dump_pagetables.c 14.1 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14
/*
 * Debug helper to dump the current kernel pagetables of the system
 * so that we can see what the various memory ranges are set to.
 *
 * (C) Copyright 2008 Intel Corporation
 *
 * Author: Arjan van de Ven <arjan@linux.intel.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; version 2
 * of the License.
 */

15
#include <linux/debugfs.h>
16
#include <linux/kasan.h>
17
#include <linux/mm.h>
18
#include <linux/init.h>
19
#include <linux/sched.h>
20 21 22 23 24 25 26 27 28 29 30 31 32 33
#include <linux/seq_file.h>

#include <asm/pgtable.h>

/*
 * The dumper groups pagetable entries of the same type into one, and for
 * that it needs to keep some state when walking, and flush this state
 * when a "break" in the continuity is found.
 */
struct pg_state {
	int level;
	pgprot_t current_prot;
	unsigned long start_address;
	unsigned long current_address;
34
	const struct addr_marker *marker;
35
	unsigned long lines;
36
	bool to_dmesg;
S
Stephen Smalley 已提交
37 38
	bool check_wx;
	unsigned long wx_pages;
39 40
};

41 42 43
struct addr_marker {
	unsigned long start_address;
	const char *name;
44
	unsigned long max_lines;
45 46
};

47 48 49 50
/* Address space markers hints */

#ifdef CONFIG_X86_64

51 52 53 54 55 56
enum address_markers_idx {
	USER_SPACE_NR = 0,
	KERNEL_SPACE_NR,
	LOW_KERNEL_NR,
	VMALLOC_START_NR,
	VMEMMAP_START_NR,
57 58 59 60
#ifdef CONFIG_KASAN
	KASAN_SHADOW_START_NR,
	KASAN_SHADOW_END_NR,
#endif
61
#ifdef CONFIG_X86_ESPFIX64
62
	ESPFIX_START_NR,
63 64 65 66
#endif
#ifdef CONFIG_EFI
	EFI_END_NR,
#endif
67 68 69
	HIGH_KERNEL_NR,
	MODULES_VADDR_NR,
	MODULES_END_NR,
70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100
	FIXADDR_START_NR,
	END_OF_SPACE_NR,
};

static struct addr_marker address_markers[] = {
	[USER_SPACE_NR]		= { 0,			"User Space" },
	[KERNEL_SPACE_NR]	= { (1UL << 63),	"Kernel Space" },
	[LOW_KERNEL_NR]		= { 0UL,		"Low Kernel Mapping" },
	[VMALLOC_START_NR]	= { 0UL,		"vmalloc() Area" },
	[VMEMMAP_START_NR]	= { 0UL,		"Vmemmap" },
#ifdef CONFIG_KASAN
	[KASAN_SHADOW_START_NR]	= { KASAN_SHADOW_START,	"KASAN shadow" },
	[KASAN_SHADOW_END_NR]	= { KASAN_SHADOW_END,	"KASAN shadow end" },
#endif
#ifdef CONFIG_X86_ESPFIX64
	[ESPFIX_START_NR]	= { ESPFIX_BASE_ADDR,	"ESPfix Area", 16 },
#endif
#ifdef CONFIG_EFI
	[EFI_END_NR]		= { EFI_VA_END,		"EFI Runtime Services" },
#endif
	[HIGH_KERNEL_NR]	= { __START_KERNEL_map,	"High Kernel Mapping" },
	[MODULES_VADDR_NR]	= { MODULES_VADDR,	"Modules" },
	[MODULES_END_NR]	= { MODULES_END,	"End Modules" },
	[FIXADDR_START_NR]	= { FIXADDR_START,	"Fixmap Area" },
	[END_OF_SPACE_NR]	= { -1,			NULL }
};

#else /* CONFIG_X86_64 */

enum address_markers_idx {
	USER_SPACE_NR = 0,
101 102 103
	KERNEL_SPACE_NR,
	VMALLOC_START_NR,
	VMALLOC_END_NR,
104
#ifdef CONFIG_HIGHMEM
105 106
	PKMAP_BASE_NR,
#endif
107 108
	FIXADDR_START_NR,
	END_OF_SPACE_NR,
109 110
};

