1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2014, The Linux Foundation. All rights reserved.
4 * Debug helper to dump the current kernel pagetables of the system
5 * so that we can see what the various memory ranges are set to.
6 *
7 * Derived from x86 and arm implementation:
8 * (C) Copyright 2008 Intel Corporation
9 *
10 * Author: Arjan van de Ven <arjan@linux.intel.com>
11 */
12 #include <linux/debugfs.h>
13 #include <linux/errno.h>
14 #include <linux/fs.h>
15 #include <linux/io.h>
16 #include <linux/init.h>
17 #include <linux/mm.h>
18 #include <linux/ptdump.h>
19 #include <linux/sched.h>
20 #include <linux/seq_file.h>
21
22 #include <asm/fixmap.h>
23 #include <asm/kasan.h>
24 #include <asm/memory.h>
25 #include <asm/pgtable-hwdef.h>
26 #include <asm/ptdump.h>
27
28
29 enum address_markers_idx {
30 PAGE_OFFSET_NR = 0,
31 PAGE_END_NR,
32 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
33 KASAN_START_NR,
34 #endif
35 };
36
37 static struct addr_marker address_markers[] = {
38 { PAGE_OFFSET, "Linear Mapping start" },
39 { 0 /* PAGE_END */, "Linear Mapping end" },
40 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
41 { 0 /* KASAN_SHADOW_START */, "Kasan shadow start" },
42 { KASAN_SHADOW_END, "Kasan shadow end" },
43 #endif
44 { BPF_JIT_REGION_START, "BPF start" },
45 { BPF_JIT_REGION_END, "BPF end" },
46 { MODULES_VADDR, "Modules start" },
47 { MODULES_END, "Modules end" },
48 { VMALLOC_START, "vmalloc() area" },
49 { VMALLOC_END, "vmalloc() end" },
50 { FIXADDR_START, "Fixmap start" },
51 { FIXADDR_TOP, "Fixmap end" },
52 { PCI_IO_START, "PCI I/O start" },
53 { PCI_IO_END, "PCI I/O end" },
54 { VMEMMAP_START, "vmemmap start" },
55 { VMEMMAP_START + VMEMMAP_SIZE, "vmemmap end" },
56 { -1, NULL },
57 };
58
59 #define pt_dump_seq_printf(m, fmt, args...) \
60 ({ \
61 if (m) \
62 seq_printf(m, fmt, ##args); \
63 })
64
65 #define pt_dump_seq_puts(m, fmt) \
66 ({ \
67 if (m) \
68 seq_printf(m, fmt); \
69 })
70
71 /*
72 * The page dumper groups page table entries of the same type into a single
73 * description. It uses pg_state to track the range information while
74 * iterating over the pte entries. When the continuity is broken it then
75 * dumps out a description of the range.
76 */
77 struct pg_state {
78 struct ptdump_state ptdump;
79 struct seq_file *seq;
80 const struct addr_marker *marker;
81 unsigned long start_address;
82 int level;
83 u64 current_prot;
84 bool check_wx;
85 unsigned long wx_pages;
86 unsigned long uxn_pages;
87 };
88
89 struct prot_bits {
90 u64 mask;
91 u64 val;
92 const char *set;
93 const char *clear;
94 };
95
96 static const struct prot_bits pte_bits[] = {
97 {
98 .mask = PTE_VALID,
99 .val = PTE_VALID,
100 .set = " ",
101 .clear = "F",
102 }, {
103 .mask = PTE_USER,
104 .val = PTE_USER,
105 .set = "USR",
106 .clear = " ",
107 }, {
108 .mask = PTE_RDONLY,
109 .val = PTE_RDONLY,
110 .set = "ro",
111 .clear = "RW",
112 }, {
113 .mask = PTE_PXN,
114 .val = PTE_PXN,
115 .set = "NX",
116 .clear = "x ",
117 }, {
118 .mask = PTE_SHARED,
119 .val = PTE_SHARED,
120 .set = "SHD",
121 .clear = " ",
122 }, {
123 .mask = PTE_AF,
124 .val = PTE_AF,
125 .set = "AF",
126 .clear = " ",
127 }, {
128 .mask = PTE_NG,
129 .val = PTE_NG,
130 .set = "NG",
131 .clear = " ",
132 }, {
133 .mask = PTE_CONT,
134 .val = PTE_CONT,
135 .set = "CON",
136 .clear = " ",
