Commit | Line | Data |
---|---|---|
b886d83c | 1 | // SPDX-License-Identifier: GPL-2.0-only |
c9465b4e LA |
2 | /* |
3 | * Copyright (c) 2014, The Linux Foundation. All rights reserved. | |
4 | * Debug helper to dump the current kernel pagetables of the system | |
5 | * so that we can see what the various memory ranges are set to. | |
6 | * | |
7 | * Derived from x86 and arm implementation: | |
8 | * (C) Copyright 2008 Intel Corporation | |
9 | * | |
10 | * Author: Arjan van de Ven <arjan@linux.intel.com> | |
c9465b4e LA |
11 | */ |
12 | #include <linux/debugfs.h> | |
764011ca | 13 | #include <linux/errno.h> |
c9465b4e | 14 | #include <linux/fs.h> |
284be285 | 15 | #include <linux/io.h> |
764011ca | 16 | #include <linux/init.h> |
c9465b4e LA |
17 | #include <linux/mm.h> |
18 | #include <linux/sched.h> | |
19 | #include <linux/seq_file.h> | |
20 | ||
21 | #include <asm/fixmap.h> | |
d8fc68a0 | 22 | #include <asm/kasan.h> |
764011ca | 23 | #include <asm/memory.h> |
c9465b4e | 24 | #include <asm/pgtable.h> |
764011ca | 25 | #include <asm/pgtable-hwdef.h> |
4674fdb9 | 26 | #include <asm/ptdump.h> |
c9465b4e | 27 | |
c8f8cca4 | 28 | static const struct addr_marker address_markers[] = { |
d8fc68a0 AB |
29 | #ifdef CONFIG_KASAN |
30 | { KASAN_SHADOW_START, "Kasan shadow start" }, | |
31 | { KASAN_SHADOW_END, "Kasan shadow end" }, | |
32 | #endif | |
c8f8cca4 AB |
33 | { MODULES_VADDR, "Modules start" }, |
34 | { MODULES_END, "Modules end" }, | |
4733c7c7 WD |
35 | { VMALLOC_START, "vmalloc() area" }, |
36 | { VMALLOC_END, "vmalloc() end" }, | |
c8f8cca4 AB |
37 | { FIXADDR_START, "Fixmap start" }, |
38 | { FIXADDR_TOP, "Fixmap end" }, | |
39 | { PCI_IO_START, "PCI I/O start" }, | |
40 | { PCI_IO_END, "PCI I/O end" }, | |
3e1907d5 | 41 | #ifdef CONFIG_SPARSEMEM_VMEMMAP |
c8f8cca4 AB |
42 | { VMEMMAP_START, "vmemmap start" }, |
43 | { VMEMMAP_START + VMEMMAP_SIZE, "vmemmap end" }, | |
3e1907d5 | 44 | #endif |
4733c7c7 | 45 | { PAGE_OFFSET, "Linear mapping" }, |
c8f8cca4 | 46 | { -1, NULL }, |
c9465b4e LA |
47 | }; |
48 | ||
ae5d1cf3 LA |
49 | #define pt_dump_seq_printf(m, fmt, args...) \ |
50 | ({ \ | |
51 | if (m) \ | |
52 | seq_printf(m, fmt, ##args); \ | |
53 | }) | |
54 | ||
55 | #define pt_dump_seq_puts(m, fmt) \ | |
56 | ({ \ | |
57 | if (m) \ | |
58 | seq_printf(m, fmt); \ | |
59 | }) | |
60 | ||
202e41a1 JL |
61 | /* |
62 | * The page dumper groups page table entries of the same type into a single | |
63 | * description. It uses pg_state to track the range information while | |
64 | * iterating over the pte entries. When the continuity is broken it then | |
65 | * dumps out a description of the range. | |
66 | */ | |
c9465b4e LA |
67 | struct pg_state { |
68 | struct seq_file *seq; | |
69 | const struct addr_marker *marker; | |
70 | unsigned long start_address; | |