111
static struct addr_marker address_markers[] = {
112 113 114 115 116 117
	[USER_SPACE_NR]		= { 0,			"User Space" },
	[KERNEL_SPACE_NR]	= { PAGE_OFFSET,	"Kernel Mapping" },
	[VMALLOC_START_NR]	= { 0UL,		"vmalloc() Area" },
	[VMALLOC_END_NR]	= { 0UL,		"vmalloc() End" },
#ifdef CONFIG_HIGHMEM
	[PKMAP_BASE_NR]		= { 0UL,		"Persistent kmap() Area" },
118
#endif
119 120
	[FIXADDR_START_NR]	= { 0UL,		"Fixmap area" },
	[END_OF_SPACE_NR]	= { -1,			NULL }
121
};
122

123 124
#endif /* !CONFIG_X86_64 */

125 126 127 128
/* Multipliers for offsets within the PTEs */
#define PTE_LEVEL_MULT (PAGE_SIZE)
#define PMD_LEVEL_MULT (PTRS_PER_PTE * PTE_LEVEL_MULT)
#define PUD_LEVEL_MULT (PTRS_PER_PMD * PMD_LEVEL_MULT)
129
#define P4D_LEVEL_MULT (PTRS_PER_PUD * PUD_LEVEL_MULT)
130
#define PGD_LEVEL_MULT (PTRS_PER_P4D * P4D_LEVEL_MULT)
131

132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149
#define pt_dump_seq_printf(m, to_dmesg, fmt, args...)		\
({								\
	if (to_dmesg)					\
		printk(KERN_INFO fmt, ##args);			\
	else							\
		if (m)						\
			seq_printf(m, fmt, ##args);		\
})

#define pt_dump_cont_printf(m, to_dmesg, fmt, args...)		\
({								\
	if (to_dmesg)					\
		printk(KERN_CONT fmt, ##args);			\
	else							\
		if (m)						\
			seq_printf(m, fmt, ##args);		\
})

150 151 152
/*
 * Print a readable form of a pgprot_t to the seq_file
 */
153
static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
154
{
155 156
	pgprotval_t pr = pgprot_val(prot);
	static const char * const level_name[] =
157
		{ "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
158

159
	if (!(pr & _PAGE_PRESENT)) {
160
		/* Not present */
161
		pt_dump_cont_printf(m, dmsg, "                              ");
162 163
	} else {
		if (pr & _PAGE_USER)
164
			pt_dump_cont_printf(m, dmsg, "USR ");
165
		else
166
			pt_dump_cont_printf(m, dmsg, "    ");
167
		if (pr & _PAGE_RW)
168
			pt_dump_cont_printf(m, dmsg, "RW ");
169
		else
170
			pt_dump_cont_printf(m, dmsg, "ro ");
171
		if (pr & _PAGE_PWT)
172
			pt_dump_cont_printf(m, dmsg, "PWT ");
173
		else
174
			pt_dump_cont_printf(m, dmsg, "    ");
175
		if (pr & _PAGE_PCD)
176
			pt_dump_cont_printf(m, dmsg, "PCD ");
177
		else
178
			pt_dump_cont_printf(m, dmsg, "    ");
179

180
		/* Bit 7 has a different meaning on level 3 vs 4 */
181
		if (level <= 4 && pr & _PAGE_PSE)
182 183 184
			pt_dump_cont_printf(m, dmsg, "PSE ");
		else
			pt_dump_cont_printf(m, dmsg, "    ");
185 186
		if ((level == 5 && pr & _PAGE_PAT) ||
		    ((level == 4 || level == 3) && pr & _PAGE_PAT_LARGE))
187
			pt_dump_cont_printf(m, dmsg, "PAT ");
188 189
		else
			pt_dump_cont_printf(m, dmsg, "    ");
190
		if (pr & _PAGE_GLOBAL)
191
			pt_dump_cont_printf(m, dmsg, "GLB ");
192
		else
193
			pt_dump_cont_printf(m, dmsg, "    ");
194
		if (pr & _PAGE_NX)
195
			pt_dump_cont_printf(m, dmsg, "NX ");
196
		else
197
			pt_dump_cont_printf(m, dmsg, "x  ");
198
	}
199
	pt_dump_cont_printf(m, dmsg, "%s\n", level_name[level]);
200 201 202
}

