dump_pagetables.c 13.7 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14
/*
 * Debug helper to dump the current kernel pagetables of the system
 * so that we can see what the various memory ranges are set to.
 *
 * (C) Copyright 2008 Intel Corporation
 *
 * Author: Arjan van de Ven <arjan@linux.intel.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; version 2
 * of the License.
 */

15
#include <linux/debugfs.h>
16
#include <linux/kasan.h>
17
#include <linux/mm.h>
18
#include <linux/init.h>
19
#include <linux/sched.h>
20 21 22 23 24 25 26 27 28 29 30 31 32 33
#include <linux/seq_file.h>

#include <asm/pgtable.h>

/*
 * The dumper groups pagetable entries of the same type into one, and for
 * that it needs to keep some state when walking, and flush this state
 * when a "break" in the continuity is found.
 */
struct pg_state {
	int level;
	pgprot_t current_prot;
	unsigned long start_address;
	unsigned long current_address;
34
	const struct addr_marker *marker;
35
	unsigned long lines;
36
	bool to_dmesg;
S
Stephen Smalley 已提交
37 38
	bool check_wx;
	unsigned long wx_pages;
39 40
};

41 42 43
struct addr_marker {
	unsigned long start_address;
	const char *name;
44
	unsigned long max_lines;
45 46
};

47 48 49 50 51 52 53 54
/* indices for address_markers; keep sync'd w/ address_markers below */
enum address_markers_idx {
	USER_SPACE_NR = 0,
#ifdef CONFIG_X86_64
	KERNEL_SPACE_NR,
	LOW_KERNEL_NR,
	VMALLOC_START_NR,
	VMEMMAP_START_NR,
55 56 57 58
#ifdef CONFIG_KASAN
	KASAN_SHADOW_START_NR,
	KASAN_SHADOW_END_NR,
#endif
59
# ifdef CONFIG_X86_ESPFIX64
60
	ESPFIX_START_NR,
61
# endif
62 63 64 65 66 67 68 69 70 71 72 73 74 75
	HIGH_KERNEL_NR,
	MODULES_VADDR_NR,
	MODULES_END_NR,
#else
	KERNEL_SPACE_NR,
	VMALLOC_START_NR,
	VMALLOC_END_NR,
# ifdef CONFIG_HIGHMEM
	PKMAP_BASE_NR,
# endif
	FIXADDR_START_NR,
#endif
};

76 77 78 79 80
/* Address space markers hints */
static struct addr_marker address_markers[] = {
	{ 0, "User Space" },
#ifdef CONFIG_X86_64
	{ 0x8000000000000000UL, "Kernel Space" },
81 82 83
	{ 0/* PAGE_OFFSET */,   "Low Kernel Mapping" },
	{ 0/* VMALLOC_START */, "vmalloc() Area" },
	{ 0/* VMEMMAP_START */, "Vmemmap" },
84 85 86 87
#ifdef CONFIG_KASAN
	{ KASAN_SHADOW_START,	"KASAN shadow" },
	{ KASAN_SHADOW_END,	"KASAN shadow end" },
#endif
88
# ifdef CONFIG_X86_ESPFIX64
89
	{ ESPFIX_BASE_ADDR,	"ESPfix Area", 16 },
90 91 92
# endif
# ifdef CONFIG_EFI
	{ EFI_VA_END,		"EFI Runtime Services" },
93
# endif
94
	{ __START_KERNEL_map,   "High Kernel Mapping" },
95 96
	{ MODULES_VADDR,        "Modules" },
	{ MODULES_END,          "End Modules" },
97 98 99 100 101
#else
	{ PAGE_OFFSET,          "Kernel Mapping" },
	{ 0/* VMALLOC_START */, "vmalloc() Area" },
	{ 0/*VMALLOC_END*/,     "vmalloc() End" },
# ifdef CONFIG_HIGHMEM
L
Linus Torvalds 已提交
102
	{ 0/*PKMAP_BASE*/,      "Persistent kmap() Area" },
103 104 105 106 107
# endif
	{ 0/*FIXADDR_START*/,   "Fixmap Area" },
#endif
	{ -1, NULL }		/* End of list */
};
108