71 | unsigned level; | |
72 | u64 current_prot; | |
1404d6f1 LA |
73 | bool check_wx; |
74 | unsigned long wx_pages; | |
75 | unsigned long uxn_pages; | |
c9465b4e LA |
76 | }; |
77 | ||
78 | struct prot_bits { | |
79 | u64 mask; | |
80 | u64 val; | |
81 | const char *set; | |
82 | const char *clear; | |
83 | }; | |
84 | ||
85 | static const struct prot_bits pte_bits[] = { | |
86 | { | |
d7e9d594 LA |
87 | .mask = PTE_VALID, |
88 | .val = PTE_VALID, | |
89 | .set = " ", | |
90 | .clear = "F", | |
91 | }, { | |
c9465b4e LA |
92 | .mask = PTE_USER, |
93 | .val = PTE_USER, | |
94 | .set = "USR", | |
95 | .clear = " ", | |
96 | }, { | |
97 | .mask = PTE_RDONLY, | |
98 | .val = PTE_RDONLY, | |
99 | .set = "ro", | |
100 | .clear = "RW", | |
101 | }, { | |
102 | .mask = PTE_PXN, | |
103 | .val = PTE_PXN, | |
104 | .set = "NX", | |
105 | .clear = "x ", | |
106 | }, { | |
107 | .mask = PTE_SHARED, | |
108 | .val = PTE_SHARED, | |
109 | .set = "SHD", | |
110 | .clear = " ", | |
111 | }, { | |
112 | .mask = PTE_AF, | |
113 | .val = PTE_AF, | |
114 | .set = "AF", | |
115 | .clear = " ", | |
116 | }, { | |
117 | .mask = PTE_NG, | |
118 | .val = PTE_NG, | |
119 | .set = "NG", | |
120 | .clear = " ", | |
202e41a1 JL |
121 | }, { |
122 | .mask = PTE_CONT, | |
123 | .val = PTE_CONT, | |
124 | .set = "CON", | |
125 | .clear = " ", | |
126 | }, { | |
127 | .mask = PTE_TABLE_BIT, | |
128 | .val = PTE_TABLE_BIT, | |
129 | .set = " ", | |
130 | .clear = "BLK", | |
c9465b4e LA |
131 | }, { |
132 | .mask = PTE_UXN, | |
133 | .val = PTE_UXN, | |
134 | .set = "UXN", | |
135 | }, { | |
136 | .mask = PTE_ATTRINDX_MASK, | |
137 | .val = PTE_ATTRINDX(MT_DEVICE_nGnRnE), | |
138 | .set = "DEVICE/nGnRnE", | |
139 | }, { | |
140 | .mask = PTE_ATTRINDX_MASK, | |
141 | .val = PTE_ATTRINDX(MT_DEVICE_nGnRE), | |
142 | .set = "DEVICE/nGnRE", | |
143 | }, { | |
144 | .mask = PTE_ATTRINDX_MASK, | |
145 | .val = PTE_ATTRINDX(MT_DEVICE_GRE), | |
146 | .set = "DEVICE/GRE", | |
147 | }, { | |
148 | .mask = PTE_ATTRINDX_MASK, | |
149 | .val = PTE_ATTRINDX(MT_NORMAL_NC), | |
150 | .set = "MEM/NORMAL-NC", | |
151 | }, { | |
152 | .mask = PTE_ATTRINDX_MASK, | |
153 | .val = PTE_ATTRINDX(MT_NORMAL), | |
154 | .set = "MEM/NORMAL", | |
155 | } | |
156 | }; | |
157 | ||
158 | struct pg_level { | |
159 | const struct prot_bits *bits; | |
48dd73c5 | 160 | const char *name; |
c9465b4e LA |
161 | size_t num; |
162 | u64 mask; | |
163 | }; | |
164 | ||
165 | static struct pg_level pg_level[] = { | |
166 | { | |
167 | }, { /* pgd */ | |
48dd73c5 | 168 | .name = "PGD", |
c9465b4e LA |
169 | .bits = pte_bits, |
170 | .num = ARRAY_SIZE(pte_bits), | |
171 | }, { /* pud */ | |
48dd73c5 | 172 | .name = (CONFIG_PGTABLE_LEVELS > 3) ? "PUD" : "PGD", |
c9465b4e LA |
173 | .bits = pte_bits, |
