1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2014, The Linux Foundation. All rights reserved. 4 * Debug helper to dump the current kernel pagetables of the system 5 * so that we can see what the various memory ranges are set to. 6 * 7 * Derived from x86 and arm implementation: 8 * (C) Copyright 2008 Intel Corporation 9 * 10 * Author: Arjan van de Ven <arjan@linux.intel.com> 11 */ 12 #include <linux/debugfs.h> 13 #include <linux/errno.h> 14 #include <linux/fs.h> 15 #include <linux/io.h> 16 #include <linux/init.h> 17 #include <linux/mm.h> 18 #include <linux/ptdump.h> 19 #include <linux/sched.h> 20 #include <linux/seq_file.h> 21 22 #include <asm/fixmap.h> 23 #include <asm/kasan.h> 24 #include <asm/memory.h> 25 #include <asm/pgtable-hwdef.h> 26 #include <asm/ptdump.h> 27 28 29 enum address_markers_idx { 30 PAGE_OFFSET_NR = 0, 31 PAGE_END_NR, 32 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) 33 KASAN_START_NR, 34 #endif 35 }; 36 37 static struct addr_marker address_markers[] = { 38 { PAGE_OFFSET, "Linear Mapping start" }, 39 { 0 /* PAGE_END */, "Linear Mapping end" }, 40 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) 41 { 0 /* KASAN_SHADOW_START */, "Kasan shadow start" }, 42 { KASAN_SHADOW_END, "Kasan shadow end" }, 43 #endif 44 { BPF_JIT_REGION_START, "BPF start" }, 45 { BPF_JIT_REGION_END, "BPF end" }, 46 { MODULES_VADDR, "Modules start" }, 47 { MODULES_END, "Modules end" }, 48 { VMALLOC_START, "vmalloc() area" }, 49 { VMALLOC_END, "vmalloc() end" }, 50 { FIXADDR_START, "Fixmap start" }, 51 { FIXADDR_TOP, "Fixmap end" }, 52 { PCI_IO_START, "PCI I/O start" }, 53 { PCI_IO_END, "PCI I/O end" }, 54 { VMEMMAP_START, "vmemmap start" }, 55 { VMEMMAP_START + VMEMMAP_SIZE, "vmemmap end" }, 56 { -1, NULL }, 57 }; 58 59 #define pt_dump_seq_printf(m, fmt, args...) \ 60 ({ \ 61 if (m) \ 62 seq_printf(m, fmt, ##args); \ 63 }) 64 65 #define pt_dump_seq_puts(m, fmt) \ 66 ({ \ 67 if (m) \ 68 seq_printf(m, fmt); \ 69 }) 70 71 /* 72 * The page dumper groups page table entries of the same type into a single 73 * description. It uses pg_state to track the range information while 74 * iterating over the pte entries. When the continuity is broken it then 75 * dumps out a description of the range. 76 */ 77 struct pg_state { 78 struct ptdump_state ptdump; 79 struct seq_file *seq; 80 const struct addr_marker *marker; 81 unsigned long start_address; 82 int level; 83 u64 current_prot; 84 bool check_wx; 85 unsigned long wx_pages; 86 unsigned long uxn_pages; 87 }; 88 89 struct prot_bits { 90 u64 mask; 91 u64 val; 92 const char *set; 93 const char *clear; 94 }; 95 96 static const struct prot_bits pte_bits[] = { 97 { 98 .mask = PTE_VALID, 99 .val = PTE_VALID, 100 .set = " ", 101 .clear = "F", 102 }, { 103 .mask = PTE_USER, 104 .val = PTE_USER, 105 .set = "USR", 106 .clear = " ", 107 }, { 108 .mask = PTE_RDONLY, 109 .val = PTE_RDONLY, 110 .set = "ro", 111 .clear = "RW", 112 }, { 113 .mask = PTE_PXN, 114 .val = PTE_PXN, 115 .set = "NX", 116 .clear = "x ", 117 }, { 118 .mask = PTE_SHARED, 119 .val = PTE_SHARED, 120 .set = "SHD", 121 .clear = " ", 122 }, { 123 .mask = PTE_AF, 124 .val = PTE_AF, 125 .set = "AF", 126 .clear = " ", 127 }, { 128 .mask = PTE_NG, 129 .val = PTE_NG, 