137 }, {
138 .mask = PTE_TABLE_BIT,
139 .val = PTE_TABLE_BIT,
140 .set = " ",
141 .clear = "BLK",
142 }, {
143 .mask = PTE_UXN,
144 .val = PTE_UXN,
145 .set = "UXN",
146 .clear = " ",
147 }, {
148 .mask = PTE_GP,
149 .val = PTE_GP,
150 .set = "GP",
151 .clear = " ",
152 }, {
153 .mask = PTE_ATTRINDX_MASK,
154 .val = PTE_ATTRINDX(MT_DEVICE_nGnRnE),
155 .set = "DEVICE/nGnRnE",
156 }, {
157 .mask = PTE_ATTRINDX_MASK,
158 .val = PTE_ATTRINDX(MT_DEVICE_nGnRE),
159 .set = "DEVICE/nGnRE",
160 }, {
161 .mask = PTE_ATTRINDX_MASK,
162 .val = PTE_ATTRINDX(MT_DEVICE_GRE),
163 .set = "DEVICE/GRE",
164 }, {
165 .mask = PTE_ATTRINDX_MASK,
166 .val = PTE_ATTRINDX(MT_NORMAL_NC),
167 .set = "MEM/NORMAL-NC",
168 }, {
169 .mask = PTE_ATTRINDX_MASK,
170 .val = PTE_ATTRINDX(MT_NORMAL),
171 .set = "MEM/NORMAL",
172 }, {
173 .mask = PTE_ATTRINDX_MASK,
174 .val = PTE_ATTRINDX(MT_NORMAL_TAGGED),
175 .set = "MEM/NORMAL-TAGGED",
176 }
177 };
178
179 struct pg_level {
180 const struct prot_bits *bits;
181 const char *name;
182 size_t num;
183 u64 mask;
184 };
185
186 static struct pg_level pg_level[] = {
187 { /* pgd */
188 .name = "PGD",
189 .bits = pte_bits,
190 .num = ARRAY_SIZE(pte_bits),
191 }, { /* p4d */
192 .name = "P4D",
193 .bits = pte_bits,
194 .num = ARRAY_SIZE(pte_bits),
195 }, { /* pud */
196 .name = (CONFIG_PGTABLE_LEVELS > 3) ? "PUD" : "PGD",
197 .bits = pte_bits,
198 .num = ARRAY_SIZE(pte_bits),
199 }, { /* pmd */
200 .name = (CONFIG_PGTABLE_LEVELS > 2) ? "PMD" : "PGD",
201 .bits = pte_bits,
202 .num = ARRAY_SIZE(pte_bits),
203 }, { /* pte */
204 .name = "PTE",
205 .bits = pte_bits,
206 .num = ARRAY_SIZE(pte_bits),
207 },
208 };
209
dump_prot(struct pg_state * st,const struct prot_bits * bits,size_t num)210 static void dump_prot(struct pg_state *st, const struct prot_bits *bits,
211 size_t num)
212 {
213 unsigned i;
214
215 for (i = 0; i < num; i++, bits++) {
216 const char *s;
217
218 if ((st->current_prot & bits->mask) == bits->val)
219 s = bits->set;
220 else
221 s = bits->clear;
222
223 if (s)
224 pt_dump_seq_printf(st->seq, " %s", s);
225 }
226 }
227
note_prot_uxn(struct pg_state * st,unsigned long addr)228 static void note_prot_uxn(struct pg_state *st, unsigned long addr)
229 {
230 if (!st->check_wx)
231 return;
232
233 if ((st->current_prot & PTE_UXN) == PTE_UXN)
234 return;
235
236 WARN_ONCE(1, "arm64/mm: Found non-UXN mapping at address %p/%pS\n",
237 (void *)st->start_address, (void *)st->start_address);
238
239 st->uxn_pages += (addr - st->start_address) / PAGE_SIZE;
240 }
241
note_prot_wx(struct pg_state * st,unsigned long addr)242 static void note_prot_wx(struct pg_state *st, unsigned long addr)
243 {
244 if (!st->check_wx)
245 return;
246 if ((st->current_prot & PTE_RDONLY) == PTE_RDONLY)
247 return;
248 if ((st->current_prot & PTE_PXN) == PTE_PXN)
249 return;
250
251 WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
252 (void *)st->start_address, (void *)st->start_address);
253
254 st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
255 }
256
note_page(struct ptdump_state * pt_st,unsigned long addr,int level,u64 val)257 static void note_page(struct ptdump_state *pt_st, unsigned long addr, int level,
258 u64 val)
259 {
260 struct pg_state *st = container_of(pt_st, struct pg_state, ptdump);
261 static const char units[] = "KMGTPE";
262 u64 prot = 0;
263
264 if (level >= 0)
