD; i++) { |
328 | pud = pud_start + i; |
329 | if (!pud_none(pud: *pud)) |
330 | return; |
331 | } |
332 | |
333 | pud_free(mm: &init_mm, pud: (pud_t *)page_to_virt(p4d_page(*p4d))); |
334 | p4d_clear(p4dp: p4d); |
335 | } |
336 | |
337 | static void kasan_free_p4d(p4d_t *p4d_start, pgd_t *pgd) |
338 | { |
339 | p4d_t *p4d; |
340 | int i; |
341 | |
342 | for (i = 0; i < PTRS_PER_P4D; i++) { |
343 | p4d = p4d_start + i; |
344 | if (!p4d_none(p4d: *p4d)) |
345 | return; |
346 | } |
347 | |
348 | p4d_free(mm: &init_mm, p4d: (p4d_t *)page_to_virt(pgd_page(*pgd))); |
349 | pgd_clear(pgd); |
350 | } |
351 | |
352 | static void kasan_remove_pte_table(pte_t *pte, unsigned long addr, |
353 | unsigned long end) |
354 | { |
355 | unsigned long next; |
356 | pte_t ptent; |
357 | |
358 | for (; addr < end; addr = next, pte++) { |
359 | next = (addr + PAGE_SIZE) & PAGE_MASK; |
360 | if (next > end) |
361 | next = end; |
362 | |
363 | ptent = ptep_get(ptep: pte); |
364 | |
365 | if (!pte_present(a: ptent)) |
366 | continue; |
367 | |
368 | if (WARN_ON(!kasan_early_shadow_page_entry(ptent))) |
369 | continue; |
370 | pte_clear(mm: &init_mm, addr, ptep: pte); |
371 | } |
372 | } |
373 | |
374 | static void kasan_remove_pmd_table(pmd_t *pmd, unsigned long addr, |
375 | unsigned long end) |
376 | { |
377 | unsigned long next; |
378 | |
379 | for (; addr < end; addr = next, pmd++) { |
380 | pte_t *pte; |
381 | |
382 | next = pmd_addr_end(addr, end); |
383 | |
384 | if (!pmd_present(pmd: *pmd)) |
385 | continue; |
386 | |
387 | if (kasan_pte_table(pmd: *pmd)) { |
388 | if (IS_ALIGNED(addr, PMD_SIZE) && |
389 | IS_ALIGNED(next, PMD_SIZE)) { |
390 | pmd_clear(pmdp: pmd); |
391 | continue; |
392 | } |
393 | } |
394 | pte = pte_offset_kernel(pmd, address: addr); |
395 | kasan_remove_pte_table(pte, addr, end: next); |
396 | kasan_free_pte(pte_offset_kernel(pmd, address: 0), pmd); |
397 | } |
398 | } |
399 | |
400 | static void kasan_remove_pud_table(pud_t *pud, unsigned long addr, |
401 | unsigned long end) |
402 | { |
403 | unsigned long next; |
404 | |
405 | for (; addr < end; addr = next, pud++) { |
406 | pmd_t *pmd, *pmd_base; |
407 | |
408 | next = pud_addr_end(addr, end); |
409 | |
410 | if (!pud_present(pud: *pud)) |
411 | continue; |
412 | |
413 | if (kasan_pmd_table(pud: *pud)) { |
414 | if (IS_ALIGNED(addr, PUD_SIZE) && |
415 | IS_ALIGNED(next, PUD_SIZE)) { |
416 | pud_clear(pudp: pud); |
417 | continue; |
418 | } |
419 | } |
420 | pmd = pmd_offset(pud, address: addr); |
421 | pmd_base = pmd_offset(pud, address: 0); |
422 | kasan_remove_pmd_table(pmd, addr, end: next); |
423 | kasan_free_pmd(pmd_start: pmd_base, pud); |
424 | } |
425 | } |
426 | |
427 | static void kasan_remove_p4d_table(p4d_t *p4d, unsigned long addr, |
428 | unsigned long end) |
429 | { |
430 | unsigned long next; |
431 | |
432 | for (; addr < end; addr = next, p4d++) { |
433 | pud_t *pud; |
434 | |
435 | next = p4d_addr_end(addr, end); |
436 | |
437 | if (!p4d_present(p4d: *p4d)) |
438 | continue; |
439 | |
440 | if (kasan_pud_table(p4d: *p4d)) { |
441 | if (IS_ALIGNED(addr, P4D_SIZE) && |
442 | IS_ALIGNED(next, P4D_SIZE)) { |
443 | p4d_clear(p4dp: p4d); |
444 | continue; |
445 | } |
446 | } |
447 | pud = pud_offset(p4d, address: addr); |
448 | kasan_remove_pud_table(pud, addr, end: next); |
449 | kasan_free_pud(pud_offset(p4d, address: 0), p4d); |
450 | } |
451 | } |
452 | |
453 | void kasan_remove_zero_shadow(void *start, unsigned long size) |
454 | { |
455 | unsigned long addr, end, next; |
456 | pgd_t *pgd; |
457 | |
458 | addr = (unsigned long)kasan_mem_to_shadow(start); |
459 | end = addr + (size >> KASAN_SHADOW_SCALE_SHIFT); |
460 | |
461 | if (WARN_ON((unsigned long)start % KASAN_MEMORY_PER_SHADOW_PAGE) || |
462 | WARN_ON(size % KASAN_MEMORY_PER_SHADOW_PAGE)) |
463 | return; |
464 | |
465 | for (; addr < end; addr = next) { |
466 | p4d_t *p4d; |
467 | |
468 | next = pgd_addr_end(addr, end); |
469 | |
470 | pgd = pgd_offset_k(addr); |
471 | if (!pgd_present(pgd: *pgd)) |
472 | continue; |
473 | |
474 | if (kasan_p4d_table(pgd: *pgd)) { |
475 | if (IS_ALIGNED(addr, PGDIR_SIZE) && |
476 | IS_ALIGNED(next, PGDIR_SIZE)) { |
477 | pgd_clear(pgd); |
478 | continue; |
479 | } |
480 | } |
481 | |
482 | p4d = p4d_offset(pgd, address: addr); |
483 | kasan_remove_p4d_table(p4d, addr, end: next); |
484 | kasan_free_p4d(p4d_start: p4d_offset(pgd, address: 0), pgd); |
485 | } |
486 | } |
487 | |
488 | int kasan_add_zero_shadow(void *start, unsigned long size) |
489 | { |
490 | int ret; |
491 | void *shadow_start, *shadow_end; |
492 | |
493 | shadow_start = kasan_mem_to_shadow(start); |
494 | shadow_end = shadow_start + (size >> KASAN_SHADOW_SCALE_SHIFT); |
495 | |
496 | if (WARN_ON((unsigned long)start % KASAN_MEMORY_PER_SHADOW_PAGE) || |
497 | WARN_ON(size % KASAN_MEMORY_PER_SHADOW_PAGE)) |
498 | return -EINVAL; |
499 | |
500 | ret = kasan_populate_early_shadow(shadow_start, shadow_end); |
501 | if (ret) |
502 | kasan_remove_zero_shadow(start, size); |
503 | return ret; |
504 | } |
505 | |