174 | .num = ARRAY_SIZE(pte_bits), | |
175 | }, { /* pmd */ | |
48dd73c5 | 176 | .name = (CONFIG_PGTABLE_LEVELS > 2) ? "PMD" : "PGD", |
c9465b4e LA |
177 | .bits = pte_bits, |
178 | .num = ARRAY_SIZE(pte_bits), | |
179 | }, { /* pte */ | |
48dd73c5 | 180 | .name = "PTE", |
c9465b4e LA |
181 | .bits = pte_bits, |
182 | .num = ARRAY_SIZE(pte_bits), | |
183 | }, | |
184 | }; | |
185 | ||
186 | static void dump_prot(struct pg_state *st, const struct prot_bits *bits, | |
187 | size_t num) | |
188 | { | |
189 | unsigned i; | |
190 | ||
191 | for (i = 0; i < num; i++, bits++) { | |
192 | const char *s; | |
193 | ||
194 | if ((st->current_prot & bits->mask) == bits->val) | |
195 | s = bits->set; | |
196 | else | |
197 | s = bits->clear; | |
198 | ||
199 | if (s) | |
ae5d1cf3 | 200 | pt_dump_seq_printf(st->seq, " %s", s); |
c9465b4e LA |
201 | } |
202 | } | |
203 | ||
1404d6f1 LA |
204 | static void note_prot_uxn(struct pg_state *st, unsigned long addr) |
205 | { | |
206 | if (!st->check_wx) | |
207 | return; | |
208 | ||
209 | if ((st->current_prot & PTE_UXN) == PTE_UXN) | |
210 | return; | |
211 | ||
212 | WARN_ONCE(1, "arm64/mm: Found non-UXN mapping at address %p/%pS\n", | |
213 | (void *)st->start_address, (void *)st->start_address); | |
214 | ||
215 | st->uxn_pages += (addr - st->start_address) / PAGE_SIZE; | |
216 | } | |
217 | ||
218 | static void note_prot_wx(struct pg_state *st, unsigned long addr) | |
219 | { | |
220 | if (!st->check_wx) | |
221 | return; | |
222 | if ((st->current_prot & PTE_RDONLY) == PTE_RDONLY) | |
223 | return; | |
224 | if ((st->current_prot & PTE_PXN) == PTE_PXN) | |
225 | return; | |
226 | ||
227 | WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n", | |
228 | (void *)st->start_address, (void *)st->start_address); | |
229 | ||
230 | st->wx_pages += (addr - st->start_address) / PAGE_SIZE; | |
231 | } | |
232 | ||
c9465b4e LA |
233 | static void note_page(struct pg_state *st, unsigned long addr, unsigned level, |
234 | u64 val) | |
235 | { | |
236 | static const char units[] = "KMGTPE"; | |
237 | u64 prot = val & pg_level[level].mask; | |
238 | ||
c9465b4e LA |
239 | if (!st->level) { |
240 | st->level = level; | |
241 | st->current_prot = prot; | |
242 | st->start_address = addr; | |
ae5d1cf3 | 243 | pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); |
c9465b4e LA |
244 | } else if (prot != st->current_prot || level != st->level || |
245 | addr >= st->marker[1].start_address) { | |
246 | const char *unit = units; | |
247 | unsigned long delta; | |
248 | ||
249 | if (st->current_prot) { | |
1404d6f1 LA |
250 | note_prot_uxn(st, addr); |
251 | note_prot_wx(st, addr); | |
ae5d1cf3 | 252 | pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ", |
c9465b4e LA |
253 | st->start_address, addr); |
254 | ||