265 prot = val & pg_level[level].mask;
266
267 if (st->level == -1) {
268 st->level = level;
269 st->current_prot = prot;
270 st->start_address = addr;
271 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
272 } else if (prot != st->current_prot || level != st->level ||
273 addr >= st->marker[1].start_address) {
274 const char *unit = units;
275 unsigned long delta;
276
277 if (st->current_prot) {
278 note_prot_uxn(st, addr);
279 note_prot_wx(st, addr);
280 }
281
282 pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ",
283 st->start_address, addr);
284
285 delta = (addr - st->start_address) >> 10;
286 while (!(delta & 1023) && unit[1]) {
287 delta >>= 10;
288 unit++;
289 }
290 pt_dump_seq_printf(st->seq, "%9lu%c %s", delta, *unit,
291 pg_level[st->level].name);
292 if (st->current_prot && pg_level[st->level].bits)
293 dump_prot(st, pg_level[st->level].bits,
294 pg_level[st->level].num);
295 pt_dump_seq_puts(st->seq, "\n");
296
297 if (addr >= st->marker[1].start_address) {
298 st->marker++;
299 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
300 }
301
302 st->start_address = addr;
303 st->current_prot = prot;
304 st->level = level;
305 }
306
307 if (addr >= st->marker[1].start_address) {
308 st->marker++;
309 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
310 }
311
312 }
313
ptdump_walk(struct seq_file * s,struct ptdump_info * info)314 void ptdump_walk(struct seq_file *s, struct ptdump_info *info)
315 {
316 unsigned long end = ~0UL;
317 struct pg_state st;
318
319 if (info->base_addr < TASK_SIZE_64)
320 end = TASK_SIZE_64;
321
322 st = (struct pg_state){
323 .seq = s,
324 .marker = info->markers,
325 .level = -1,
326 .ptdump = {
327 .note_page = note_page,
328 .range = (struct ptdump_range[]){
329 {info->base_addr, end},
330 {0, 0}
331 }
332 }
333 };
334
335 ptdump_walk_pgd(&st.ptdump, info->mm, NULL);
336 }
337
ptdump_initialize(void)338 static void __init ptdump_initialize(void)
339 {
340 unsigned i, j;
341
342 for (i = 0; i < ARRAY_SIZE(pg_level); i++)
343 if (pg_level[i].bits)
344 for (j = 0; j < pg_level[i].num; j++)
345 pg_level[i].mask |= pg_level[i].bits[j].mask;
346 }
347
348 static struct ptdump_info kernel_ptdump_info = {
349 .mm = &init_mm,
350 .markers = address_markers,
351 .base_addr = PAGE_OFFSET,
352 };
353
ptdump_check_wx(void)354 void ptdump_check_wx(void)
355 {
356 struct pg_state st = {
357 .seq = NULL,
358 .marker = (struct addr_marker[]) {
359 { 0, NULL},
360 { -1, NULL},
361 },
362 .level = -1,
363 .check_wx = true,
364 .ptdump = {
365 .note_page = note_page,
366 .range = (struct ptdump_range[]) {
367 {PAGE_OFFSET, ~0UL},
368 {0, 0}
369 }
370 }
371 };
372
373 ptdump_walk_pgd(&st.ptdump, &init_mm, NULL);
374
375 if (st.wx_pages || st.uxn_pages)
376 pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",
377 st.wx_pages, st.uxn_pages);
378 else
379 pr_info("Checked W+X mappings: passed, no W+X pages found\n");
380 }
381
ptdump_init(void)382 static int __init ptdump_init(void)
383 {
384 address_markers[PAGE_END_NR].start_address = PAGE_END;
385 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
386 address_markers[KASAN_START_NR].start_address = KASAN_SHADOW_START;
387 #endif
388 ptdump_initialize();
389 ptdump_debugfs_register(&kernel_ptdump_info, "kernel_page_tables");
390 return 0;
391 }
392 device_initcall(ptdump_init);
393