/* * Copyright (c) 2000-2021 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in * compliance with the License. The rights granted to you under the License * may not be used to create, or enable the creation or redistribution of, * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ #ifndef _KASAN_INTERNAL_H_ #define _KASAN_INTERNAL_H_ #include #include #include #include typedef uintptr_t uptr; #define MiB(x) ((x) * 1024UL * 1024) #define BIT(x) (1U << (x)) /* Sanity checks */ #ifndef KASAN #error KASAN undefined #endif #ifndef KASAN_OFFSET #error KASAN_OFFSET undefined #endif #ifndef KASAN_SCALE #error KASAN_SCALE undefined #endif #if defined(__x86_64__) # define _JBLEN ((9 * 2) + 3 + 16) #elif defined(__arm64__) # define _JBLEN ((14 + 8 + 2) * 2) #else # error "Unknown arch" #endif #if KASAN_DEBUG #define NOINLINE OS_NOINLINE #else #define NOINLINE #endif #define ALWAYS_INLINE inline __attribute__((always_inline)) #define CLANG_MIN_VERSION(x) (defined(__apple_build_version__) && (__apple_build_version__ >= (x))) #if KASAN_CLASSIC #define KASAN_MODEL_STR "kasan-classic" #define KASAN_STRIP_ADDR(_x) (_x) #elif KASAN_TBI #define KASAN_MODEL_STR "kasan-tbi" #define KASAN_STRIP_ADDR(_x) (VM_KERNEL_STRIP_UPTR(_x)) #else #error "No kasan model specified" #endif /* KASAN_CLASSIC || KASAN_TBI */ extern vm_address_t kernel_vbase; extern vm_address_t kernel_vtop; extern unsigned shadow_pages_used; /* boot-arg configurable */ extern unsigned kasan_enabled; extern int fakestack_enabled; extern bool report_suppressed_checks; #define KASAN_GRANULE (1UL << KASAN_SCALE) #define KASAN_GRANULE_MASK (KASAN_GRANULE - 1UL) #define kasan_granule_trunc(x) (x & ~KASAN_GRANULE_MASK) #define kasan_granule_round(x) ((x + KASAN_GRANULE_MASK) & ~KASAN_GRANULE_MASK) #define kasan_granule_partial(x) (x & KASAN_GRANULE_MASK) #define ADDRESS_FOR_SHADOW(x) (((KASAN_STRIP_ADDR(x)) - KASAN_OFFSET) << KASAN_SCALE) #define SHADOW_FOR_ADDRESS(x) (uint8_t *)(((KASAN_STRIP_ADDR(x)) >> KASAN_SCALE) + KASAN_OFFSET) enum __attribute__((flag_enum)) kasan_access_types { /* Common to all KASAN versions */ TYPE_LOAD = BIT(0), /* regular memory load */ TYPE_STORE = BIT(1), /* regular store */ TYPE_MEMR = BIT(2), /* memory intrinsic (read) */ TYPE_MEMW = BIT(3), /* memory intrinsic (write) */ TYPE_STRR = BIT(4), /* string intrinsic (read) */ TYPE_STRW = BIT(5), /* string intrinsic (write) */ /* KASAN-classic specific */ TYPE_ZFREE = BIT(6), /* zfree() */ TYPE_FSFREE = BIT(7), /* fakestack free */ TYPE_UAF = BIT(12), TYPE_POISON_GLOBAL = BIT(13), TYPE_POISON_HEAP = BIT(14), /* no TYPE_POISON_STACK, because the runtime does not control stack poisoning */ TYPE_TEST = BIT(15), /* masks */ TYPE_MEM = TYPE_MEMR | TYPE_MEMW, /* memory intrinsics */ TYPE_STR = TYPE_STRR | TYPE_STRW, /* string intrinsics */ TYPE_READ = TYPE_LOAD | TYPE_MEMR | TYPE_STRR, /* all reads */ TYPE_WRITE = TYPE_STORE | TYPE_MEMW | TYPE_STRW, /* all writes */ TYPE_RW = TYPE_READ | TYPE_WRITE, /* reads and writes */ TYPE_FREE = TYPE_ZFREE | TYPE_FSFREE, TYPE_NORMAL = TYPE_RW | TYPE_FREE, TYPE_DYNAMIC = TYPE_NORMAL | TYPE_UAF, TYPE_POISON = TYPE_POISON_GLOBAL | TYPE_POISON_HEAP, TYPE_ALL = ~0U, }; enum kasan_violation_types { REASON_POISONED = 0, /* read or write of poisoned data */ REASON_BAD_METADATA = 1, /* incorrect kasan metadata */ REASON_INVALID_SIZE = 2, /* free size did not match alloc size */ REASON_MOD_AFTER_FREE = 3, /* object modified after free */ REASON_MOD_OOB = 4, /* out of bounds modification of object */ }; typedef enum kasan_access_types access_t; typedef enum kasan_violation_types violation_t; /* * KASAN may support different shadow table formats and different checking * strategies. _impl functions are called from the format-independent * kasan code to the format dependent implementations. */ void kasan_impl_report_internal(uptr, uptr, access_t, violation_t, bool); void kasan_impl_poison_range(vm_offset_t, vm_size_t, uint8_t); void kasan_impl_kdp_disable(void); void kasan_impl_init(void); void kasan_impl_late_init(void); void kasan_impl_fill_valid_range(uintptr_t, size_t); /* * Poisoning comes from KASAN CLASSIC nomenclature. KASAN CLASSIC is based on * identifying valid memory vs poisoned memory (memory that shouldn't be accessed). * This terminology isn't great for KASAN TBI, but is kept for compatibility. */ void kasan_poison(vm_offset_t, vm_size_t, vm_size_t, vm_size_t, uint8_t); /* * Runtime checking. kasan_check_range() is consumed by the inlined * instrumentation. See kasan-helper.c */ bool kasan_check_enabled(access_t); bool kasan_impl_check_enabled(access_t); void kasan_check_range(const void *, size_t, access_t); /* dynamic blacklist */ void kasan_init_dybl(void); bool kasan_is_blacklisted(access_t); void kasan_dybl_load_kext(uintptr_t, const char *); void kasan_dybl_unload_kext(uintptr_t); /* arch-specific interface */ void kasan_arch_init(void); bool kasan_is_shadow_mapped(uintptr_t); /* Locking */ void kasan_lock_init(void); void kasan_lock(boolean_t *); void kasan_unlock(boolean_t); bool kasan_lock_held(thread_t); /* Subsystem helpers */ void kasan_init_fakestack(void); /* * Global variables need to be explicitly handled at runtime, both for xnu * and for KEXTs. */ void kasan_init_globals(vm_offset_t, vm_size_t); /* * Handle KASAN detected issues. If modifying kasan_crash_report(), remember * that is called by the instrumentation as well, see kasan-helper.c. */ void kasan_violation(uintptr_t, size_t, access_t, violation_t); size_t kasan_impl_decode_issue(char *, size_t, uptr, uptr, access_t, violation_t); void NOINLINE OS_NORETURN kasan_crash_report(uptr, uptr, access_t, violation_t); void kasan_handle_test(void); SYSCTL_DECL(kasan); SYSCTL_DECL(_kern_kasan); #endif /* _KASAN_INTERNAL_H_ */