1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2014, The Linux Foundation. All rights reserved.
4 * Debug helper to dump the current kernel pagetables of the system
5 * so that we can see what the various memory ranges are set to.
6 *
7 * Derived from x86 and arm implementation:
8 * (C) Copyright 2008 Intel Corporation
9 *
10 * Author: Arjan van de Ven <arjan@linux.intel.com>
11 */
12 #include <linux/debugfs.h>
13 #include <linux/errno.h>
14 #include <linux/fs.h>
15 #include <linux/io.h>
16 #include <linux/init.h>
17 #include <linux/mm.h>
18 #include <linux/ptdump.h>
19 #include <linux/sched.h>
20 #include <linux/seq_file.h>
21
22 #include <asm/fixmap.h>
23 #include <asm/kasan.h>
24 #include <asm/memory.h>
25 #include <asm/pgtable-hwdef.h>
26 #include <asm/ptdump.h>
27
28
29 #define pt_dump_seq_printf(m, fmt, args...) \
30 ({ \
31 if (m) \
32 seq_printf(m, fmt, ##args); \
33 })
34
35 #define pt_dump_seq_puts(m, fmt) \
36 ({ \
37 if (m) \
38 seq_printf(m, fmt); \
39 })
40
41 static const struct ptdump_prot_bits pte_bits[] = {
42 {
43 .mask = PTE_VALID,
44 .val = PTE_VALID,
45 .set = " ",
46 .clear = "F",
47 }, {
48 .mask = PTE_USER,
49 .val = PTE_USER,
50 .set = "USR",
51 .clear = " ",
52 }, {
53 .mask = PTE_RDONLY,
54 .val = PTE_RDONLY,
55 .set = "ro",
56 .clear = "RW",
57 }, {
58 .mask = PTE_PXN,
59 .val = PTE_PXN,
60 .set = "NX",
61 .clear = "x ",
62 }, {
63 .mask = PTE_SHARED,
64 .val = PTE_SHARED,
65 .set = "SHD",
66 .clear = " ",
67 }, {
68 .mask = PTE_AF,
69 .val = PTE_AF,
70 .set = "AF",
71 .clear = " ",
72 }, {
73 .mask = PTE_NG,
74 .val = PTE_NG,
75 .set = "NG",
76 .clear = " ",
77 }, {
78 .mask = PTE_CONT,
79 .val = PTE_CONT,
80 .set = "CON",
81 .clear = " ",
82 }, {
83 .mask = PMD_TYPE_MASK,
84 .val = PMD_TYPE_SECT,
85 .set = "BLK",
86 .clear = " ",
87 }, {
88 .mask = PTE_UXN,
89 .val = PTE_UXN,
90 .set = "UXN",
91 .clear = " ",
92 }, {
93 .mask = PTE_GP,
94 .val = PTE_GP,
95 .set = "GP",
96 .clear = " ",
97 }, {
98 .mask = PTE_ATTRINDX_MASK,
99 .val = PTE_ATTRINDX(MT_DEVICE_nGnRnE),
100 .set = "DEVICE/nGnRnE",
101 }, {
102 .mask = PTE_ATTRINDX_MASK,
103 .val = PTE_ATTRINDX(MT_DEVICE_nGnRE),
104 .set = "DEVICE/nGnRE",
105 }, {
106 .mask = PTE_ATTRINDX_MASK,
107 .val = PTE_ATTRINDX(MT_NORMAL_NC),
108 .set = "MEM/NORMAL-NC",
109 }, {
110 .mask = PTE_ATTRINDX_MASK,
111 .val = PTE_ATTRINDX(MT_NORMAL),
112 .set = "MEM/NORMAL",
113 }, {
114 .mask = PTE_ATTRINDX_MASK,
115 .val = PTE_ATTRINDX(MT_NORMAL_TAGGED),
116 .set = "MEM/NORMAL-TAGGED",
117 }
118 };
119
120 static struct ptdump_pg_level kernel_pg_levels[] __ro_after_init = {
121 { /* pgd */
122 .name = "PGD",
123 .bits = pte_bits,
124 .num = ARRAY_SIZE(pte_bits),
125 }, { /* p4d */
126 .name = "P4D",
127 .bits = pte_bits,
128 .num = ARRAY_SIZE(pte_bits),
129 }, { /* pud */
130 .name = "PUD",
131 .bits = pte_bits,
132 .num = ARRAY_SIZE(pte_bits),
133 }, { /* pmd */
134 .name = "PMD",
135 .bits = pte_bits,
136 .num = ARRAY_SIZE(pte_bits),
137 }, { /* pte */
138 .name = "PTE",
139 .bits = pte_bits,
140 .num = ARRAY_SIZE(pte_bits),
141 },
142 };
143
dump_prot(struct ptdump_pg_state * st,const struct ptdump_prot_bits * bits,size_t num)144 static void dump_prot(struct ptdump_pg_state *st, const struct ptdump_prot_bits *bits,
145 size_t num)
146 {
147 unsigned i;
148
149 for (i = 0; i < num; i++, bits++) {
150 const char *s;
151
152 if ((st->current_prot & bits->mask) == bits->val)
153 s = bits->set;
154 else
155 s = bits->clear;
156
157 if (s)
158 pt_dump_seq_printf(st->seq, " %s", s);
159 }
160 }
161
note_prot_uxn(struct ptdump_pg_state * st,unsigned long addr)162 static void note_prot_uxn(struct ptdump_pg_state *st, unsigned long addr)
163 {
164 if (!st->check_wx)
165 return;
166
167 if ((st->current_prot & PTE_UXN) == PTE_UXN)
168 return;
169
170 WARN_ONCE(1, "arm64/mm: Found non-UXN mapping at address %p/%pS\n",
171 (void *)st->start_address, (void *)st->start_address);
172
173 st->uxn_pages += (addr - st->start_address) / PAGE_SIZE;
