Re: [patch 064/158] mm: add generic ptdump

[David Hildenbrand <david@redhat.com>]

On 01.12.19 02:53, akpm@linux-foundation.org wrote:
> From: Steven Price <steven.price@arm.com>
> Subject: mm: add generic ptdump
> 
> Add a generic version of page table dumping that architectures can opt-in
> to
> 
> [steven.price@arm.com: v15]
>   Link: http://lkml.kernel.org/r/20191101140942.51554-20-steven.price@arm.com
> [cai@lca.pw: fix a -Wold-style-declaration warning]
>   Link: http://lkml.kernel.org/r/1572895385-29194-1-git-send-email-cai@lca.pw
> Link: http://lkml.kernel.org/r/20191028135910.33253-20-steven.price@arm.com
> Signed-off-by: Steven Price <steven.price@arm.com>
> Signed-off-by: Qian Cai <cai@lca.pw>
> Cc: Albert Ou <aou@eecs.berkeley.edu>
> Cc: Alexander Potapenko <glider@google.com>
> Cc: Alexandre Ghiti <alex@ghiti.fr>
> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Christian Borntraeger <borntraeger@de.ibm.com>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Ingo Molnar <mingo@elte.hu>
> Cc: James Hogan <jhogan@kernel.org>
> Cc: James Morse <james.morse@arm.com>
> Cc: "Liang, Kan" <kan.liang@linux.intel.com>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Matthew Wilcox <mawilcox@microsoft.com>
> Cc: Michael Ellerman <mpe@ellerman.id.au>
> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> Cc: Palmer Dabbelt <palmer@sifive.com>
> Cc: Paul Burton <paul.burton@mips.com>
> Cc: Paul Mackerras <paulus@samba.org>
> Cc: Paul Walmsley <paul.walmsley@sifive.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ralf Baechle <ralf@linux-mips.org>
> Cc: Russell King <linux@armlinux.org.uk>
> Cc: Shiraz Hashim <shashim@codeaurora.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Vasily Gorbik <gor@linux.ibm.com>
> Cc: Vineet Gupta <vgupta@synopsys.com>
> Cc: Will Deacon <will@kernel.org>
> Cc: Zong Li <zong.li@sifive.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>  include/linux/ptdump.h |   21 +++++
>  mm/Kconfig.debug       |   21 +++++
>  mm/Makefile            |    1 
>  mm/ptdump.c            |  151 +++++++++++++++++++++++++++++++++++++++
>  4 files changed, 194 insertions(+)
> 
> --- /dev/null
> +++ a/include/linux/ptdump.h
> @@ -0,0 +1,21 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#ifndef _LINUX_PTDUMP_H
> +#define _LINUX_PTDUMP_H
> +
> +#include <linux/mm_types.h>
> +
> +struct ptdump_range {
> +	unsigned long start;
> +	unsigned long end;
> +};
> +
> +struct ptdump_state {
> +	void (*note_page)(struct ptdump_state *st, unsigned long addr,
> +			  int level, unsigned long val);
> +	const struct ptdump_range *range;
> +};
> +
> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm);
> +
> +#endif /* _LINUX_PTDUMP_H */
> --- a/mm/Kconfig.debug~mm-add-generic-ptdump
> +++ a/mm/Kconfig.debug
> @@ -117,3 +117,24 @@ config DEBUG_RODATA_TEST
>      depends on STRICT_KERNEL_RWX
>      ---help---
>        This option enables a testcase for the setting rodata read-only.
> +
> +config GENERIC_PTDUMP
> +	bool
> +
> +config PTDUMP_CORE
> +	bool
> +
> +config PTDUMP_DEBUGFS
> +	bool "Export kernel pagetable layout to userspace via debugfs"
> +	depends on DEBUG_KERNEL
> +	depends on DEBUG_FS
> +	depends on GENERIC_PTDUMP
> +	select PTDUMP_CORE
> +	help
> +	  Say Y here if you want to show the kernel pagetable layout in a
> +	  debugfs file. This information is only useful for kernel developers
> +	  who are working in architecture specific areas of the kernel.
> +	  It is probably not a good idea to enable this feature in a production
> +	  kernel.
> +
> +	  If in doubt, say N.
> --- a/mm/Makefile~mm-add-generic-ptdump
> +++ a/mm/Makefile
> @@ -98,6 +98,7 @@ obj-$(CONFIG_CMA)	+= cma.o
>  obj-$(CONFIG_MEMORY_BALLOON) += balloon_compaction.o
>  obj-$(CONFIG_PAGE_EXTENSION) += page_ext.o
>  obj-$(CONFIG_CMA_DEBUGFS) += cma_debug.o
> +obj-$(CONFIG_PTDUMP_CORE) += ptdump.o
>  obj-$(CONFIG_USERFAULTFD) += userfaultfd.o
>  obj-$(CONFIG_IDLE_PAGE_TRACKING) += page_idle.o
>  obj-$(CONFIG_FRAME_VECTOR) += frame_vector.o
> --- /dev/null
> +++ a/mm/ptdump.c