255 | delta = (addr - st->start_address) >> 10; | |
256 | while (!(delta & 1023) && unit[1]) { | |
257 | delta >>= 10; | |
258 | unit++; | |
259 | } | |
ae5d1cf3 | 260 | pt_dump_seq_printf(st->seq, "%9lu%c %s", delta, *unit, |
48dd73c5 | 261 | pg_level[st->level].name); |
c9465b4e LA |
262 | if (pg_level[st->level].bits) |
263 | dump_prot(st, pg_level[st->level].bits, | |
264 | pg_level[st->level].num); | |
ae5d1cf3 | 265 | pt_dump_seq_puts(st->seq, "\n"); |
c9465b4e LA |
266 | } |
267 | ||
268 | if (addr >= st->marker[1].start_address) { | |
269 | st->marker++; | |
ae5d1cf3 | 270 | pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); |
c9465b4e LA |
271 | } |
272 | ||
273 | st->start_address = addr; | |
274 | st->current_prot = prot; | |
275 | st->level = level; | |
276 | } | |
277 | ||
278 | if (addr >= st->marker[1].start_address) { | |
279 | st->marker++; | |
ae5d1cf3 | 280 | pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); |
c9465b4e LA |
281 | } |
282 | ||
283 | } | |
284 | ||
d23c808c WD |
285 | static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start, |
286 | unsigned long end) | |
c9465b4e | 287 | { |
d23c808c WD |
288 | unsigned long addr = start; |
289 | pte_t *ptep = pte_offset_kernel(pmdp, start); | |
c9465b4e | 290 | |
d23c808c | 291 | do { |
20a004e7 | 292 | note_page(st, addr, 4, READ_ONCE(pte_val(*ptep))); |
d23c808c | 293 | } while (ptep++, addr += PAGE_SIZE, addr != end); |
c9465b4e LA |
294 | } |
295 | ||
d23c808c WD |
296 | static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start, |
297 | unsigned long end) | |
c9465b4e | 298 | { |
d23c808c WD |
299 | unsigned long next, addr = start; |
300 | pmd_t *pmdp = pmd_offset(pudp, start); | |
c9465b4e | 301 | |
d23c808c | 302 | do { |
20a004e7 | 303 | pmd_t pmd = READ_ONCE(*pmdp); |
d23c808c | 304 | next = pmd_addr_end(addr, end); |
20a004e7 | 305 | |
20a004e7 WD |
306 | if (pmd_none(pmd) || pmd_sect(pmd)) { |
307 | note_page(st, addr, 3, pmd_val(pmd)); | |
a1c76574 | 308 | } else { |
20a004e7 | 309 | BUG_ON(pmd_bad(pmd)); |
d23c808c | 310 | walk_pte(st, pmdp, addr, next); |
a1c76574 | 311 | } |
d23c808c | 312 | } while (pmdp++, addr = next, addr != end); |
c9465b4e LA |
313 | } |
314 | ||
d23c808c WD |
315 | static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start, |
316 | unsigned long end) | |
c9465b4e | 317 | { |
d23c808c WD |
318 | unsigned long next, addr = start; |
319 | pud_t *pudp = pud_offset(pgdp, start); | |
c9465b4e | 320 | |
d23c808c | 321 | do { |
20a004e7 | 322 | pud_t pud = READ_ONCE(*pudp); |
d23c808c | 323 | next = pud_addr_end(addr, end); |
20a004e7 | 324 | |
20a004e7 WD |
325 | if (pud_none(pud) || pud_sect(pud)) { |
326 | note_page(st, addr, 2, pud_val(pud)); | |
a1c76574 | 327 | } else { |
20a004e7 | 328 | BUG_ON(pud_bad(pud)); |
