[49/78] kasan, arm64: implement HW_TAGS runtime

Message ID	20201218220405.TDzOdRjiz%akpm@linux-foundation.org (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=Y0WR=FW=kvack.org=owner-linux-mm@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1889923B5D Date: Fri, 18 Dec 2020 14:04:05 -0800 From: Andrew Morton <akpm@linux-foundation.org> To: akpm@linux-foundation.org, andreyknvl@google.com, aryabinin@virtuozzo.com, Branislav.Rankov@arm.com, catalin.marinas@arm.com, dvyukov@google.com, elver@google.com, eugenis@google.com, glider@google.com, gor@linux.ibm.com, kevin.brodsky@arm.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, torvalds@linux-foundation.org, vincenzo.frascino@arm.com, will.deacon@arm.com Subject: [patch 49/78] kasan, arm64: implement HW_TAGS runtime Message-ID: <20201218220405.TDzOdRjiz%akpm@linux-foundation.org> In-Reply-To: <20201218140046.497484741326828e5b5d46ec@linux-foundation.org> User-Agent: s-nail v14.8.16 Sender: owner-linux-mm@kvack.org Precedence: bulk
Series	[01/78] mm/memcg: bail early from swap accounting if memcg disabled \| expand [01/78] mm/memcg: bail early from swap accounting if memcg disabled [02/78] mm/memcg: warning on !memcg after readahead page charged [03/78] mm/memcg: remove unused definitions [04/78] mm, kvm: account kvm_vcpu_mmap to kmemcg [05/78] mm/memcontrol:rewrite mem_cgroup_page_lruvec() [06/78] epoll: check for events when removing a timed out thread from the wait queue [07/78] epoll: simplify signal handling [08/78] epoll: pull fatal signal checks into ep_send_events() [09/78] epoll: move eavail next to the list_empty_careful check [10/78] epoll: simplify and optimize busy loop logic [11/78] epoll: pull all code between fetch_events and send_event into the loop [12/78] epoll: replace gotos with a proper loop [13/78] epoll: eliminate unnecessary lock for zero timeout [14/78] kasan: drop unnecessary GPL text from comment headers [15/78] kasan: KASAN_VMALLOC depends on KASAN_GENERIC [16/78] kasan: group vmalloc code [17/78] kasan: shadow declarations only for software modes [18/78] kasan: rename (un)poison_shadow to (un)poison_range [19/78] kasan: rename KASAN_SHADOW_* to KASAN_GRANULE_* [20/78] kasan: only build init.c for software modes [21/78] kasan: split out shadow.c from common.c [22/78] kasan: define KASAN_MEMORY_PER_SHADOW_PAGE [23/78] kasan: rename report and tags files [24/78] kasan: don't duplicate config dependencies [25/78] kasan: hide invalid free check implementation [26/78] kasan: decode stack frame only with KASAN_STACK_ENABLE [27/78] kasan, arm64: only init shadow for software modes [28/78] kasan, arm64: only use kasan_depth for software modes [29/78] kasan, arm64: move initialization message [30/78] kasan, arm64: rename kasan_init_tags and mark as __init [31/78] kasan: rename addr_has_shadow to addr_has_metadata [32/78] kasan: rename print_shadow_for_address to print_memory_metadata [33/78] kasan: rename SHADOW layout macros to META [34/78] kasan: separate metadata_fetch_row for each mode [35/78] kasan: introduce CONFIG_KASAN_HW_TAGS [36/78] arm64: enable armv8.5-a asm-arch option [37/78] arm64: mte: add in-kernel MTE helpers [38/78] arm64: mte: reset the page tag in page->flags [39/78] arm64: mte: add in-kernel tag fault handler [40/78] arm64: kasan: allow enabling in-kernel MTE [41/78] arm64: mte: convert gcr_user into an exclude mask [42/78] arm64: mte: switch GCR_EL1 in kernel entry and exit [43/78] kasan, mm: untag page address in free_reserved_area [44/78] arm64: kasan: align allocations for HW_TAGS [45/78] arm64: kasan: add arch layer for memory tagging helpers [46/78] kasan: define KASAN_GRANULE_SIZE for HW_TAGS [47/78] kasan, x86, s390: update undef CONFIG_KASAN [48/78] kasan, arm64: expand CONFIG_KASAN checks [49/78] kasan, arm64: implement HW_TAGS runtime [50/78] kasan, arm64: print report from tag fault handler [51/78] kasan, mm: reset tags when accessing metadata [52/78] kasan, arm64: enable CONFIG_KASAN_HW_TAGS [53/78] kasan: add documentation for hardware tag-based mode [54/78] kselftest/arm64: check GCR_EL1 after context switch [55/78] kasan: simplify quarantine_put call site [56/78] kasan: rename get_alloc/free_info [57/78] kasan: introduce set_alloc_info [58/78] kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK [59/78] kasan: allow VMAP_STACK for HW_TAGS mode [60/78] kasan: remove __kasan_unpoison_stack [61/78] kasan: inline kasan_reset_tag for tag-based modes [62/78] kasan: inline random_tag for HW_TAGS [63/78] kasan: open-code kasan_unpoison_slab [64/78] kasan: inline (un)poison_range and check_invalid_free [65/78] kasan: add and integrate kasan boot parameters [66/78] kasan, mm: check kasan_enabled in annotations [67/78] kasan, mm: rename kasan_poison_kfree [68/78] kasan: don't round_up too much [69/78] kasan: simplify assign_tag and set_tag calls [70/78] kasan: clarify comment in __kasan_kfree_large [71/78] kasan: sanitize objects when metadata doesn't fit [72/78] kasan, mm: allow cache merging with no metadata [73/78] kasan: update documentation [74/78] mm/Kconfig: fix spelling mistake "whats" -> "what's" [75/78] epoll: convert internal api to timespec64 [76/78] epoll: add syscall epoll_pwait2 [77/78] epoll: wire up syscall epoll_pwait2 [78/78] selftests/filesystems: expand epoll with epoll_pwait2

--- a/arch/arm64/include/asm/memory.h~kasan-arm64-implement-hw_tags-runtime +++ a/arch/arm64/include/asm/memory.h @@ -214,7 +214,7 @@ static inline unsigned long kaslr_offset (__force __typeof__(addr))__addr; \ }) -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define __tag_shifted(tag) ((u64)(tag) << 56) #define __tag_reset(addr) __untagged_addr(addr) #define __tag_get(addr) (__u8)((u64)(addr) >> 56) @@ -222,7 +222,7 @@ static inline unsigned long kaslr_offset #define __tag_shifted(tag) 0UL #define __tag_reset(addr) (addr) #define __tag_get(addr) 0 -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline const void *__tag_set(const void *addr, u8 tag) { --- a/arch/arm64/kernel/cpufeature.c~kasan-arm64-implement-hw_tags-runtime +++ a/arch/arm64/kernel/cpufeature.c @@ -70,6 +70,7 @@ #include <linux/types.h> #include <linux/mm.h> #include <linux/cpu.h> +#include <linux/kasan.h> #include <asm/cpu.h> #include <asm/cpufeature.h> #include <asm/cpu_ops.h> @@ -1709,6 +1710,8 @@ static void cpu_enable_mte(struct arm64_ cleared_zero_page = true; mte_clear_page_tags(lm_alias(empty_zero_page)); } + + kasan_init_hw_tags_cpu(); } #endif /* CONFIG_ARM64_MTE */ --- a/arch/arm64/kernel/smp.c~kasan-arm64-implement-hw_tags-runtime +++ a/arch/arm64/kernel/smp.c @@ -462,6 +462,8 @@ void __init smp_prepare_boot_cpu(void) /* Conditionally switch to GIC PMR for interrupt masking */ if (system_uses_irq_prio_masking()) init_gic_priority_masking(); + + kasan_init_hw_tags(); } static u64 __init of_get_cpu_mpidr(struct device_node *dn) --- a/include/linux/kasan.h~kasan-arm64-implement-hw_tags-runtime +++ a/include/linux/kasan.h @@ -190,25 +190,35 @@ static inline void kasan_record_aux_stac #endif /* CONFIG_KASAN_GENERIC */ -#ifdef CONFIG_KASAN_SW_TAGS - -void __init kasan_init_sw_tags(void); +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void *kasan_reset_tag(const void *addr); bool kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip); -#else /* CONFIG_KASAN_SW_TAGS */ - -static inline void kasan_init_sw_tags(void) { } +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline void *kasan_reset_tag(const void *addr) { return (void *)addr; } -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/ + +#ifdef CONFIG_KASAN_SW_TAGS +void __init kasan_init_sw_tags(void); +#else +static inline void kasan_init_sw_tags(void) { } +#endif + +#ifdef CONFIG_KASAN_HW_TAGS +void kasan_init_hw_tags_cpu(void); +void __init kasan_init_hw_tags(void); +#else +static inline void kasan_init_hw_tags_cpu(void) { } +static inline void kasan_init_hw_tags(void) { } +#endif #ifdef CONFIG_KASAN_VMALLOC --- a/include/linux/mm.h~kasan-arm64-implement-hw_tags-runtime +++ a/include/linux/mm.h @@ -1421,7 +1421,7 @@ static inline bool cpupid_match_pid(stru } #endif /* CONFIG_NUMA_BALANCING */ -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) static inline u8 page_kasan_tag(const struct page *page) { return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; --- a/include/linux/page-flags-layout.h~kasan-arm64-implement-hw_tags-runtime +++ a/include/linux/page-flags-layout.h @@ -77,7 +77,7 @@ #define LAST_CPUPID_SHIFT 0 #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define KASAN_TAG_WIDTH 8 #else #define KASAN_TAG_WIDTH 0 --- a/mm/kasan/common.c~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/common.c @@ -118,7 +118,7 @@ void kasan_free_pages(struct page *page, */ static inline unsigned int optimal_redzone(unsigned int object_size) { - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) return 0; return @@ -183,14 +183,14 @@ size_t kasan_metadata_size(struct kmem_c struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, const void *object) { - return (void *)object + cache->kasan_info.alloc_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset; } struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object) { BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); - return (void *)object + cache->kasan_info.free_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset; } void kasan_poison_slab(struct page *page) @@ -272,9 +272,8 @@ void * __must_check kasan_init_slab_obj( alloc_info = get_alloc_info(cache, object); __memset(alloc_info, 0, sizeof(*alloc_info)); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) - object = set_tag(object, - assign_tag(cache, object, true, false)); + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) + object = set_tag(object, assign_tag(cache, object, true, false)); return (void *)object; } @@ -342,10 +341,10 @@ static void *__kasan_kmalloc(struct kmem redzone_end = round_up((unsigned long)object + cache->object_size, KASAN_GRANULE_SIZE); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) tag = assign_tag(cache, object, false, keep_tag); - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */ + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */ unpoison_range(set_tag(object, tag), size); poison_range((void *)redzone_start, redzone_end - redzone_start, KASAN_KMALLOC_REDZONE); --- /dev/null +++ a/mm/kasan/hw_tags.c @@ -0,0 +1,89 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains core hardware tag-based KASAN code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov <andreyknvl@google.com> + */ + +#define pr_fmt(fmt) "kasan: " fmt + +#include <linux/kasan.h> +#include <linux/kernel.h> +#include <linux/kfence.h> +#include <linux/memory.h> +#include <linux/mm.h> +#include <linux/string.h> +#include <linux/types.h> + +#include "kasan.h" + +/* kasan_init_hw_tags_cpu() is called for each CPU. */ +void kasan_init_hw_tags_cpu(void) +{ + hw_init_tags(KASAN_TAG_MAX); + hw_enable_tagging(); +} + +/* kasan_init_hw_tags() is called once on boot CPU. */ +void __init kasan_init_hw_tags(void) +{ + pr_info("KernelAddressSanitizer initialized\n"); +} + +void *kasan_reset_tag(const void *addr) +{ + return reset_tag(addr); +} + +void poison_range(const void *address, size_t size, u8 value) +{ + /* Skip KFENCE memory if called explicitly outside of sl*b. */ + if (is_kfence_address(address)) + return; + + hw_set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), value); +} + +void unpoison_range(const void *address, size_t size) +{ + /* Skip KFENCE memory if called explicitly outside of sl*b. */ + if (is_kfence_address(address)) + return; + + hw_set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); +} + +u8 random_tag(void) +{ + return hw_get_random_tag(); +} + +bool check_invalid_free(void *addr) +{ + u8 ptr_tag = get_tag(addr); + u8 mem_tag = hw_get_mem_tag(addr); + + return (mem_tag == KASAN_TAG_INVALID) || + (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag); +} + +void kasan_set_free_info(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + kasan_set_track(&alloc_meta->free_track[0], GFP_NOWAIT); +} + +struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + return &alloc_meta->free_track[0]; +} --- a/mm/kasan/kasan.h~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/kasan.h @@ -154,6 +154,11 @@ struct kasan_alloc_meta *get_alloc_info( struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object); +void poison_range(const void *address, size_t size, u8 value); +void unpoison_range(const void *address, size_t size); + +#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) + static inline const void *kasan_shadow_to_mem(const void *shadow_addr) { return (void *)(((unsigned long)shadow_addr - KASAN_SHADOW_OFFSET) @@ -165,9 +170,6 @@ static inline bool addr_has_metadata(con