> @@ -0,0 +1,151 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <linux/pagewalk.h>
> +#include <linux/ptdump.h>
> +#include <linux/kasan.h>
> +
> +static int ptdump_pgd_entry(pgd_t *pgd, unsigned long addr,
> +			    unsigned long next, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +	pgd_t val = READ_ONCE(*pgd);
> +
> +	if (pgd_leaf(val))
> +		st->note_page(st, addr, 1, pgd_val(val));
> +
> +	return 0;
> +}
> +
> +static int ptdump_p4d_entry(p4d_t *p4d, unsigned long addr,
> +			    unsigned long next, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +	p4d_t val = READ_ONCE(*p4d);
> +
> +	if (p4d_leaf(val))
> +		st->note_page(st, addr, 2, p4d_val(val));
> +
> +	return 0;
> +}
> +
> +static int ptdump_pud_entry(pud_t *pud, unsigned long addr,
> +			    unsigned long next, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +	pud_t val = READ_ONCE(*pud);
> +
> +	if (pud_leaf(val))
> +		st->note_page(st, addr, 3, pud_val(val));
> +
> +	return 0;
> +}
> +
> +static int ptdump_pmd_entry(pmd_t *pmd, unsigned long addr,
> +			    unsigned long next, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +	pmd_t val = READ_ONCE(*pmd);
> +
> +	if (pmd_leaf(val))
> +		st->note_page(st, addr, 4, pmd_val(val));
> +
> +	return 0;
> +}
> +
> +static int ptdump_pte_entry(pte_t *pte, unsigned long addr,
> +			    unsigned long next, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +
> +	st->note_page(st, addr, 5, pte_val(READ_ONCE(*pte)));
> +
> +	return 0;
> +}
> +
> +#ifdef CONFIG_KASAN
> +/*
> + * This is an optimization for KASAN=y case. Since all kasan page tables
> + * eventually point to the kasan_early_shadow_page we could call note_page()
> + * right away without walking through lower level page tables. This saves
> + * us dozens of seconds (minutes for 5-level config) while checking for
> + * W+X mapping or reading kernel_page_tables debugfs file.
> + */
> +static inline int note_kasan_page_table(struct mm_walk *walk,
> +					unsigned long addr)
> +{
> +	struct ptdump_state *st = walk->private;
> +
> +	st->note_page(st, addr, 5, pte_val(kasan_early_shadow_pte[0]));
> +	return 1;
> +}
> +
> +static int ptdump_test_p4d(unsigned long addr, unsigned long next,
> +			   p4d_t *p4d, struct mm_walk *walk)
> +{
> +#if CONFIG_PGTABLE_LEVELS > 4
> +	if (p4d == lm_alias(kasan_early_shadow_p4d))
> +		return note_kasan_page_table(walk, addr);
> +#endif
> +	return 0;
> +}
> +
> +static int ptdump_test_pud(unsigned long addr, unsigned long next,
> +			   pud_t *pud, struct mm_walk *walk)
> +{
> +#if CONFIG_PGTABLE_LEVELS > 3
> +	if (pud == lm_alias(kasan_early_shadow_pud))
> +		return note_kasan_page_table(walk, addr);
> +#endif
> +	return 0;
> +}
> +
> +static int ptdump_test_pmd(unsigned long addr, unsigned long next,
> +			   pmd_t *pmd, struct mm_walk *walk)
> +{
> +#if CONFIG_PGTABLE_LEVELS > 2
> +	if (pmd == lm_alias(kasan_early_shadow_pmd))
> +		return note_kasan_page_table(walk, addr);
> +#endif
> +	return 0;
> +}
> +#endif /* CONFIG_KASAN */
> +
> +static int ptdump_hole(unsigned long addr, unsigned long next,
> +		       int depth, struct mm_walk *walk)
> +{
> +	struct ptdump_state *st = walk->private;
> +
> +	st->note_page(st, addr, depth + 1, 0);
> +
> +	return 0;
> +}
> +
> +static const struct mm_walk_ops ptdump_ops = {
> +	.pgd_entry	= ptdump_pgd_entry,
> +	.p4d_entry	= ptdump_p4d_entry,
> +	.pud_entry	= ptdump_pud_entry,
> +	.pmd_entry	= ptdump_pmd_entry,
> +	.pte_entry	= ptdump_pte_entry,
> +#ifdef CONFIG_KASAN
> +	.test_p4d	= ptdump_test_p4d,
> +	.test_pud	= ptdump_test_pud,
> +	.test_pmd	= ptdump_test_pmd,
> +#endif
> +	.pte_hole	= ptdump_hole,
> +};
> +
> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm)
> +{
> +	const struct ptdump_range *range = st->range;
> +
> +	down_read(&mm->mmap_sem);
> +	while (range->start != range->end) {
> +		walk_page_range_novma(mm, range->start, range->end,
> +				      &ptdump_ops, st);
> +		range++;
> +	}
> +	up_read(&mm->mmap_sem);
> +
> +	/* Flush out the last page */
> +	st->note_page(st, 0, 0, 0);
> +}
> _
> 