109 110 111 112
/* Multipliers for offsets within the PTEs */
#define PTE_LEVEL_MULT (PAGE_SIZE)
#define PMD_LEVEL_MULT (PTRS_PER_PTE * PTE_LEVEL_MULT)
#define PUD_LEVEL_MULT (PTRS_PER_PMD * PMD_LEVEL_MULT)
113
#define P4D_LEVEL_MULT (PTRS_PER_PUD * PUD_LEVEL_MULT)
114
#define PGD_LEVEL_MULT (PTRS_PER_P4D * P4D_LEVEL_MULT)
115

116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
#define pt_dump_seq_printf(m, to_dmesg, fmt, args...)		\
({								\
	if (to_dmesg)					\
		printk(KERN_INFO fmt, ##args);			\
	else							\
		if (m)						\
			seq_printf(m, fmt, ##args);		\
})

#define pt_dump_cont_printf(m, to_dmesg, fmt, args...)		\
({								\
	if (to_dmesg)					\
		printk(KERN_CONT fmt, ##args);			\
	else							\
		if (m)						\
			seq_printf(m, fmt, ##args);		\
})

134 135 136
/*
 * Print a readable form of a pgprot_t to the seq_file
 */
137
static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
138
{
139 140
	pgprotval_t pr = pgprot_val(prot);
	static const char * const level_name[] =
141
		{ "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
142 143 144

	if (!pgprot_val(prot)) {
		/* Not present */
145
		pt_dump_cont_printf(m, dmsg, "                              ");
146 147
	} else {
		if (pr & _PAGE_USER)
148
			pt_dump_cont_printf(m, dmsg, "USR ");
149
		else
150
			pt_dump_cont_printf(m, dmsg, "    ");
151
		if (pr & _PAGE_RW)
152
			pt_dump_cont_printf(m, dmsg, "RW ");
153
		else
154
			pt_dump_cont_printf(m, dmsg, "ro ");
155
		if (pr & _PAGE_PWT)
156
			pt_dump_cont_printf(m, dmsg, "PWT ");
157
		else
158
			pt_dump_cont_printf(m, dmsg, "    ");
159
		if (pr & _PAGE_PCD)
160
			pt_dump_cont_printf(m, dmsg, "PCD ");
161
		else
162
			pt_dump_cont_printf(m, dmsg, "    ");
163

164
		/* Bit 7 has a different meaning on level 3 vs 4 */
165
		if (level <= 4 && pr & _PAGE_PSE)
166 167 168
			pt_dump_cont_printf(m, dmsg, "PSE ");
		else
			pt_dump_cont_printf(m, dmsg, "    ");
169 170
		if ((level == 5 && pr & _PAGE_PAT) ||
		    ((level == 4 || level == 3) && pr & _PAGE_PAT_LARGE))
171
			pt_dump_cont_printf(m, dmsg, "PAT ");
172 173
		else
			pt_dump_cont_printf(m, dmsg, "    ");
174
		if (pr & _PAGE_GLOBAL)
175
			pt_dump_cont_printf(m, dmsg, "GLB ");
176
		else
177
			pt_dump_cont_printf(m, dmsg, "    ");
178
		if (pr & _PAGE_NX)
179
			pt_dump_cont_printf(m, dmsg, "NX ");
180
		else
181
			pt_dump_cont_printf(m, dmsg, "x  ");
182
	}
183
	pt_dump_cont_printf(m, dmsg, "%s\n", level_name[level]);
184 185 186
}

/*
187
 * On 64 bits, sign-extend the 48 bit address to 64 bit
188
 */
189
static unsigned long normalize_addr(unsigned long u)
190
{
191 192 193 194 195 196
	int shift;
	if (!IS_ENABLED(CONFIG_X86_64))
		return u;

	shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
	return (signed long)(u << shift) >> shift;
197 198 199 200 201 202 203 204
}

