From: David Hildenbrand <david@redhat.com>
To: akpm@linux-foundation.org, alex@ghiti.fr, aou@eecs.berkeley.edu,
ard.biesheuvel@linaro.org, arnd@arndb.de,
aryabinin@virtuozzo.com, benh@kernel.crashing.org,
borntraeger@de.ibm.com, bp@alien8.de, cai@lca.pw,
catalin.marinas@arm.com, dave.hansen@linux.intel.com,
dave.jiang@intel.com, davem@davemloft.net, dvyukov@google.com,
glider@google.com, gor@linux.ibm.com, heiko.carstens@de.ibm.com,
hpa@zytor.com, james.morse@arm.com, jhogan@kernel.org,
kan.liang@linux.intel.com, linux-mm@kvack.org,
linux@armlinux.org.uk, luto@kernel.org, mark.rutland@arm.com,
mawilcox@microsoft.com, mingo@elte.hu,
mm-commits@vger.kernel.org, mpe@ellerman.id.au,
n-horiguchi@ah.jp.nec.com, palmer@sifive.com,
paul.burton@mips.com, paul.walmsley@sifive.com, paulus@samba.org,
peterz@infradead.org, ralf@linux-mips.org,
shashim@codeaurora.org, steven.price@arm.com, tglx@linutronix.de,
torvalds@linux-foundation.org, vgupta@synopsys.com,
will@kernel.org, zong.li@sifive.com
Subject: Re: [patch 064/158] mm: add generic ptdump
Date: Tue, 3 Dec 2019 12:00:47 +0100 [thread overview]
Message-ID: <b7ce62f2-9a48-6e48-6685-003431e521aa@redhat.com> (raw)
In-Reply-To: <6d6b02db-525c-1729-c5cf-25bda83763c7@redhat.com>
On 03.12.19 11:47, David Hildenbrand wrote:
> On 01.12.19 02:53, akpm@linux-foundation.org wrote:
>> From: Steven Price <steven.price@arm.com>
>> Subject: mm: add generic ptdump
>>
>> Add a generic version of page table dumping that architectures can opt-in
>> to
>>
>> [steven.price@arm.com: v15]
>> Link: http://lkml.kernel.org/r/20191101140942.51554-20-steven.price@arm.com
>> [cai@lca.pw: fix a -Wold-style-declaration warning]
>> Link: http://lkml.kernel.org/r/1572895385-29194-1-git-send-email-cai@lca.pw
>> Link: http://lkml.kernel.org/r/20191028135910.33253-20-steven.price@arm.com
>> Signed-off-by: Steven Price <steven.price@arm.com>
>> Signed-off-by: Qian Cai <cai@lca.pw>
>> Cc: Albert Ou <aou@eecs.berkeley.edu>
>> Cc: Alexander Potapenko <glider@google.com>
>> Cc: Alexandre Ghiti <alex@ghiti.fr>
>> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
>> Cc: Andy Lutomirski <luto@kernel.org>
>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Cc: Arnd Bergmann <arnd@arndb.de>
>> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>> Cc: Christian Borntraeger <borntraeger@de.ibm.com>
>> Cc: Dave Hansen <dave.hansen@linux.intel.com>
>> Cc: Dave Jiang <dave.jiang@intel.com>
>> Cc: David S. Miller <davem@davemloft.net>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Ingo Molnar <mingo@elte.hu>
>> Cc: James Hogan <jhogan@kernel.org>
>> Cc: James Morse <james.morse@arm.com>
>> Cc: "Liang, Kan" <kan.liang@linux.intel.com>
>> Cc: Mark Rutland <mark.rutland@arm.com>
>> Cc: Matthew Wilcox <mawilcox@microsoft.com>
>> Cc: Michael Ellerman <mpe@ellerman.id.au>
>> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
>> Cc: Palmer Dabbelt <palmer@sifive.com>
>> Cc: Paul Burton <paul.burton@mips.com>
>> Cc: Paul Mackerras <paulus@samba.org>
>> Cc: Paul Walmsley <paul.walmsley@sifive.com>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> Cc: Ralf Baechle <ralf@linux-mips.org>
>> Cc: Russell King <linux@armlinux.org.uk>