174 }
175
note_prot_wx(struct ptdump_pg_state * st,unsigned long addr)176 static void note_prot_wx(struct ptdump_pg_state *st, unsigned long addr)
177 {
178 if (!st->check_wx)
179 return;
180 if ((st->current_prot & PTE_RDONLY) == PTE_RDONLY)
181 return;
182 if ((st->current_prot & PTE_PXN) == PTE_PXN)
183 return;
184
185 WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
186 (void *)st->start_address, (void *)st->start_address);
187
188 st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
189 }
190
note_page(struct ptdump_state * pt_st,unsigned long addr,int level,pteval_t val)191 void note_page(struct ptdump_state *pt_st, unsigned long addr, int level,
192 pteval_t val)
193 {
194 struct ptdump_pg_state *st = container_of(pt_st, struct ptdump_pg_state, ptdump);
195 struct ptdump_pg_level *pg_level = st->pg_level;
196 static const char units[] = "KMGTPE";
197 ptval_t prot = 0;
198
199 /* check if the current level has been folded dynamically */
200 if (st->mm && ((level == 1 && mm_p4d_folded(st->mm)) ||
201 (level == 2 && mm_pud_folded(st->mm))))
202 level = 0;
203
204 if (level >= 0)
205 prot = val & pg_level[level].mask;
206
207 if (st->level == -1) {
208 st->level = level;
209 st->current_prot = prot;
210 st->start_address = addr;
211 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
212 } else if (prot != st->current_prot || level != st->level ||
213 addr >= st->marker[1].start_address) {
214 const char *unit = units;
215 unsigned long delta;
216
217 if (st->current_prot) {
218 note_prot_uxn(st, addr);
219 note_prot_wx(st, addr);
220 }
221
222 pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ",
223 st->start_address, addr);
224
225 delta = (addr - st->start_address) >> 10;
226 while (!(delta & 1023) && unit[1]) {
227 delta >>= 10;
228 unit++;
229 }
230 pt_dump_seq_printf(st->seq, "%9lu%c %s", delta, *unit,
231 pg_level[st->level].name);
232 if (st->current_prot && pg_level[st->level].bits)
233 dump_prot(st, pg_level[st->level].bits,
234 pg_level[st->level].num);
235 pt_dump_seq_puts(st->seq, "\n");
236
237 if (addr >= st->marker[1].start_address) {
238 st->marker++;
239 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
240 }
241
242 st->start_address = addr;
243 st->current_prot = prot;
244 st->level = level;
245 }
246
247 if (addr >= st->marker[1].start_address) {
248 st->marker++;
249 pt_dump_seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
250 }
251
252 }
253
note_page_pte(struct ptdump_state * pt_st,unsigned long addr,pte_t pte)254 void note_page_pte(struct ptdump_state *pt_st, unsigned long addr, pte_t pte)
255 {
256 note_page(pt_st, addr, 4, pte_val(pte));
257 }
258
note_page_pmd(struct ptdump_state * pt_st,unsigned long addr,pmd_t pmd)259 void note_page_pmd(struct ptdump_state *pt_st, unsigned long addr, pmd_t pmd)
260 {
261 note_page(pt_st, addr, 3, pmd_val(pmd));
262 }
263
note_page_pud(struct ptdump_state * pt_st,unsigned long addr,pud_t pud)264 void note_page_pud(struct ptdump_state *pt_st, unsigned long addr, pud_t pud)
265 {
266 note_page(pt_st, addr, 2, pud_val(pud));
267 }
268
note_page_p4d(struct ptdump_state * pt_st,unsigned long addr,p4d_t p4d)269 void note_page_p4d(struct ptdump_state *pt_st, unsigned long addr, p4d_t p4d)
270 {
271 note_page(pt_st, addr, 1, p4d_val(p4d));
272 }
273
note_page_pgd(struct ptdump_state * pt_st,unsigned long addr,pgd_t pgd)274 void note_page_pgd(struct ptdump_state *pt_st, unsigned long addr, pgd_t pgd)
275 {
276 note_page(pt_st, addr, 0, pgd_val(pgd));
277 }
278
note_page_flush(struct ptdump_state * pt_st)279 void note_page_flush(struct ptdump_state *pt_st)
280 {
281 struct ptdump_pg_state *st = container_of(pt_st, struct ptdump_pg_state, ptdump);
282 unsigned long end = st->end_address;
283 pte_t pte_zero = {0};
284
285 /*
286 * Address spaces that end at 1 << 64 have end_address == ULONG_MAX,
287 * but note_page() expects the exclusive end. In this case adjust end
288 * to the wraparound value 0.