/*
203
 * On 64 bits, sign-extend the 48 bit address to 64 bit
204
 */
205
static unsigned long normalize_addr(unsigned long u)
206
{
207 208 209 210 211 212
	int shift;
	if (!IS_ENABLED(CONFIG_X86_64))
		return u;

	shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
	return (signed long)(u << shift) >> shift;
213 214 215 216 217 218 219 220
}

/*
 * This function gets called on a break in a continuous series
 * of PTE entries; the next one is different so we need to
 * print what we collected so far.
 */
static void note_page(struct seq_file *m, struct pg_state *st,
221
		      pgprot_t new_prot, int level)
222
{
223
	pgprotval_t prot, cur;
224
	static const char units[] = "BKMGTPE";
225 226 227

	/*
	 * If we have a "break" in the series, we need to flush the state that
228 229
	 * we have now. "break" is either changing perms, levels or
	 * address space marker.
230
	 */
231 232
	prot = pgprot_val(new_prot);
	cur = pgprot_val(st->current_prot);
233

234 235 236 237 238
	if (!st->level) {
		/* First entry */
		st->current_prot = new_prot;
		st->level = level;
		st->marker = address_markers;
239
		st->lines = 0;
240 241
		pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
				   st->marker->name);
242 243 244
	} else if (prot != cur || level != st->level ||
		   st->current_address >= st->marker[1].start_address) {
		const char *unit = units;
245
		unsigned long delta;
246
		int width = sizeof(unsigned long) * 2;
S
Stephen Smalley 已提交
247 248 249 250 251 252 253 254 255 256
		pgprotval_t pr = pgprot_val(st->current_prot);

		if (st->check_wx && (pr & _PAGE_RW) && !(pr & _PAGE_NX)) {
			WARN_ONCE(1,
				  "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
				  (void *)st->start_address,
				  (void *)st->start_address);
			st->wx_pages += (st->current_address -
					 st->start_address) / PAGE_SIZE;
		}
257 258 259 260

		/*
		 * Now print the actual finished series
		 */
261 262 263 264 265 266
		if (!st->marker->max_lines ||
		    st->lines < st->marker->max_lines) {
			pt_dump_seq_printf(m, st->to_dmesg,
					   "0x%0*lx-0x%0*lx   ",
					   width, st->start_address,
					   width, st->current_address);
267

268 269 270 271 272 273 274 275 276
			delta = st->current_address - st->start_address;
			while (!(delta & 1023) && unit[1]) {
				delta >>= 10;
				unit++;
			}
			pt_dump_cont_printf(m, st->to_dmesg, "%9lu%c ",
					    delta, *unit);
			printk_prot(m, st->current_prot, st->level,
				    st->to_dmesg);
277
		}
278
		st->lines++;
279 280 281 282 283 284 285

		/*
		 * We print markers for special areas of address space,
		 * such as the start of vmalloc space etc.
		 * This helps in the interpretation.
		 */
		if (st->current_address >= st->marker[1].start_address) {
286 287 288 289 290 291 292 293 294
			if (st->marker->max_lines &&
			    st->lines > st->marker->max_lines) {
				unsigned long nskip =
					st->lines - st->marker->max_lines;
				pt_dump_seq_printf(m, st->to_dmesg,
						   "... %lu entr%s skipped ... \n",
						   nskip,
						   nskip == 1 ? "y" : "ies");
			}
295
			st->marker++;
296
			st->lines = 0;
297 298
			pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
					   st->marker->name);
299
		}
300

301 302 303
		st->start_address = st->current_address;
		st->current_prot = new_prot;
		st->level = level;
304
	}
305 306
}

307
static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, unsigned long P)
308 309 310
{
	int i;
	pte_t *start;
311
	pgprotval_t prot;
312

313
	start = (pte_t *)pmd_page_vaddr(addr);
314
	for (i = 0; i < PTRS_PER_PTE; i++) {
315
		prot = pte_flags(*start);
316
		st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT);
317
		note_page(m, st, __pgprot(prot), 5);
318 319 320
		start++;
	}
}
321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350
#ifdef CONFIG_KASAN