>> Cc: Shiraz Hashim <shashim@codeaurora.org>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Vasily Gorbik <gor@linux.ibm.com>
>> Cc: Vineet Gupta <vgupta@synopsys.com>
>> Cc: Will Deacon <will@kernel.org>
>> Cc: Zong Li <zong.li@sifive.com>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> ---
>>
>> include/linux/ptdump.h | 21 +++++
>> mm/Kconfig.debug | 21 +++++
>> mm/Makefile | 1
>> mm/ptdump.c | 151 +++++++++++++++++++++++++++++++++++++++
>> 4 files changed, 194 insertions(+)
>>
>> --- /dev/null
>> +++ a/include/linux/ptdump.h
>> @@ -0,0 +1,21 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +
>> +#ifndef _LINUX_PTDUMP_H
>> +#define _LINUX_PTDUMP_H
>> +
>> +#include <linux/mm_types.h>
>> +
>> +struct ptdump_range {
>> + unsigned long start;
>> + unsigned long end;
>> +};
>> +
>> +struct ptdump_state {
>> + void (*note_page)(struct ptdump_state *st, unsigned long addr,
>> + int level, unsigned long val);
>> + const struct ptdump_range *range;
>> +};
>> +
>> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm);
>> +
>> +#endif /* _LINUX_PTDUMP_H */
>> --- a/mm/Kconfig.debug~mm-add-generic-ptdump
>> +++ a/mm/Kconfig.debug
>> @@ -117,3 +117,24 @@ config DEBUG_RODATA_TEST
>> depends on STRICT_KERNEL_RWX
>> ---help---
>> This option enables a testcase for the setting rodata read-only.
>> +
>> +config GENERIC_PTDUMP
>> + bool
>> +
>> +config PTDUMP_CORE
>> + bool
>> +
>> +config PTDUMP_DEBUGFS
>> + bool "Export kernel pagetable layout to userspace via debugfs"
>> + depends on DEBUG_KERNEL
>> + depends on DEBUG_FS
>> + depends on GENERIC_PTDUMP
>> + select PTDUMP_CORE
>> + help
>> + Say Y here if you want to show the kernel pagetable layout in a
>> + debugfs file. This information is only useful for kernel developers
>> + who are working in architecture specific areas of the kernel.
>> + It is probably not a good idea to enable this feature in a production
>> + kernel.
>> +
>> + If in doubt, say N.
>> --- a/mm/Makefile~mm-add-generic-ptdump
>> +++ a/mm/Makefile
>> @@ -98,6 +98,7 @@ obj-$(CONFIG_CMA) += cma.o
>> obj-$(CONFIG_MEMORY_BALLOON) += balloon_compaction.o
>> obj-$(CONFIG_PAGE_EXTENSION) += page_ext.o
>> obj-$(CONFIG_CMA_DEBUGFS) += cma_debug.o
>> +obj-$(CONFIG_PTDUMP_CORE) += ptdump.o
>> obj-$(CONFIG_USERFAULTFD) += userfaultfd.o
>> obj-$(CONFIG_IDLE_PAGE_TRACKING) += page_idle.o
>> obj-$(CONFIG_FRAME_VECTOR) += frame_vector.o
>> --- /dev/null
>> +++ a/mm/ptdump.c
>> @@ -0,0 +1,151 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +
>> +#include <linux/pagewalk.h>
>> +#include <linux/ptdump.h>
>> +#include <linux/kasan.h>
>> +
>> +static int ptdump_pgd_entry(pgd_t *pgd, unsigned long addr,
>> + unsigned long next, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> + pgd_t val = READ_ONCE(*pgd);
>> +
>> + if (pgd_leaf(val))
>> + st->note_page(st, addr, 1, pgd_val(val));
>> +
>> + return 0;
>> +}
>> +
>> +static int ptdump_p4d_entry(p4d_t *p4d, unsigned long addr,
>> + unsigned long next, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> + p4d_t val = READ_ONCE(*p4d);
>> +
>> + if (p4d_leaf(val))
>> + st->note_page(st, addr, 2, p4d_val(val));
>> +
>> + return 0;
>> +}
>> +
>> +static int ptdump_pud_entry(pud_t *pud, unsigned long addr,
