ptdump.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2014, The Linux Foundation. All rights reserved.
  4. * Debug helper to dump the current kernel pagetables of the system
  5. * so that we can see what the various memory ranges are set to.
  6. *
  7. * Derived from x86 and arm implementation:
  8. * (C) Copyright 2008 Intel Corporation
  9. *
  10. * Author: Arjan van de Ven <arjan@linux.intel.com>
  11. */
  12. #include <linux/debugfs.h>
  13. #include <linux/errno.h>
  14. #include <linux/fs.h>
  15. #include <linux/io.h>
  16. #include <linux/init.h>
  17. #include <linux/mm.h>
  18. #include <linux/ptdump.h>
  19. #include <linux/sched.h>
  20. #include <linux/seq_file.h>
  21. #include <asm/fixmap.h>
  22. #include <asm/kasan.h>
  23. #include <asm/memory.h>
  24. #include <asm/pgtable-hwdef.h>
  25. #include <asm/ptdump.h>
  26. enum address_markers_idx {
  27. PAGE_OFFSET_NR = 0,
  28. PAGE_END_NR,
  29. #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
  30. KASAN_START_NR,
  31. #endif
  32. };
  33. static struct addr_marker address_markers[] = {
  34. { PAGE_OFFSET, "Linear Mapping start" },
  35. { 0 /* PAGE_END */, "Linear Mapping end" },
  36. #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
  37. { 0 /* KASAN_SHADOW_START */, "Kasan shadow start" },
  38. { KASAN_SHADOW_END, "Kasan shadow end" },
  39. #endif
  40. { BPF_JIT_REGION_START, "BPF start" },
  41. { BPF_JIT_REGION_END, "BPF end" },
  42. { MODULES_VADDR, "Modules start" },
  43. { MODULES_END, "Modules end" },
  44. { VMALLOC_START, "vmalloc() area" },
  45. { VMALLOC_END, "vmalloc() end" },
  46. { FIXADDR_START, "Fixmap start" },
  47. { FIXADDR_TOP, "Fixmap end" },
  48. { PCI_IO_START, "PCI I/O start" },
  49. { PCI_IO_END, "PCI I/O end" },
  50. #ifdef CONFIG_SPARSEMEM_VMEMMAP
  51. { VMEMMAP_START, "vmemmap start" },
  52. { VMEMMAP_START + VMEMMAP_SIZE, "vmemmap end" },
  53. #endif
  54. { -1, NULL },
  55. };
  56. #define pt_dump_seq_printf(m, fmt, args...) \
  57. ({ \
  58. if (m) \
  59. seq_printf(m, fmt, ##args); \
  60. })
  61. #define pt_dump_seq_puts(m, fmt) \
  62. ({ \
  63. if (m) \
  64. seq_printf(m, fmt); \
  65. })
  66. /*
  67. * The page dumper groups page table entries of the same type into a single
  68. * description. It uses pg_state to track the range information while
  69. * iterating over the pte entries. When the continuity is broken it then
  70. * dumps out a description of the range.
  71. */
  72. struct pg_state {
  73. struct ptdump_state ptdump;
  74. struct seq_file *seq;
  75. const struct addr_marker *marker;
  76. unsigned long start_address;
  77. int level;
  78. u64 current_prot;
  79. bool check_wx;
  80. unsigned long wx_pages;
  81. unsigned long uxn_pages;
  82. };
  83. struct prot_bits {
  84. u64 mask;
  85. u64 val;
  86. const char *set;
  87. const char *clear;
  88. };
  89. static const struct prot_bits pte_bits[] = {
  90. {
  91. .mask = PTE_VALID,
  92. .val = PTE_VALID,
  93. .set = " ",
  94. .clear = "F",
  95. }, {
  96. .mask = PTE_USER,
  97. .val = PTE_USER,
  98. .set = "USR",
  99. .clear = " ",
  100. }, {
  101. .mask = PTE_RDONLY,
  102. .val = PTE_RDONLY,
  103. .set = "ro",
  104. .clear = "RW",
  105. }, {
  106. .mask = PTE_PXN,
  107. .val = PTE_PXN,
  108. .set = "NX",
  109. .clear = "x ",
  110. }, {
  111. .mask = PTE_SHARED,
  112. .val = PTE_SHARED,
  113. .set = "SHD",
  114. .clear = " ",
  115. }, {
  116. .mask = PTE_AF,
  117. .val = PTE_AF,
  118. .set = "AF",