289 */
290 if (end == ULONG_MAX)
291 end = 0;
292
293 note_page(pt_st, end, -1, pte_val(pte_zero));
294 }
295
ptdump_walk(struct seq_file * s,struct ptdump_info * info)296 void ptdump_walk(struct seq_file *s, struct ptdump_info *info)
297 {
298 unsigned long end = ~0UL;
299 struct ptdump_pg_state st;
300
301 if (info->base_addr < TASK_SIZE_64)
302 end = TASK_SIZE_64;
303
304 st = (struct ptdump_pg_state){
305 .seq = s,
306 .marker = info->markers,
307 .mm = info->mm,
308 .pg_level = &kernel_pg_levels[0],
309 .end_address = end,
310 .level = -1,
311 .ptdump = {
312 .note_page_pte = note_page_pte,
313 .note_page_pmd = note_page_pmd,
314 .note_page_pud = note_page_pud,
315 .note_page_p4d = note_page_p4d,
316 .note_page_pgd = note_page_pgd,
317 .note_page_flush = note_page_flush,
318 .range = (struct ptdump_range[]){
319 {info->base_addr, end},
320 {0, 0}
321 }
322 }
323 };
324
325 ptdump_walk_pgd(&st.ptdump, info->mm, NULL);
326 }
327
ptdump_initialize(void)328 static void __init ptdump_initialize(void)
329 {
330 unsigned i, j;
331
332 for (i = 0; i < ARRAY_SIZE(kernel_pg_levels); i++)
333 if (kernel_pg_levels[i].bits)
334 for (j = 0; j < kernel_pg_levels[i].num; j++)
335 kernel_pg_levels[i].mask |= kernel_pg_levels[i].bits[j].mask;
336 }
337
338 static struct ptdump_info kernel_ptdump_info __ro_after_init = {
339 .mm = &init_mm,
340 };
341
ptdump_check_wx(void)342 bool ptdump_check_wx(void)
343 {
344 struct ptdump_pg_state st = {
345 .seq = NULL,
346 .marker = (struct addr_marker[]) {
347 { 0, NULL},
348 { -1, NULL},
349 },
350 .pg_level = &kernel_pg_levels[0],
351 .end_address = ~0UL,
352 .level = -1,
353 .check_wx = true,
354 .ptdump = {
355 .note_page_pte = note_page_pte,
356 .note_page_pmd = note_page_pmd,
357 .note_page_pud = note_page_pud,
358 .note_page_p4d = note_page_p4d,
359 .note_page_pgd = note_page_pgd,
360 .note_page_flush = note_page_flush,
361 .range = (struct ptdump_range[]) {
362 {_PAGE_OFFSET(vabits_actual), ~0UL},
363 {0, 0}
364 }
365 }
366 };
367
368 ptdump_walk_pgd(&st.ptdump, &init_mm, NULL);
369
370 if (st.wx_pages || st.uxn_pages) {
371 pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",
372 st.wx_pages, st.uxn_pages);
373
374 return false;
375 } else {
376 pr_info("Checked W+X mappings: passed, no W+X pages found\n");
377
378 return true;
379 }
380 }
381
ptdump_init(void)382 static int __init ptdump_init(void)
383 {
384 u64 page_offset = _PAGE_OFFSET(vabits_actual);
385 u64 vmemmap_start = (u64)virt_to_page((void *)page_offset);
386 struct addr_marker m[] = {
387 { PAGE_OFFSET, "Linear Mapping start" },
388 { PAGE_END, "Linear Mapping end" },
389 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
390 { KASAN_SHADOW_START, "Kasan shadow start" },
391 { KASAN_SHADOW_END, "Kasan shadow end" },
392 #endif
393 { MODULES_VADDR, "Modules start" },
394 { MODULES_END, "Modules end" },
395 { VMALLOC_START, "vmalloc() area" },
396 { VMALLOC_END, "vmalloc() end" },
397 { vmemmap_start, "vmemmap start" },
398 { VMEMMAP_END, "vmemmap end" },
399 { PCI_IO_START, "PCI I/O start" },
400 { PCI_IO_END, "PCI I/O end" },
401 { FIXADDR_TOT_START, "Fixmap start" },
402 { FIXADDR_TOP, "Fixmap end" },
403 { -1, NULL },
404 };
405 static struct addr_marker address_markers[ARRAY_SIZE(m)] __ro_after_init;
406
407 kernel_ptdump_info.markers = memcpy(address_markers, m, sizeof(m));
408 kernel_ptdump_info.base_addr = page_offset;
409
410 ptdump_initialize();
411 ptdump_debugfs_register(&kernel_ptdump_info, "kernel_page_tables");
412 return 0;
413 }
414 device_initcall(ptdump_init);
415