[mirror_ubuntu-bionic-kernel.git] / arch / x86 / mm / kasan_init_64.c

#define DISABLE_BRANCH_PROFILING
#define pr_fmt(fmt) "kasan: " fmt
#include <linux/bootmem.h>
#include <linux/kasan.h>
#include <linux/kdebug.h>
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/sched/task.h>
#include <linux/vmalloc.h>

#include <asm/e820/types.h>
#include <asm/tlbflush.h>
#include <asm/sections.h>

extern pgd_t early_top_pgt[PTRS_PER_PGD];
extern struct range pfn_mapped[E820_MAX_ENTRIES];

static int __init map_range(struct range *range)
{
	unsigned long start;
	unsigned long end;

	start = (unsigned long)kasan_mem_to_shadow(pfn_to_kaddr(range->start));
	end = (unsigned long)kasan_mem_to_shadow(pfn_to_kaddr(range->end));

	return vmemmap_populate(start, end, NUMA_NO_NODE);
}

static void __init clear_pgds(unsigned long start,
			unsigned long end)
{
	pgd_t *pgd;

	for (; start < end; start += PGDIR_SIZE) {
		pgd = pgd_offset_k(start);
		/*
		 * With folded p4d, pgd_clear() is nop, use p4d_clear()
		 * instead.
		 */
		if (CONFIG_PGTABLE_LEVELS < 5)
			p4d_clear(p4d_offset(pgd, start));
		else
			pgd_clear(pgd);
	}
}

static void __init kasan_map_early_shadow(pgd_t *pgd)
{
	int i;
	unsigned long start = KASAN_SHADOW_START;
	unsigned long end = KASAN_SHADOW_END;

	for (i = pgd_index(start); start < end; i++) {
		switch (CONFIG_PGTABLE_LEVELS) {
		case 4:
			pgd[i] = __pgd(__pa_nodebug(kasan_zero_pud) |
					_KERNPG_TABLE);
			break;
		case 5:
			pgd[i] = __pgd(__pa_nodebug(kasan_zero_p4d) |
					_KERNPG_TABLE);
			break;
		default:
			BUILD_BUG();
		}
		start += PGDIR_SIZE;
	}
}

#ifdef CONFIG_KASAN_INLINE
static int kasan_die_handler(struct notifier_block *self,
			     unsigned long val,
			     void *data)
{
	if (val == DIE_GPF) {
		pr_emerg("CONFIG_KASAN_INLINE enabled\n");
		pr_emerg("GPF could be caused by NULL-ptr deref or user memory access\n");
	}
	return NOTIFY_OK;
}

static struct notifier_block kasan_die_notifier = {
	.notifier_call = kasan_die_handler,
};
#endif

void __init kasan_early_init(void)
{
	int i;
	pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL | _PAGE_ENC;
	pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
	pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
	p4dval_t p4d_val = __pa_nodebug(kasan_zero_pud) | _KERNPG_TABLE;

	for (i = 0; i < PTRS_PER_PTE; i++)
		kasan_zero_pte[i] = __pte(pte_val);

	for (i = 0; i < PTRS_PER_PMD; i++)
		kasan_zero_pmd[i] = __pmd(pmd_val);

	for (i = 0; i < PTRS_PER_PUD; i++)
		kasan_zero_pud[i] = __pud(pud_val);

	for (i = 0; CONFIG_PGTABLE_LEVELS >= 5 && i < PTRS_PER_P4D; i++)
		kasan_zero_p4d[i] = __p4d(p4d_val);

	kasan_map_early_shadow(early_top_pgt);
	kasan_map_early_shadow(init_top_pgt);
}

void __init kasan_init(void)
{
	int i;

#ifdef CONFIG_KASAN_INLINE
	register_die_notifier(&kasan_die_notifier);
#endif

	memcpy(early_top_pgt, init_top_pgt, sizeof(early_top_pgt));
	load_cr3(early_top_pgt);
	__flush_tlb_all();

	clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);

	kasan_populate_zero_shadow((void *)KASAN_SHADOW_START,
			kasan_mem_to_shadow((void *)PAGE_OFFSET));

	for (i = 0; i < E820_MAX_ENTRIES; i++) {
		if (pfn_mapped[i].end == 0)
			break;

		if (map_range(&pfn_mapped[i]))
			panic("kasan: unable to allocate shadow!");
	}
	kasan_populate_zero_shadow(
		kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM),
		kasan_mem_to_shadow((void *)__START_KERNEL_map));

	vmemmap_populate((unsigned long)kasan_mem_to_shadow(_stext),
			(unsigned long)kasan_mem_to_shadow(_end),
			NUMA_NO_NODE);

	kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END),
			(void *)KASAN_SHADOW_END);

	load_cr3(init_top_pgt);
	__flush_tlb_all();