d23c808c | 329 | walk_pmd(st, pudp, addr, next); |
a1c76574 | 330 | } |
d23c808c | 331 | } while (pudp++, addr = next, addr != end); |
c9465b4e LA |
332 | } |
333 | ||
4674fdb9 MR |
334 | static void walk_pgd(struct pg_state *st, struct mm_struct *mm, |
335 | unsigned long start) | |
c9465b4e | 336 | { |
d23c808c WD |
337 | unsigned long end = (start < TASK_SIZE_64) ? TASK_SIZE_64 : 0; |
338 | unsigned long next, addr = start; | |
339 | pgd_t *pgdp = pgd_offset(mm, start); | |
c9465b4e | 340 | |
d23c808c | 341 | do { |
20a004e7 | 342 | pgd_t pgd = READ_ONCE(*pgdp); |
d23c808c | 343 | next = pgd_addr_end(addr, end); |
20a004e7 | 344 | |
20a004e7 WD |
345 | if (pgd_none(pgd)) { |
346 | note_page(st, addr, 1, pgd_val(pgd)); | |
a1c76574 | 347 | } else { |
20a004e7 | 348 | BUG_ON(pgd_bad(pgd)); |
d23c808c | 349 | walk_pud(st, pgdp, addr, next); |
a1c76574 | 350 | } |
d23c808c | 351 | } while (pgdp++, addr = next, addr != end); |
c9465b4e LA |
352 | } |
353 | ||
4ddb9bf8 | 354 | void ptdump_walk_pgd(struct seq_file *m, struct ptdump_info *info) |
c9465b4e LA |
355 | { |
356 | struct pg_state st = { | |
357 | .seq = m, | |
4674fdb9 | 358 | .marker = info->markers, |
c9465b4e LA |
359 | }; |
360 | ||
4674fdb9 | 361 | walk_pgd(&st, info->mm, info->base_addr); |
c9465b4e LA |
362 | |
363 | note_page(&st, 0, 0, 0); | |
c9465b4e LA |
364 | } |
365 | ||
4ddb9bf8 | 366 | static void ptdump_initialize(void) |
c9465b4e | 367 | { |
c9465b4e LA |
368 | unsigned i, j; |
369 | ||
370 | for (i = 0; i < ARRAY_SIZE(pg_level); i++) | |
371 | if (pg_level[i].bits) | |
372 | for (j = 0; j < pg_level[i].num; j++) | |
373 | pg_level[i].mask |= pg_level[i].bits[j].mask; | |
c9465b4e | 374 | } |
4674fdb9 MR |
375 | |
376 | static struct ptdump_info kernel_ptdump_info = { | |
377 | .mm = &init_mm, | |
378 | .markers = address_markers, | |
379 | .base_addr = VA_START, | |
380 | }; | |
381 | ||
1404d6f1 LA |
382 | void ptdump_check_wx(void) |
383 | { | |
384 | struct pg_state st = { | |
385 | .seq = NULL, | |
386 | .marker = (struct addr_marker[]) { | |
387 | { 0, NULL}, | |
388 | { -1, NULL}, | |
389 | }, | |
390 | .check_wx = true, | |
391 | }; | |
392 | ||
1d08a044 | 393 | walk_pgd(&st, &init_mm, VA_START); |
1404d6f1 LA |
394 | note_page(&st, 0, 0, 0); |
395 | if (st.wx_pages || st.uxn_pages) | |
396 | pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n", | |
397 | st.wx_pages, st.uxn_pages); | |
398 | else | |
399 | pr_info("Checked W+X mappings: passed, no W+X pages found\n"); | |
400 | } | |
401 | ||
4674fdb9 MR |
402 | static int ptdump_init(void) |
403 | { | |
4ddb9bf8 | 404 | ptdump_initialize(); |
e2a2e56e GKH |
405 | ptdump_debugfs_register(&kernel_ptdump_info, "kernel_page_tables"); |
406 | return 0; | |
4674fdb9 | 407 | } |
c9465b4e | 408 | device_initcall(ptdump_init); |