On linux-next, booting a simple QEMU x86-64 guest (since I updated from
pre-v5.4 base), I get:

[    1.231285] BUG: kernel NULL pointer dereference, address: 0000000000000018
[    1.231897] #PF: supervisor read access in kernel mode
[    1.232354] #PF: error_code(0x0000) - not-present page
[    1.232803] PGD 0 P4D 0 
[    1.233033] Oops: 0000 [#1] SMP NOPTI
[    1.233359] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.4.0-next-20191203+ #29
[    1.233998] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4
[    1.235015] RIP: 0010:__lock_acquire+0x778/0x1940
[    1.235428] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7
[    1.237051] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002
[    1.237512] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
[    1.238147] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
[    1.238765] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000
[    1.239395] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[    1.240012] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[    1.240626] FS:  0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000
[    1.241316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.241808] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0
[    1.242407] Call Trace:
[    1.242626]  ? check_usage_backwards+0x99/0x140
[    1.243023]  ? stack_trace_save+0x4b/0x70
[    1.243385]  lock_acquire+0xa2/0x1b0
[    1.243707]  ? __walk_page_range+0x6e5/0xa00
[    1.244104]  _raw_spin_lock+0x2c/0x40
[    1.244431]  ? __walk_page_range+0x6e5/0xa00
[    1.244817]  __walk_page_range+0x6e5/0xa00
[    1.245184]  walk_page_range_novma+0x69/0xb0
[    1.245562]  ptdump_walk_pgd+0x46/0x80
[    1.245904]  ptdump_walk_pgd_level_core+0xb7/0xe0
[    1.246318]  ? ptdump_walk_pgd_level_core+0xe0/0xe0
[    1.246748]  ? rest_init+0x23a/0x23a
[    1.247076]  ? rest_init+0x23a/0x23a
[    1.247392]  kernel_init+0x2c/0x106
[    1.247700]  ret_from_fork+0x27/0x50
[    1.248025] Modules linked in:
[    1.248298] CR2: 0000000000000018
[    1.248594] ---[ end trace d9ad45dca0b4f3a3 ]---
[    1.249020] RIP: 0010:__lock_acquire+0x778/0x1940
[    1.249432] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7
[    1.251059] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002
[    1.251514] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
[    1.252153] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
[    1.252773] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000
[    1.253396] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[    1.254026] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[    1.254648] FS:  0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000
[    1.255360] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.255867] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0
[    1.256491] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:38
[    1.257268] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
[    1.257952] INFO: lockdep is turned off.
[    1.258299] irq event stamp: 1570043
[    1.258617] hardirqs last  enabled at (1570043): [<ffffffff9716dd2c>] console_unlock+0x45c/0x5c0
[    1.259386] hardirqs last disabled at (1570042): [<ffffffff9716d964>] console_unlock+0x94/0x5c0
[    1.260153] softirqs last  enabled at (1570040): [<ffffffff97e0035d>] __do_softirq+0x35d/0x45d
[    1.260898] softirqs last disabled at (1570033): [<ffffffff970efe54>] irq_exit+0xf4/0x100
[    1.261615] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G      D           5.4.0-next-20191203+ #29
[    1.262370] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4
[    1.263372] Call Trace:
[    1.263595]  dump_stack+0x8f/0xd0
[    1.263895]  ___might_sleep.cold+0xb3/0xc3
[    1.264246]  exit_signals+0x30/0x2d0
[    1.264552]  do_exit+0xb4/0xc40
[    1.264832]  rewind_stack_do_exit+0x17/0x20
[    1.265198] note: swapper/0[1] exited with preempt_count 1
[    1.265700] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[    1.266443] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbff)
[    1.267394] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---

Related to this?

-- 
Thanks,

David / dhildenb