	/*
	 * kasan_zero_page has been used as early shadow memory, thus it may
	 * contain some garbage. Now we can clear and write protect it, since
	 * after the TLB flush no one should write to it.
	 */
	memset(kasan_zero_page, 0, PAGE_SIZE);
	for (i = 0; i < PTRS_PER_PTE; i++) {
		pte_t pte = __pte(__pa(kasan_zero_page) | __PAGE_KERNEL_RO | _PAGE_ENC);
		set_pte(&kasan_zero_pte[i], pte);
	}
	/* Flush TLBs again to be sure that write protection applied. */
	__flush_tlb_all();

	init_task.kasan_depth = 0;
	pr_info("KernelAddressSanitizer initialized\n");
}
Commit	Line	Data
be3606ff	1	#define DISABLE_BRANCH_PROFILING
85155229	2	#define pr_fmt(fmt) "kasan: " fmt
ef7f0d6a AR	3	#include <linux/bootmem.h>
	4	#include <linux/kasan.h>
	5	#include <linux/kdebug.h>
	6	#include <linux/mm.h>
	7	#include <linux/sched.h>
9164bb4a	8	#include <linux/sched/task.h>
ef7f0d6a AR	9	#include <linux/vmalloc.h>
ef7f0d6a AR	10
5520b7e7	11	#include <asm/e820/types.h>
ef7f0d6a AR	12	#include <asm/tlbflush.h>
	13	#include <asm/sections.h>
	14
65ade2f8	15	extern pgd_t early_top_pgt[PTRS_PER_PGD];
08b46d5d	16	extern struct range pfn_mapped[E820_MAX_ENTRIES];
ef7f0d6a	17
ef7f0d6a AR	18	static int __init map_range(struct range *range)
	19	{
	20	unsigned long start;
	21	unsigned long end;
	22
	23	start = (unsigned long)kasan_mem_to_shadow(pfn_to_kaddr(range->start));
	24	end = (unsigned long)kasan_mem_to_shadow(pfn_to_kaddr(range->end));
	25
4d461333	26	return vmemmap_populate(start, end, NUMA_NO_NODE);
ef7f0d6a AR	27	}
	28
	29	static void __init clear_pgds(unsigned long start,
	30	unsigned long end)
	31	{
d691a3cf KS	32	pgd_t *pgd;
	33
	34	for (; start < end; start += PGDIR_SIZE) {
	35	pgd = pgd_offset_k(start);
	36	/*
	37	* With folded p4d, pgd_clear() is nop, use p4d_clear()
	38	* instead.
	39	*/
	40	if (CONFIG_PGTABLE_LEVELS < 5)
	41	p4d_clear(p4d_offset(pgd, start));
	42	else
	43	pgd_clear(pgd);
	44	}
ef7f0d6a AR	45	}
ef7f0d6a AR	46
5d5aa3cf	47	static void __init kasan_map_early_shadow(pgd_t *pgd)
ef7f0d6a AR	48	{
	49	int i;
	50	unsigned long start = KASAN_SHADOW_START;
	51	unsigned long end = KASAN_SHADOW_END;
	52
	53	for (i = pgd_index(start); start < end; i++) {
5480bb61 KS	54	switch (CONFIG_PGTABLE_LEVELS) {
	55	case 4:
	56	pgd[i] = __pgd(__pa_nodebug(kasan_zero_pud) \|
	57	_KERNPG_TABLE);
	58	break;
	59	case 5:
	60	pgd[i] = __pgd(__pa_nodebug(kasan_zero_p4d) \|
	61	_KERNPG_TABLE);
	62	break;
	63	default:
	64	BUILD_BUG();
	65	}
ef7f0d6a AR	66	start += PGDIR_SIZE;
	67	}
	68	}
	69
ef7f0d6a AR	70	#ifdef CONFIG_KASAN_INLINE
	71	static int kasan_die_handler(struct notifier_block *self,
	72	unsigned long val,
	73	void *data)
	74	{
	75	if (val == DIE_GPF) {
2ba78056 DV	76	pr_emerg("CONFIG_KASAN_INLINE enabled\n");
2ba78056 DV	77	pr_emerg("GPF could be caused by NULL-ptr deref or user memory access\n");
ef7f0d6a AR	78	}
	79	return NOTIFY_OK;
	80	}
	81
	82	static struct notifier_block kasan_die_notifier = {
	83	.notifier_call = kasan_die_handler,
	84	};
	85	#endif