>> + unsigned long next, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> + pud_t val = READ_ONCE(*pud);
>> +
>> + if (pud_leaf(val))
>> + st->note_page(st, addr, 3, pud_val(val));
>> +
>> + return 0;
>> +}
>> +
>> +static int ptdump_pmd_entry(pmd_t *pmd, unsigned long addr,
>> + unsigned long next, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> + pmd_t val = READ_ONCE(*pmd);
>> +
>> + if (pmd_leaf(val))
>> + st->note_page(st, addr, 4, pmd_val(val));
>> +
>> + return 0;
>> +}
>> +
>> +static int ptdump_pte_entry(pte_t *pte, unsigned long addr,
>> + unsigned long next, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> +
>> + st->note_page(st, addr, 5, pte_val(READ_ONCE(*pte)));
>> +
>> + return 0;
>> +}
>> +
>> +#ifdef CONFIG_KASAN
>> +/*
>> + * This is an optimization for KASAN=y case. Since all kasan page tables
>> + * eventually point to the kasan_early_shadow_page we could call note_page()
>> + * right away without walking through lower level page tables. This saves
>> + * us dozens of seconds (minutes for 5-level config) while checking for
>> + * W+X mapping or reading kernel_page_tables debugfs file.
>> + */
>> +static inline int note_kasan_page_table(struct mm_walk *walk,
>> + unsigned long addr)
>> +{
>> + struct ptdump_state *st = walk->private;
>> +
>> + st->note_page(st, addr, 5, pte_val(kasan_early_shadow_pte[0]));
>> + return 1;
>> +}
>> +
>> +static int ptdump_test_p4d(unsigned long addr, unsigned long next,
>> + p4d_t *p4d, struct mm_walk *walk)
>> +{
>> +#if CONFIG_PGTABLE_LEVELS > 4
>> + if (p4d == lm_alias(kasan_early_shadow_p4d))
>> + return note_kasan_page_table(walk, addr);
>> +#endif
>> + return 0;
>> +}
>> +
>> +static int ptdump_test_pud(unsigned long addr, unsigned long next,
>> + pud_t *pud, struct mm_walk *walk)
>> +{
>> +#if CONFIG_PGTABLE_LEVELS > 3
>> + if (pud == lm_alias(kasan_early_shadow_pud))
>> + return note_kasan_page_table(walk, addr);
>> +#endif
>> + return 0;
>> +}
>> +
>> +static int ptdump_test_pmd(unsigned long addr, unsigned long next,
>> + pmd_t *pmd, struct mm_walk *walk)
>> +{
>> +#if CONFIG_PGTABLE_LEVELS > 2
>> + if (pmd == lm_alias(kasan_early_shadow_pmd))
>> + return note_kasan_page_table(walk, addr);
>> +#endif
>> + return 0;
>> +}
>> +#endif /* CONFIG_KASAN */
>> +
>> +static int ptdump_hole(unsigned long addr, unsigned long next,
>> + int depth, struct mm_walk *walk)
>> +{
>> + struct ptdump_state *st = walk->private;
>> +
>> + st->note_page(st, addr, depth + 1, 0);
>> +
>> + return 0;
>> +}
>> +
>> +static const struct mm_walk_ops ptdump_ops = {
>> + .pgd_entry = ptdump_pgd_entry,
>> + .p4d_entry = ptdump_p4d_entry,
>> + .pud_entry = ptdump_pud_entry,
>> + .pmd_entry = ptdump_pmd_entry,
>> + .pte_entry = ptdump_pte_entry,
>> +#ifdef CONFIG_KASAN
>> + .test_p4d = ptdump_test_p4d,
>> + .test_pud = ptdump_test_pud,
>> + .test_pmd = ptdump_test_pmd,
>> +#endif
>> + .pte_hole = ptdump_hole,
>> +};
>> +
>> +void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm)
>> +{
>> + const struct ptdump_range *range = st->range;
>> +
>> + down_read(&mm->mmap_sem);
>> + while (range->start != range->end) {
>> + walk_page_range_novma(mm, range->start, range->end,