/*
 * This is an optimization for KASAN=y case. Since all kasan page tables
 * eventually point to the kasan_zero_page we could call note_page()
 * right away without walking through lower level page tables. This saves
 * us dozens of seconds (minutes for 5-level config) while checking for
 * W+X mapping or reading kernel_page_tables debugfs file.
 */
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
				void *pt)
{
	if (__pa(pt) == __pa(kasan_zero_pmd) ||
#ifdef CONFIG_X86_5LEVEL
	    __pa(pt) == __pa(kasan_zero_p4d) ||
#endif
	    __pa(pt) == __pa(kasan_zero_pud)) {
		pgprotval_t prot = pte_flags(kasan_zero_pte[0]);
		note_page(m, st, __pgprot(prot), 5);
		return true;
	}
	return false;
}
#else
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
				void *pt)
{
	return false;
}
#endif
351

352
#if PTRS_PER_PMD > 1
353

354
static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, unsigned long P)
355 356
{
	int i;
357
	pmd_t *start, *pmd_start;
358
	pgprotval_t prot;
359

360
	pmd_start = start = (pmd_t *)pud_page_vaddr(addr);
361
	for (i = 0; i < PTRS_PER_PMD; i++) {
362
		st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
363
		if (!pmd_none(*start)) {
364 365
			if (pmd_large(*start) || !pmd_present(*start)) {
				prot = pmd_flags(*start);
366
				note_page(m, st, __pgprot(prot), 4);
367
			} else if (!kasan_page_table(m, st, pmd_start)) {
368 369
				walk_pte_level(m, st, *start,
					       P + i * PMD_LEVEL_MULT);
370
			}
371
		} else
372
			note_page(m, st, __pgprot(0), 4);
373 374 375 376
		start++;
	}
}

377 378 379 380 381
#else
#define walk_pmd_level(m,s,a,p) walk_pte_level(m,s,__pmd(pud_val(a)),p)
#define pud_large(a) pmd_large(__pmd(pud_val(a)))
#define pud_none(a)  pmd_none(__pmd(pud_val(a)))
#endif
382

383 384
#if PTRS_PER_PUD > 1

385
static void walk_pud_level(struct seq_file *m, struct pg_state *st, p4d_t addr, unsigned long P)
386 387
{
	int i;
388
	pud_t *start, *pud_start;
389
	pgprotval_t prot;
390
	pud_t *prev_pud = NULL;
391

392
	pud_start = start = (pud_t *)p4d_page_vaddr(addr);
393 394

	for (i = 0; i < PTRS_PER_PUD; i++) {
395
		st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
396
		if (!pud_none(*start)) {
397 398
			if (pud_large(*start) || !pud_present(*start)) {
				prot = pud_flags(*start);
399
				note_page(m, st, __pgprot(prot), 3);
400
			} else if (!kasan_page_table(m, st, pud_start)) {
401 402
				walk_pmd_level(m, st, *start,
					       P + i * PUD_LEVEL_MULT);
403
			}
404
		} else
405
			note_page(m, st, __pgprot(0), 3);
406

407
		prev_pud = start;
408 409 410 411
		start++;
	}
}

412
#else
413 414 415 416 417 418 419 420 421 422
#define walk_pud_level(m,s,a,p) walk_pmd_level(m,s,__pud(p4d_val(a)),p)
#define p4d_large(a) pud_large(__pud(p4d_val(a)))
#define p4d_none(a)  pud_none(__pud(p4d_val(a)))
#endif

#if PTRS_PER_P4D > 1

static void walk_p4d_level(struct seq_file *m, struct pg_state *st, pgd_t addr, unsigned long P)
{
	int i;
423
	p4d_t *start, *p4d_start;
424 425
	pgprotval_t prot;