	86
5d5aa3cf AP	87	void __init kasan_early_init(void)
	88	{
	89	int i;
21729f81	90	pteval_t pte_val = __pa_nodebug(kasan_zero_page) \| __PAGE_KERNEL \| _PAGE_ENC;
5d5aa3cf AP	91	pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) \| _KERNPG_TABLE;
5d5aa3cf AP	92	pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) \| _KERNPG_TABLE;
5480bb61	93	p4dval_t p4d_val = __pa_nodebug(kasan_zero_pud) \| _KERNPG_TABLE;
5d5aa3cf AP	94
	95	for (i = 0; i < PTRS_PER_PTE; i++)
	96	kasan_zero_pte[i] = __pte(pte_val);
	97
	98	for (i = 0; i < PTRS_PER_PMD; i++)
	99	kasan_zero_pmd[i] = __pmd(pmd_val);
	100
	101	for (i = 0; i < PTRS_PER_PUD; i++)
	102	kasan_zero_pud[i] = __pud(pud_val);
	103
5480bb61 KS	104	for (i = 0; CONFIG_PGTABLE_LEVELS >= 5 && i < PTRS_PER_P4D; i++)
	105	kasan_zero_p4d[i] = __p4d(p4d_val);
	106
65ade2f8 KS	107	kasan_map_early_shadow(early_top_pgt);
65ade2f8 KS	108	kasan_map_early_shadow(init_top_pgt);
5d5aa3cf AP	109	}
5d5aa3cf AP	110
ef7f0d6a AR	111	void __init kasan_init(void)
	112	{
	113	int i;
	114
	115	#ifdef CONFIG_KASAN_INLINE
	116	register_die_notifier(&kasan_die_notifier);
	117	#endif
	118
65ade2f8 KS	119	memcpy(early_top_pgt, init_top_pgt, sizeof(early_top_pgt));
65ade2f8 KS	120	load_cr3(early_top_pgt);
241d2c54	121	__flush_tlb_all();
ef7f0d6a AR	122
	123	clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
	124
69786cdb	125	kasan_populate_zero_shadow((void *)KASAN_SHADOW_START,
ef7f0d6a AR	126	kasan_mem_to_shadow((void *)PAGE_OFFSET));
ef7f0d6a AR	127
08b46d5d	128	for (i = 0; i < E820_MAX_ENTRIES; i++) {
ef7f0d6a AR	129	if (pfn_mapped[i].end == 0)
	130	break;
	131
	132	if (map_range(&pfn_mapped[i]))
	133	panic("kasan: unable to allocate shadow!");
	134	}
69786cdb AR	135	kasan_populate_zero_shadow(
	136	kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM),
	137	kasan_mem_to_shadow((void *)__START_KERNEL_map));
c420f167 AR	138
	139	vmemmap_populate((unsigned long)kasan_mem_to_shadow(_stext),
	140	(unsigned long)kasan_mem_to_shadow(_end),
	141	NUMA_NO_NODE);
	142
69786cdb	143	kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END),
c420f167	144	(void *)KASAN_SHADOW_END);
ef7f0d6a	145
65ade2f8	146	load_cr3(init_top_pgt);
241d2c54	147	__flush_tlb_all();
85155229	148
69e0210f AR	149	/*
69e0210f AR	150	* kasan_zero_page has been used as early shadow memory, thus it may
063fb3e5 AR	151	* contain some garbage. Now we can clear and write protect it, since
063fb3e5 AR	152	* after the TLB flush no one should write to it.
69e0210f AR	153	*/
69e0210f AR	154	memset(kasan_zero_page, 0, PAGE_SIZE);
063fb3e5	155	for (i = 0; i < PTRS_PER_PTE; i++) {
21729f81	156	pte_t pte = __pte(__pa(kasan_zero_page) \| __PAGE_KERNEL_RO \| _PAGE_ENC);
063fb3e5 AR	157	set_pte(&kasan_zero_pte[i], pte);
	158	}
	159	/* Flush TLBs again to be sure that write protection applied. */
	160	__flush_tlb_all();
69e0210f AR	161
69e0210f AR	162	init_task.kasan_depth = 0;
25add7ec	163	pr_info("KernelAddressSanitizer initialized\n");
ef7f0d6a	164	}