return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); } -void poison_range(const void *address, size_t size, u8 value); -void unpoison_range(const void *address, size_t size); - /** * check_memory_region - Check memory region, and report if invalid access. * @addr: the accessed address @@ -179,6 +181,15 @@ void unpoison_range(const void *address, bool check_memory_region(unsigned long addr, size_t size, bool write, unsigned long ret_ip); +#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + +static inline bool addr_has_metadata(const void *addr) +{ + return true; +} + +#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + bool check_invalid_free(void *addr); void *find_first_bad_addr(void *addr, size_t size); @@ -215,7 +226,7 @@ static inline void quarantine_reduce(voi static inline void quarantine_remove_cache(struct kmem_cache *cache) { } #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void print_tags(u8 addr_tag, const void *addr); --- a/mm/kasan/Makefile~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/Makefile @@ -10,8 +10,10 @@ CFLAGS_REMOVE_init.o = $(CC_FLAGS_FTRACE CFLAGS_REMOVE_quarantine.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_generic.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_report_hw_tags.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_sw_tags.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_shadow.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_hw_tags.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_sw_tags.o = $(CC_FLAGS_FTRACE) # Function splitter causes unnecessary splits in __asan_load1/__asan_store1 @@ -27,10 +29,13 @@ CFLAGS_init.o := $(CC_FLAGS_KASAN_RUNTIM CFLAGS_quarantine.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_generic.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_report_hw_tags.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_sw_tags.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_shadow.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_hw_tags.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_sw_tags.o := $(CC_FLAGS_KASAN_RUNTIME) obj-$(CONFIG_KASAN) := common.o report.o obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o +obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o --- /dev/null +++ a/mm/kasan/report_hw_tags.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains hardware tag-based KASAN specific error reporting code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov <andreyknvl@google.com> + */ + +#include <linux/kasan.h> +#include <linux/kernel.h> +#include <linux/memory.h> +#include <linux/mm.h> +#include <linux/string.h> +#include <linux/types.h> + +#include "kasan.h" + +const char *get_bug_type(struct kasan_access_info *info) +{ + return "invalid-access"; +} + +void *find_first_bad_addr(void *addr, size_t size) +{ + return reset_tag(addr); +} + +void metadata_fetch_row(char *buffer, void *row) +{ + int i; + + for (i = 0; i < META_BYTES_PER_ROW; i++) + buffer[i] = hw_get_mem_tag(row + i * KASAN_GRANULE_SIZE); +} + +void print_tags(u8 addr_tag, const void *addr) +{ + u8 memory_tag = hw_get_mem_tag((void *)addr); + + pr_err("Pointer tag: [%02x], memory tag: [%02x]\n", + addr_tag, memory_tag); +} --- a/mm/kasan/report_sw_tags.c~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/report_sw_tags.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains tag-based KASAN specific error reporting code. + * This file contains software tag-based KASAN specific error reporting code. * * Copyright (c) 2014 Samsung Electronics Co., Ltd. * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> --- a/mm/kasan/shadow.c~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/shadow.c @@ -120,7 +120,7 @@ void unpoison_range(const void *address, if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) *shadow = tag; - else + else /* CONFIG_KASAN_GENERIC */ *shadow = size & KASAN_GRANULE_MASK; } } --- a/mm/kasan/sw_tags.c~kasan-arm64-implement-hw_tags-runtime +++ a/mm/kasan/sw_tags.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains core tag-based KASAN code. + * This file contains core software tag-based KASAN code. * * Copyright (c) 2018 Google, Inc. * Author: Andrey Konovalov <andreyknvl@google.com>

[49/78] kasan, arm64: implement HW_TAGS runtime

Commit Message

Patch