130 .set = "NG", 131 .clear = " ", 132 }, { 133 .mask = PTE_CONT, 134 .val = PTE_CONT, 135 .set = "CON", 136 .clear = " ", 137 }, { 138 .mask = PTE_TABLE_BIT, 139 .val = PTE_TABLE_BIT, 140 .set = " ", 141 .clear = "BLK", 142 }, { 143 .mask = PTE_UXN, 144 .val = PTE_UXN, 145 .set = "UXN", 146 .clear = " ", 147 }, { 148 .mask = PTE_GP, 149 .val = PTE_GP, 150 .set = "GP", 151 .clear = " ", 152 }, { 153 .mask = PTE_ATTRINDX_MASK, 154 .val = PTE_ATTRINDX(MT_DEVICE_nGnRnE), 155 .set = "DEVICE/nGnRnE", 156 }, { 157 .mask = PTE_ATTRINDX_MASK, 158 .val = PTE_ATTRINDX(MT_DEVICE_nGnRE), 159 .set = "DEVICE/nGnRE", 160 }, { 161 .mask = PTE_ATTRINDX_MASK, 162 .val = PTE_ATTRINDX(MT_DEVICE_GRE), 163 .set = "DEVICE/GRE", 164 }, { 165 .mask = PTE_ATTRINDX_MASK, 166 .val = PTE_ATTRINDX(MT_NORMAL_NC), 167 .set = "MEM/NORMAL-NC", 168 }, { 169 .mask = PTE_ATTRINDX_MASK, 170 .val = PTE_ATTRINDX(MT_NORMAL), 171 .set = "MEM/NORMAL", 172 }, { 173 .mask = PTE_ATTRINDX_MASK, 174 .val = PTE_ATTRINDX(MT_NORMAL_TAGGED), 175 .set = "MEM/NORMAL-TAGGED", 176 } 177 }; 178 179 struct pg_level { 180 const struct prot_bits *bits; 181 const char *name; 182 size_t num; 183 u64 mask; 184 }; 185 186 static struct pg_level pg_level[] = { 187 { /* pgd */ 188 .name = "PGD", 189 .bits = pte_bits, 190 .num = ARRAY_SIZE(pte_bits), 191 }, { /* p4d */ 192 .name = "P4D", 193 .bits = pte_bits, 194 .num = ARRAY_SIZE(pte_bits), 195 }, { /* pud */ 196 .name = (CONFIG_PGTABLE_LEVELS > 3) ? "PUD" : "PGD", 197 .bits = pte_bits, 198 .num = ARRAY_SIZE(pte_bits), 199 }, { /* pmd */ 200 .name = (CONFIG_PGTABLE_LEVELS > 2) ? "PMD" : "PGD", 201 .bits = pte_bits, 202 .num = ARRAY_SIZE(pte_bits), 203 }, { /* pte */ 204 .name = "PTE", 205 .bits = pte_bits, 206 .num = ARRAY_SIZE(pte_bits), 207 }, 208 }; 209 210 static void dump_prot(struct pg_state *st, const struct prot_bits *bits, 211 size_t num) 212 { 213 unsigned i; 214 215 for (i = 0; i < num; i++, bits++) { 216 const char *s; 217 218 if ((st->current_prot & bits->mask) == bits->val) 219 s = bits->set; 220 else 221 s = bits->clear; 222 223 if (s) 224 pt_dump_seq_printf(st->seq, " %s", s); 225 } 226 } 227 228 static void note_prot_uxn(struct pg_state *st, unsigned long addr) 229 { 230 if (!st->check_wx) 231 return; 232 233 if ((st->current_prot & PTE_UXN) == PTE_UXN) 234 return; 235 236 WARN_ONCE(1, "arm64/mm: Found non-UXN mapping at address %p/%pS\n", 237 (void *)st->start_address, (void *)st->start_address); 238 239 st->uxn_pages += (addr - st->start_address) / PAGE_SIZE; 240 } 241 242 static void note_prot_wx(struct pg_state *st, unsigned long addr) 243 { 244 if (!st->check_wx) 245 return; 246 if ((st->current_prot & PTE_RDONLY) == PTE_RDONLY) 247 return; 248 if ((st->current_prot & PTE_PXN) == PTE_PXN) 249 return; 250 251 WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n", 252 (void *)st->start_address, (void *)st->start_address); 253 254 st->wx_pages += (addr - st->start_address) / PAGE_SIZE; 255 } 256 257 static void note_page(struct ptdump_state *pt_st, unsigned long addr, int level, 258 u64 val) 259 { 260 struct pg_state *st = container_of(pt_st, struct pg_state, ptdump); 261 static const char units[] = "KMGTPE"; 262 u64 prot = 0; 263 264 if (level >= 0) 