/*
 * This function gets called on a break in a continuous series
 * of PTE entries; the next one is different so we need to
 * print what we collected so far.
 */
static void note_page(struct seq_file *m, struct pg_state *st,
205
		      pgprot_t new_prot, int level)
206
{
207
	pgprotval_t prot, cur;
208
	static const char units[] = "BKMGTPE";
209 210 211

	/*
	 * If we have a "break" in the series, we need to flush the state that
212 213
	 * we have now. "break" is either changing perms, levels or
	 * address space marker.
214
	 */
215 216
	prot = pgprot_val(new_prot);
	cur = pgprot_val(st->current_prot);
217

218 219 220 221 222
	if (!st->level) {
		/* First entry */
		st->current_prot = new_prot;
		st->level = level;
		st->marker = address_markers;
223
		st->lines = 0;
224 225
		pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
				   st->marker->name);
226 227 228
	} else if (prot != cur || level != st->level ||
		   st->current_address >= st->marker[1].start_address) {
		const char *unit = units;
229
		unsigned long delta;
230
		int width = sizeof(unsigned long) * 2;
S
Stephen Smalley 已提交
231 232 233 234 235 236 237 238 239 240
		pgprotval_t pr = pgprot_val(st->current_prot);

		if (st->check_wx && (pr & _PAGE_RW) && !(pr & _PAGE_NX)) {
			WARN_ONCE(1,
				  "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
				  (void *)st->start_address,
				  (void *)st->start_address);
			st->wx_pages += (st->current_address -
					 st->start_address) / PAGE_SIZE;
		}
241 242 243 244

		/*
		 * Now print the actual finished series
		 */
245 246 247 248 249 250
		if (!st->marker->max_lines ||
		    st->lines < st->marker->max_lines) {
			pt_dump_seq_printf(m, st->to_dmesg,
					   "0x%0*lx-0x%0*lx   ",
					   width, st->start_address,
					   width, st->current_address);
251

252 253 254 255 256 257 258 259 260
			delta = st->current_address - st->start_address;
			while (!(delta & 1023) && unit[1]) {
				delta >>= 10;
				unit++;
			}
			pt_dump_cont_printf(m, st->to_dmesg, "%9lu%c ",
					    delta, *unit);
			printk_prot(m, st->current_prot, st->level,
				    st->to_dmesg);
261
		}
262
		st->lines++;
263 264 265 266 267 268 269

		/*
		 * We print markers for special areas of address space,
		 * such as the start of vmalloc space etc.
		 * This helps in the interpretation.
		 */
		if (st->current_address >= st->marker[1].start_address) {
270 271 272 273 274 275 276 277 278
			if (st->marker->max_lines &&
			    st->lines > st->marker->max_lines) {
				unsigned long nskip =
					st->lines - st->marker->max_lines;
				pt_dump_seq_printf(m, st->to_dmesg,
						   "... %lu entr%s skipped ... \n",
						   nskip,
						   nskip == 1 ? "y" : "ies");
			}
279
			st->marker++;
280
			st->lines = 0;
281 282
			pt_dump_seq_printf(m, st->to_dmesg, "---[ %s ]---\n",
					   st->marker->name);
283
		}
284

285 286 287
		st->start_address = st->current_address;
		st->current_prot = new_prot;
		st->level = level;
288
	}
289 290
}

291
static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr, unsigned long P)
292 293 294
{
	int i;
	pte_t *start;
295
	pgprotval_t prot;
296

297
	start = (pte_t *)pmd_page_vaddr(addr);
298
	for (i = 0; i < PTRS_PER_PTE; i++) {
299
		prot = pte_flags(*start);
300
		st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT);
301
		note_page(m, st, __pgprot(prot), 5);
302 303 304
		start++;
	}
}
305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334
#ifdef CONFIG_KASAN