>> + &ptdump_ops, st);
>> + range++;
>> + }
>> + up_read(&mm->mmap_sem);
>> +
>> + /* Flush out the last page */
>> + st->note_page(st, 0, 0, 0);
>> +}
>> _
>>
>
> On linux-next, booting a simple QEMU x86-64 guest (since I updated from
> pre-v5.4 base), I get:
>
> [ 1.231285] BUG: kernel NULL pointer dereference, address: 0000000000000018
> [ 1.231897] #PF: supervisor read access in kernel mode
> [ 1.232354] #PF: error_code(0x0000) - not-present page
> [ 1.232803] PGD 0 P4D 0
> [ 1.233033] Oops: 0000 [#1] SMP NOPTI
> [ 1.233359] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.4.0-next-20191203+ #29
> [ 1.233998] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4
> [ 1.235015] RIP: 0010:__lock_acquire+0x778/0x1940
> [ 1.235428] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7
> [ 1.237051] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002
> [ 1.237512] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
> [ 1.238147] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
> [ 1.238765] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000
> [ 1.239395] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [ 1.240012] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
> [ 1.240626] FS: 0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000
> [ 1.241316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1.241808] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0
> [ 1.242407] Call Trace:
> [ 1.242626] ? check_usage_backwards+0x99/0x140
> [ 1.243023] ? stack_trace_save+0x4b/0x70
> [ 1.243385] lock_acquire+0xa2/0x1b0
> [ 1.243707] ? __walk_page_range+0x6e5/0xa00
> [ 1.244104] _raw_spin_lock+0x2c/0x40
> [ 1.244431] ? __walk_page_range+0x6e5/0xa00
> [ 1.244817] __walk_page_range+0x6e5/0xa00
> [ 1.245184] walk_page_range_novma+0x69/0xb0
> [ 1.245562] ptdump_walk_pgd+0x46/0x80
> [ 1.245904] ptdump_walk_pgd_level_core+0xb7/0xe0
> [ 1.246318] ? ptdump_walk_pgd_level_core+0xe0/0xe0
> [ 1.246748] ? rest_init+0x23a/0x23a
> [ 1.247076] ? rest_init+0x23a/0x23a
> [ 1.247392] kernel_init+0x2c/0x106
> [ 1.247700] ret_from_fork+0x27/0x50
> [ 1.248025] Modules linked in:
> [ 1.248298] CR2: 0000000000000018
> [ 1.248594] ---[ end trace d9ad45dca0b4f3a3 ]---
> [ 1.249020] RIP: 0010:__lock_acquire+0x778/0x1940
> [ 1.249432] Code: 00 45 31 ff 48 8b 44 24 48 65 48 33 04 25 28 00 00 00 0f 85 fd 0d 00 00 48 83 c4 50 44 89 f8 5b7
> [ 1.251059] RSP: 0018:ffffbc6100637c48 EFLAGS: 00010002
> [ 1.251514] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
> [ 1.252153] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
> [ 1.252773] RBP: ffff92dd7db54d80 R08: 0000000000000001 R09: 0000000000000000
> [ 1.253396] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [ 1.254026] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
> [ 1.254648] FS: 0000000000000000(0000) GS:ffff92dd7dd00000(0000) knlGS:0000000000000000
> [ 1.255360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1.255867] CR2: 0000000000000018 CR3: 00000000a8610000 CR4: 00000000000006e0
> [ 1.256491] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:38
> [ 1.257268] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
> [ 1.257952] INFO: lockdep is turned off.