  119. .clear = " ",
  120. }, {
  121. .mask = PTE_NG,
  122. .val = PTE_NG,
  123. .set = "NG",
  124. .clear = " ",
  125. }, {
  126. .mask = PTE_CONT,
  127. .val = PTE_CONT,
  128. .set = "CON",
  129. .clear = " ",
  130. }, {
  131. .mask = PTE_TABLE_BIT,
  132. .val = PTE_TABLE_BIT,
  133. .set = " ",
  134. .clear = "BLK",
  135. }, {
  136. .mask = PTE_UXN,
  137. .val = PTE_UXN,
  138. .set = "UXN",
  139. .clear = " ",
  140. }, {
  141. .mask = PTE_GP,
  142. .val = PTE_GP,
  143. .set = "GP",
  144. .clear = " ",
  145. }, {
  146. .mask = PTE_ATTRINDX_MASK,
  147. .val = PTE_ATTRINDX(MT_DEVICE_nGnRnE),
  148. .set = "DEVICE/nGnRnE",
  149. }, {
  150. .mask = PTE_ATTRINDX_MASK,
  151. .val = PTE_ATTRINDX(MT_DEVICE_nGnRE),
  152. .set = "DEVICE/nGnRE",
  153. }, {
  154. .mask = PTE_ATTRINDX_MASK,
  155. .val = PTE_ATTRINDX(MT_DEVICE_GRE),
  156. .set = "DEVICE/GRE",
  157. }, {
  158. .mask = PTE_ATTRINDX_MASK,
  159. .val = PTE_ATTRINDX(MT_NORMAL_NC),
  160. .set = "MEM/NORMAL-NC",
  161. }, {
  162. .mask = PTE_ATTRINDX_MASK,
  163. .val = PTE_ATTRINDX(MT_NORMAL),
  164. .set = "MEM/NORMAL",
  165. }, {
  166. .mask = PTE_ATTRINDX_MASK,
  167. .val = PTE_ATTRINDX(MT_NORMAL_TAGGED),
  168. .set = "MEM/NORMAL-TAGGED",
  169. }
  170. };
  171. struct pg_level {
  172. const struct prot_bits *bits;
  173. const char *name;
  174. size_t num;
  175. u64 mask;
  176. };
  177. static struct pg_level pg_level[] = {
  178. { /* pgd */
  179. .name = "PGD",
  180. .bits = pte_bits,
  181. .num = ARRAY_SIZE(pte_bits),
  182. }, { /* p4d */
  183. .name = "P4D",
  184. .bits = pte_bits,
  185. .num = ARRAY_SIZE(pte_bits),
  186. }, { /* pud */
  187. .name = (CONFIG_PGTABLE_LEVELS > 3) ? "PUD" : "PGD",
  188. .bits = pte_bits,
  189. .num = ARRAY_SIZE(pte_bits),
  190. }, { /* pmd */
  191. .name = (CONFIG_PGTABLE_LEVELS > 2) ? "PMD" : "PGD",
  192. .bits = pte_bits,
  193. .num = ARRAY_SIZE(pte_bits),
  194. }, { /* pte */
  195. .name = "PTE",
  196. .bits = pte_bits,
  197. .num = ARRAY_SIZE(pte_bits),
  198. },
  199. };
  200. static void dump_prot(struct pg_state *st, const struct prot_bits *bits,
  201. size_t num)
  202. {
  203. unsigned i;
  204. for (i = 0; i < num; i++, bits++) {
  205. const char *s;
  206. if ((st->current_prot & bits->mask) == bits->val)
  207. s = bits->set;
  208. else
  209. s = bits->clear;
  210. if (s)
  211. pt_dump_seq_printf(st->seq, " %s", s);
  212. }
  213. }
  214. static void note_prot_uxn(struct pg_state *st, unsigned long addr)
  215. {
  216. if (!st->check_wx)
  217. return;
  218. if ((st->current_prot & PTE_UXN) == PTE_UXN)
  219. return;
  220. WARN_ONCE(1, "arm64/mm: Found non-UXN mapping at address %p/%pS\n",
  221. (void *)st->start_address, (void *)st->start_address);
  222. st->uxn_pages += (addr - st->start_address) / PAGE_SIZE;
  223. }
  224. static void note_prot_wx(struct pg_state *st, unsigned long addr)
  225. {
  226. if (!st->check_wx)
  227. return;
  228. if ((st->current_prot & PTE_RDONLY) == PTE_RDONLY)
  229. return;
  230. if ((st->current_prot & PTE_PXN) == PTE_PXN)
  231. return;
  232. WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
  233. (void *)st->start_address, (void *)st->start_address);
  234. st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
  235. }
  236. static void note_page(struct ptdump_state *pt_st, unsigned long addr, int level,
  237. u64 val)
  238. {
  239. struct pg_state *st = container_of(pt_st, struct pg_state, ptdump);