/*
 * This is an optimization for KASAN=y case. Since all kasan page tables
 * eventually point to the kasan_zero_page we could call note_page()
 * right away without walking through lower level page tables. This saves
 * us dozens of seconds (minutes for 5-level config) while checking for
 * W+X mapping or reading kernel_page_tables debugfs file.
 */
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
				void *pt)
{
	if (__pa(pt) == __pa(kasan_zero_pmd) ||
#ifdef CONFIG_X86_5LEVEL
	    __pa(pt) == __pa(kasan_zero_p4d) ||
#endif
	    __pa(pt) == __pa(kasan_zero_pud)) {
		pgprotval_t prot = pte_flags(kasan_zero_pte[0]);
		note_page(m, st, __pgprot(prot), 5);
		return true;
	}
	return false;
}
#else
static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
				void *pt)
{
	return false;
}
#endif
335

336
#if PTRS_PER_PMD > 1
337

338
static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, unsigned long P)
339 340
{
	int i;
341
	pmd_t *start, *pmd_start;
342
	pgprotval_t prot;
343

344
	pmd_start = start = (pmd_t *)pud_page_vaddr(addr);
345
	for (i = 0; i < PTRS_PER_PMD; i++) {
346
		st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
347
		if (!pmd_none(*start)) {
348 349
			if (pmd_large(*start) || !pmd_present(*start)) {
				prot = pmd_flags(*start);
350
				note_page(m, st, __pgprot(prot), 4);
351
			} else if (!kasan_page_table(m, st, pmd_start)) {
352 353
				walk_pte_level(m, st, *start,
					       P + i * PMD_LEVEL_MULT);
354
			}
355
		} else
356
			note_page(m, st, __pgprot(0), 4);
357 358 359 360
		start++;
	}
}

361 362 363 364 365
#else
#define walk_pmd_level(m,s,a,p) walk_pte_level(m,s,__pmd(pud_val(a)),p)
#define pud_large(a) pmd_large(__pmd(pud_val(a)))
#define pud_none(a)  pmd_none(__pmd(pud_val(a)))
#endif
366

367 368
#if PTRS_PER_PUD > 1

369
static void walk_pud_level(struct seq_file *m, struct pg_state *st, p4d_t addr, unsigned long P)
370 371
{
	int i;
372
	pud_t *start, *pud_start;
373
	pgprotval_t prot;
374
	pud_t *prev_pud = NULL;
375

376
	pud_start = start = (pud_t *)p4d_page_vaddr(addr);
377 378

	for (i = 0; i < PTRS_PER_PUD; i++) {
379
		st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
380
		if (!pud_none(*start)) {
381 382
			if (pud_large(*start) || !pud_present(*start)) {
				prot = pud_flags(*start);
383
				note_page(m, st, __pgprot(prot), 3);
384
			} else if (!kasan_page_table(m, st, pud_start)) {
385 386
				walk_pmd_level(m, st, *start,
					       P + i * PUD_LEVEL_MULT);
387
			}
388
		} else
389
			note_page(m, st, __pgprot(0), 3);
390

391
		prev_pud = start;
392 393 394 395
		start++;
	}
}

396
#else
397 398 399 400 401 402 403 404 405 406
#define walk_pud_level(m,s,a,p) walk_pmd_level(m,s,__pud(p4d_val(a)),p)
#define p4d_large(a) pud_large(__pud(p4d_val(a)))
#define p4d_none(a)  pud_none(__pud(p4d_val(a)))
#endif

#if PTRS_PER_P4D > 1

static void walk_p4d_level(struct seq_file *m, struct pg_state *st, pgd_t addr, unsigned long P)
{
	int i;
407
	p4d_t *start, *p4d_start;
408 409
	pgprotval_t prot;