426
	p4d_start = start = (p4d_t *)pgd_page_vaddr(addr);
427 428 429 430 431 432 433

	for (i = 0; i < PTRS_PER_P4D; i++) {
		st->current_address = normalize_addr(P + i * P4D_LEVEL_MULT);
		if (!p4d_none(*start)) {
			if (p4d_large(*start) || !p4d_present(*start)) {
				prot = p4d_flags(*start);
				note_page(m, st, __pgprot(prot), 2);
434
			} else if (!kasan_page_table(m, st, p4d_start)) {
435 436 437 438 439 440 441 442 443 444 445 446 447 448
				walk_pud_level(m, st, *start,
					       P + i * P4D_LEVEL_MULT);
			}
		} else
			note_page(m, st, __pgprot(0), 2);

		start++;
	}
}

#else
#define walk_p4d_level(m,s,a,p) walk_pud_level(m,s,__p4d(pgd_val(a)),p)
#define pgd_large(a) p4d_large(__p4d(pgd_val(a)))
#define pgd_none(a)  p4d_none(__p4d(pgd_val(a)))
449 450
#endif

451 452
static inline bool is_hypervisor_range(int idx)
{
453
#ifdef CONFIG_X86_64
454 455 456 457
	/*
	 * ffff800000000000 - ffff87ffffffffff is reserved for
	 * the hypervisor.
	 */
458 459
	return	(idx >= pgd_index(__PAGE_OFFSET) - 16) &&
		(idx <  pgd_index(__PAGE_OFFSET));
460
#else
461
	return false;
462
#endif
463
}
464

S
Stephen Smalley 已提交
465 466
static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
				       bool checkwx)
467
{
468
#ifdef CONFIG_X86_64
469
	pgd_t *start = (pgd_t *) &init_top_pgt;
470 471 472
#else
	pgd_t *start = swapper_pg_dir;
#endif
473
	pgprotval_t prot;
474
	int i;
475
	struct pg_state st = {};
476

477 478 479 480
	if (pgd) {
		start = pgd;
		st.to_dmesg = true;
	}
481

S
Stephen Smalley 已提交
482 483 484 485
	st.check_wx = checkwx;
	if (checkwx)
		st.wx_pages = 0;

486
	for (i = 0; i < PTRS_PER_PGD; i++) {
487
		st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
488
		if (!pgd_none(*start) && !is_hypervisor_range(i)) {
489 490
			if (pgd_large(*start) || !pgd_present(*start)) {
				prot = pgd_flags(*start);
491
				note_page(m, &st, __pgprot(prot), 1);
492
			} else {
493
				walk_p4d_level(m, &st, *start,
494
					       i * PGD_LEVEL_MULT);
495
			}
496
		} else
497
			note_page(m, &st, __pgprot(0), 1);
498

499
		cond_resched();
500 501
		start++;
	}
502 503 504 505

	/* Flush out the last page */
	st.current_address = normalize_addr(PTRS_PER_PGD*PGD_LEVEL_MULT);
	note_page(m, &st, __pgprot(0), 0);
S
Stephen Smalley 已提交
506 507 508 509 510 511 512 513 514 515 516 517
	if (!checkwx)
		return;
	if (st.wx_pages)
		pr_info("x86/mm: Checked W+X mappings: FAILED, %lu W+X pages found.\n",
			st.wx_pages);
	else
		pr_info("x86/mm: Checked W+X mappings: passed, no W+X pages found.\n");
}

void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
{
	ptdump_walk_pgd_level_core(m, pgd, false);
518
}
519
EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level);
520

S
Stephen Smalley 已提交
521 522 523 524 525
void ptdump_walk_pgd_level_checkwx(void)
{
	ptdump_walk_pgd_level_core(NULL, NULL, true);
}

526
static int __init pt_dump_init(void)
527
{
528 529 530 531 532 533 534 535 536
	/*
	 * Various markers are not compile-time constants, so assign them
	 * here.
	 */
#ifdef CONFIG_X86_64
	address_markers[LOW_KERNEL_NR].start_address = PAGE_OFFSET;
	address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
	address_markers[VMEMMAP_START_NR].start_address = VMEMMAP_START;
#endif
537
#ifdef CONFIG_X86_32
538 539
	address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
	address_markers[VMALLOC_END_NR].start_address = VMALLOC_END;
540
# ifdef CONFIG_HIGHMEM
541
	address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
542
# endif
543
	address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
544 545
#endif

546 547 548
	return 0;
}
__initcall(pt_dump_init);