265 prot = val & pg_level[level].mask; 266 267 if (st->level == -1) { 268 st->level = level; 269 st->current_prot = prot; 270 st->start_address = addr; 271 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); 272 } else if (prot != st->current_prot || level != st->level || 273 addr >= st->marker[1].start_address) { 274 const char *unit = units; 275 unsigned long delta; 276 277 if (st->current_prot) { 278 note_prot_uxn(st, addr); 279 note_prot_wx(st, addr); 280 } 281 282 pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ", 283 st->start_address, addr); 284 285 delta = (addr - st->start_address) >> 10; 286 while (!(delta & 1023) && unit[1]) { 287 delta >>= 10; 288 unit++; 289 } 290 pt_dump_seq_printf(st->seq, "%9lu%c %s", delta, *unit, 291 pg_level[st->level].name); 292 if (st->current_prot && pg_level[st->level].bits) 293 dump_prot(st, pg_level[st->level].bits, 294 pg_level[st->level].num); 295 pt_dump_seq_puts(st->seq, "\n"); 296 297 if (addr >= st->marker[1].start_address) { 298 st->marker++; 299 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); 300 } 301 302 st->start_address = addr; 303 st->current_prot = prot; 304 st->level = level; 305 } 306 307 if (addr >= st->marker[1].start_address) { 308 st->marker++; 309 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); 310 } 311 312 } 313 314 void ptdump_walk(struct seq_file *s, struct ptdump_info *info) 315 { 316 unsigned long end = ~0UL; 317 struct pg_state st; 318 319 if (info->base_addr < TASK_SIZE_64) 320 end = TASK_SIZE_64; 321 322 st = (struct pg_state){ 323 .seq = s, 324 .marker = info->markers, 325 .level = -1, 326 .ptdump = { 327 .note_page = note_page, 328 .range = (struct ptdump_range[]){ 329 {info->base_addr, end}, 330 {0, 0} 331 } 332 } 333 }; 334 335 ptdump_walk_pgd(&st.ptdump, info->mm, NULL); 336 } 337 338 static void __init ptdump_initialize(void) 339 { 340 unsigned i, j; 341 342 for (i = 0; i < ARRAY_SIZE(pg_level); i++) 343 if (pg_level[i].bits) 344 for (j = 0; j < pg_level[i].num; j++) 345 pg_level[i].mask |= pg_level[i].bits[j].mask; 346 } 347 348 static struct ptdump_info kernel_ptdump_info = { 349 .mm = &init_mm, 350 .markers = address_markers, 351 .base_addr = PAGE_OFFSET, 352 }; 353 354 void ptdump_check_wx(void) 355 { 356 struct pg_state st = { 357 .seq = NULL, 358 .marker = (struct addr_marker[]) { 359 { 0, NULL}, 360 { -1, NULL}, 361 }, 362 .level = -1, 363 .check_wx = true, 364 .ptdump = { 365 .note_page = note_page, 366 .range = (struct ptdump_range[]) { 367 {PAGE_OFFSET, ~0UL}, 368 {0, 0} 369 } 370 } 371 }; 372 373 ptdump_walk_pgd(&st.ptdump, &init_mm, NULL); 374 375 if (st.wx_pages || st.uxn_pages) 376 pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n", 377 st.wx_pages, st.uxn_pages); 378 else 379 pr_info("Checked W+X mappings: passed, no W+X pages found\n"); 380 } 381 382 static int __init ptdump_init(void) 383 { 384 address_markers[PAGE_END_NR].start_address = PAGE_END; 385 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) 386 address_markers[KASAN_START_NR].start_address = KASAN_SHADOW_START; 387 #endif 388 ptdump_initialize(); 389 ptdump_debugfs_register(&kernel_ptdump_info, "kernel_page_tables"); 390 return 0; 391 } 392 device_initcall(ptdump_init); 393