410
	p4d_start = start = (p4d_t *)pgd_page_vaddr(addr);
411 412 413 414 415 416 417

	for (i = 0; i < PTRS_PER_P4D; i++) {
		st->current_address = normalize_addr(P + i * P4D_LEVEL_MULT);
		if (!p4d_none(*start)) {
			if (p4d_large(*start) || !p4d_present(*start)) {
				prot = p4d_flags(*start);
				note_page(m, st, __pgprot(prot), 2);
418
			} else if (!kasan_page_table(m, st, p4d_start)) {
419 420 421 422 423 424 425 426 427 428 429 430 431 432
				walk_pud_level(m, st, *start,
					       P + i * P4D_LEVEL_MULT);
			}
		} else
			note_page(m, st, __pgprot(0), 2);

		start++;
	}
}

#else
#define walk_p4d_level(m,s,a,p) walk_pud_level(m,s,__p4d(pgd_val(a)),p)
#define pgd_large(a) p4d_large(__p4d(pgd_val(a)))
#define pgd_none(a)  p4d_none(__p4d(pgd_val(a)))
433 434
#endif

435 436
static inline bool is_hypervisor_range(int idx)
{
437
#ifdef CONFIG_X86_64
438 439 440 441
	/*
	 * ffff800000000000 - ffff87ffffffffff is reserved for
	 * the hypervisor.
	 */
442 443
	return	(idx >= pgd_index(__PAGE_OFFSET) - 16) &&
		(idx <  pgd_index(__PAGE_OFFSET));
444
#else
445
	return false;
446
#endif
447
}
448

S
Stephen Smalley 已提交
449 450
static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
				       bool checkwx)
451
{
452
#ifdef CONFIG_X86_64
453
	pgd_t *start = (pgd_t *) &init_top_pgt;
454 455 456
#else
	pgd_t *start = swapper_pg_dir;
#endif
457
	pgprotval_t prot;
458
	int i;
459
	struct pg_state st = {};
460

461 462 463 464
	if (pgd) {
		start = pgd;
		st.to_dmesg = true;
	}
465

S
Stephen Smalley 已提交
466 467 468 469
	st.check_wx = checkwx;
	if (checkwx)
		st.wx_pages = 0;

470
	for (i = 0; i < PTRS_PER_PGD; i++) {
471
		st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
472
		if (!pgd_none(*start) && !is_hypervisor_range(i)) {
473 474
			if (pgd_large(*start) || !pgd_present(*start)) {
				prot = pgd_flags(*start);
475
				note_page(m, &st, __pgprot(prot), 1);
476
			} else {
477
				walk_p4d_level(m, &st, *start,
478
					       i * PGD_LEVEL_MULT);
479
			}
480
		} else
481
			note_page(m, &st, __pgprot(0), 1);
482

483
		cond_resched();
484 485
		start++;
	}
486 487 488 489

	/* Flush out the last page */
	st.current_address = normalize_addr(PTRS_PER_PGD*PGD_LEVEL_MULT);
	note_page(m, &st, __pgprot(0), 0);
S
Stephen Smalley 已提交
490 491 492 493 494 495 496 497 498 499 500 501
	if (!checkwx)
		return;
	if (st.wx_pages)
		pr_info("x86/mm: Checked W+X mappings: FAILED, %lu W+X pages found.\n",
			st.wx_pages);
	else
		pr_info("x86/mm: Checked W+X mappings: passed, no W+X pages found.\n");
}

void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
{
	ptdump_walk_pgd_level_core(m, pgd, false);
502
}
503
EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level);
504

S
Stephen Smalley 已提交
505 506 507 508 509
void ptdump_walk_pgd_level_checkwx(void)
{
	ptdump_walk_pgd_level_core(NULL, NULL, true);
}

510
static int __init pt_dump_init(void)
511
{
512 513 514 515 516 517 518 519 520
	/*
	 * Various markers are not compile-time constants, so assign them
	 * here.
	 */
#ifdef CONFIG_X86_64
	address_markers[LOW_KERNEL_NR].start_address = PAGE_OFFSET;
	address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
	address_markers[VMEMMAP_START_NR].start_address = VMEMMAP_START;
#endif
521
#ifdef CONFIG_X86_32
522 523
	address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
	address_markers[VMALLOC_END_NR].start_address = VMALLOC_END;
524
# ifdef CONFIG_HIGHMEM
525
	address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
526
# endif
527
	address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
528 529
#endif

530 531 532
	return 0;
}
__initcall(pt_dump_init);