> [ 1.258299] irq event stamp: 1570043
> [ 1.258617] hardirqs last enabled at (1570043): [<ffffffff9716dd2c>] console_unlock+0x45c/0x5c0
> [ 1.259386] hardirqs last disabled at (1570042): [<ffffffff9716d964>] console_unlock+0x94/0x5c0
> [ 1.260153] softirqs last enabled at (1570040): [<ffffffff97e0035d>] __do_softirq+0x35d/0x45d
> [ 1.260898] softirqs last disabled at (1570033): [<ffffffff970efe54>] irq_exit+0xf4/0x100
> [ 1.261615] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G D 5.4.0-next-20191203+ #29
> [ 1.262370] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4
> [ 1.263372] Call Trace:
> [ 1.263595] dump_stack+0x8f/0xd0
> [ 1.263895] ___might_sleep.cold+0xb3/0xc3
> [ 1.264246] exit_signals+0x30/0x2d0
> [ 1.264552] do_exit+0xb4/0xc40
> [ 1.264832] rewind_stack_do_exit+0x17/0x20
> [ 1.265198] note: swapper/0[1] exited with preempt_count 1
> [ 1.265700] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
> [ 1.266443] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbff)
> [ 1.267394] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---
>
> Related to this?
>
I just made sure that I am actually on the latest linux-next. I do have
commit d3634da666853cdff2258a49dd3ce3607c0fd6c5
Author: Steven Price <steven.price@arm.com>
Date: Tue Nov 19 11:47:24 2019 +1100
mm-pagewalk-allow-walking-without-vma-fix
fix boot crash
Reported-by: Qian Cai <cai@lca.pw>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Problem persists. I do have a bunch of debug options enabled in my
config and can share if required.
--
Thanks,
David / dhildenb
prev parent reply other threads:[~2019-12-03 11:01 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-01 1:53 [patch 064/158] mm: add generic ptdump akpm
2019-12-01 9:07 ` Borislav Petkov
2019-12-01 14:45 ` Linus Torvalds
2019-12-01 15:10 ` Borislav Petkov
2019-12-01 15:21 ` Borislav Petkov
2019-12-01 15:45 ` Borislav Petkov
2019-12-02 9:09 ` Steven Price
2019-12-02 15:42 ` Borislav Petkov
2019-12-03 10:47 ` David Hildenbrand
2019-12-03 11:00 ` David Hildenbrand [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b7ce62f2-9a48-6e48-6685-003431e521aa@redhat.com \
--to=david@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alex@ghiti.fr \
--cc=aou@eecs.berkeley.edu \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=benh@kernel.crashing.org \
--cc=borntraeger@de.ibm.com \
--cc=bp@alien8.de \
--cc=cai@lca.pw \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=dave.jiang@intel.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=gor@linux.ibm.com \
--cc=heiko.carstens@de.ibm.com \
--cc=hpa@zytor.com \
--cc=james.morse@arm.com \
--cc=jhogan@kernel.org \
--cc=kan.liang@linux.intel.com \
--cc=linux-mm@kvack.org \
--cc=linux@armlinux.org.uk \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=mawilcox@microsoft.com \
--cc=mingo@elte.hu \
--cc=mm-commits@vger.kernel.org \
--cc=mpe@ellerman.id.au \
--cc=n-horiguchi@ah.jp.nec.com \
--cc=palmer@sifive.com \
--cc=paul.burton@mips.com \
--cc=paul.walmsley@sifive.com \
--cc=paulus@samba.org \
--cc=peterz@infradead.org \
--cc=ralf@linux-mips.org \
--cc=shashim@codeaurora.org \
--cc=steven.price@arm.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=vgupta@synopsys.com \
--cc=will@kernel.org \
--cc=zong.li@sifive.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).