  240. static const char units[] = "KMGTPE";
  241. u64 prot = 0;
  242. if (level >= 0)
  243. prot = val & pg_level[level].mask;
  244. if (st->level == -1) {
  245. st->level = level;
  246. st->current_prot = prot;
  247. st->start_address = addr;
  248. pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
  249. } else if (prot != st->current_prot || level != st->level ||
  250. addr >= st->marker[1].start_address) {
  251. const char *unit = units;
  252. unsigned long delta;
  253. if (st->current_prot) {
  254. note_prot_uxn(st, addr);
  255. note_prot_wx(st, addr);
  256. }
  257. pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ",
  258. st->start_address, addr);
  259. delta = (addr - st->start_address) >> 10;
  260. while (!(delta & 1023) && unit[1]) {
  261. delta >>= 10;
  262. unit++;
  263. }
  264. pt_dump_seq_printf(st->seq, "%9lu%c %s", delta, *unit,
  265. pg_level[st->level].name);
  266. if (st->current_prot && pg_level[st->level].bits)
  267. dump_prot(st, pg_level[st->level].bits,
  268. pg_level[st->level].num);
  269. pt_dump_seq_puts(st->seq, "\n");
  270. if (addr >= st->marker[1].start_address) {
  271. st->marker++;
  272. pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
  273. }
  274. st->start_address = addr;
  275. st->current_prot = prot;
  276. st->level = level;
  277. }
  278. if (addr >= st->marker[1].start_address) {
  279. st->marker++;
  280. pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
  281. }
  282. }
  283. void ptdump_walk(struct seq_file *s, struct ptdump_info *info)
  284. {
  285. unsigned long end = ~0UL;
  286. struct pg_state st;
  287. if (info->base_addr < TASK_SIZE_64)
  288. end = TASK_SIZE_64;
  289. st = (struct pg_state){
  290. .seq = s,
  291. .marker = info->markers,
  292. .ptdump = {
  293. .note_page = note_page,
  294. .range = (struct ptdump_range[]){
  295. {info->base_addr, end},
  296. {0, 0}
  297. }
  298. }
  299. };
  300. ptdump_walk_pgd(&st.ptdump, info->mm, NULL);
  301. }
  302. static void ptdump_initialize(void)
  303. {
  304. unsigned i, j;
  305. for (i = 0; i < ARRAY_SIZE(pg_level); i++)
  306. if (pg_level[i].bits)
  307. for (j = 0; j < pg_level[i].num; j++)
  308. pg_level[i].mask |= pg_level[i].bits[j].mask;
  309. }
  310. static struct ptdump_info kernel_ptdump_info = {
  311. .mm = &init_mm,
  312. .markers = address_markers,
  313. .base_addr = PAGE_OFFSET,
  314. };
  315. void ptdump_check_wx(void)
  316. {
  317. struct pg_state st = {
  318. .seq = NULL,
  319. .marker = (struct addr_marker[]) {
  320. { 0, NULL},
  321. { -1, NULL},
  322. },
  323. .level = -1,
  324. .check_wx = true,
  325. .ptdump = {
  326. .note_page = note_page,
  327. .range = (struct ptdump_range[]) {
  328. {PAGE_OFFSET, ~0UL},
  329. {0, 0}
  330. }
  331. }
  332. };
  333. ptdump_walk_pgd(&st.ptdump, &init_mm, NULL);
  334. if (st.wx_pages || st.uxn_pages)
  335. pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",
  336. st.wx_pages, st.uxn_pages);
  337. else
  338. pr_info("Checked W+X mappings: passed, no W+X pages found\n");
  339. }
  340. static int ptdump_init(void)
  341. {
  342. address_markers[PAGE_END_NR].start_address = PAGE_END;
  343. #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
  344. address_markers[KASAN_START_NR].start_address = KASAN_SHADOW_START;
  345. #endif
  346. ptdump_initialize();
  347. ptdump_debugfs_register(&kernel_ptdump_info, "kernel_page_tables");
  348. return 0;
  349. }
  350. device_initcall(ptdump_init);