lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1572896147.5937.116.camel@lca.pw>
Date:   Mon, 04 Nov 2019 14:35:47 -0500
From:   Qian Cai <cai@....pw>
To:     Steven Price <steven.price@....com>,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org
Cc:     Andy Lutomirski <luto@...nel.org>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Arnd Bergmann <arnd@...db.de>, Borislav Petkov <bp@...en8.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        James Morse <james.morse@....com>,
        Jérôme Glisse <jglisse@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Will Deacon <will@...nel.org>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Mark Rutland <Mark.Rutland@....com>,
        "Liang, Kan" <kan.liang@...ux.intel.com>
Subject: Re: [PATCH v15 00/23] Generic page walk and ptdump

On Fri, 2019-11-01 at 14:09 +0000, Steven Price wrote:
> Many architectures current have a debugfs file for dumping the kernel
> page tables. Currently each architecture has to implement custom
> functions for this because the details of walking the page tables used
> by the kernel are different between architectures.
> 
> This series extends the capabilities of walk_page_range() so that it can
> deal with the page tables of the kernel (which have no VMAs and can
> contain larger huge pages than exist for user space). A generic PTDUMP
> implementation is the implemented making use of the new functionality of
> walk_page_range() and finally arm64 and x86 are switch to using it,
> removing the custom table walkers.
> 
> To enable a generic page table walker to walk the unusual mappings of
> the kernel we need to implement a set of functions which let us know
> when the walker has reached the leaf entry. After a suggestion from Will
> Deacon I've chosen the name p?d_leaf() as this (hopefully) describes
> the purpose (and is a new name so has no historic baggage). Some
> architectures have p?d_large macros but this is easily confused with
> "large pages".
> 
> This series ends with a generic PTDUMP implemention for arm64 and x86.
> 
> Mostly this is a clean up and there should be very little functional
> change. The exceptions are:
> 
> * arm64 PTDUMP debugfs now displays pages which aren't present (patch 22).
> 
> * arm64 has the ability to efficiently process KASAN pages (which
>   previously only x86 implemented). This means that the combination of
>   KASAN and DEBUG_WX is now useable.
> 
> Also available as a git tree:
> git://linux-arm.org/linux-sp.git walk_page_range/v15
> 
> Changes since v14:
> https://lore.kernel.org/lkml/20191028135910.33253-1-steven.price@arm.com/
>  * Switch walk_page_range() into two functions, the existing
>    walk_page_range() now still requires VMAs (and treats areas without a
>    VMA as a 'hole'). The new walk_page_range_novma() ignores VMAs and
>    will report the actual page table layout. This fixes the previous
>    breakage of /proc/<pid>/pagemap
>  * New patch at the end of the series which reduces the 'level' numbers
>    by 1 to simplify the code slightly
>  * Added tags

Does this new version also take care of this boot crash seen with v14? Suppose
it is now breaking CONFIG_EFI_PGT_DUMP=y? The full config is,

https://raw.githubusercontent.com/cailca/linux-mm/master/x86.config

[   10.550313][    T0] Switched APIC routing to physical flat.
[   10.563899][    T0] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[   10.614633][    T0] clocksource: tsc-early: mask: 0xffffffffffffffff
max_cycles: 0x1fa6f481074, max_idle_ns: 440795311917 ns
[   10.625979][    T0] Calibrating delay loop (skipped), value calculated using
timer frequency.. 4391.73 BogoMIPS (lpj=21958690)
[   10.635990][    T0] pid_max: default: 131072 minimum: 1024
[   11.259736][    T0] ---[ User Space ]---
[   11.263737][    T0] 0x0000000000000000-
0x0000000000001000           4K     RW                     x  pte
[   11.266028][    T0] 0x0000000000001000-
0x0000000000200000        2044K                               pte
[   11.275992][    T0] 0x0000000000200000-
0x0000000004000000          62M                               pmd
[   11.285998][    T0] 0x0000000004000000-
0x0000000004076000         472K                               pte
[   11.296019][    T0] 0x0000000004076000-
0x0000000004200000        1576K                               pte
[   11.305997][    T0] 0x0000000004200000-
0x0000000011000000         206M                               pmd
[   11.316008][    T0] 0x0000000011000000-
0x0000000011100000           1M                               pte
[   11.326008][    T0] 0x0000000011100000-
0x0000000011200000           1M                               pte
[   11.335990][    T0] 0x0000000011200000-
0x0000000011800000           6M                               pmd
[   11.346054][    T0]
==================================================================
[   11.354074][    T0] BUG: KASAN: wild-memory-access in
ptdump_pte_entry+0x39/0x60
[   11.355975][    T0] Read of size 8 at addr 000f887fee5ff000 by task
swapper/0/0
[   11.355975][    T0] 
[   11.355975][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc5-mm1+
#1
[   11.355975][    T0] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385
Gen10, BIOS A40 07/10/2019
[   11.355975][    T0] Call Trace:
[   11.355975][    T0]  dump_stack+0xa0/0xea
[   11.355975][    T0]  __kasan_report.cold.7+0xb0/0xc0
[   11.355975][    T0]  ? note_page+0x7f8/0xa70
[   11.355975][    T0]  ? ptdump_pte_entry+0x39/0x60
[   11.355975][    T0]  ? ptdump_walk_pgd_level_core+0x1b0/0x1b0
[   11.355975][    T0]  kasan_report+0x12/0x20
[   11.355975][    T0]  __asan_load8+0x71/0xa0
[   11.355975][    T0]  ptdump_pte_entry+0x39/0x60
[   11.355975][    T0]  walk_pgd_range+0xb75/0xce0
[   11.355975][    T0]  __walk_page_range+0x206/0x230
[   11.355975][    T0]  ? vmacache_find+0x3a/0x170
[   11.355975][    T0]  walk_page_range+0x136/0x210
[   11.355975][    T0]  ? __walk_page_range+0x230/0x230
[   11.355975][    T0]  ? find_held_lock+0xca/0xf0
[   11.355975][    T0]  ptdump_walk_pgd+0x76/0xd0
[   11.355975][    T0]  ptdump_walk_pgd_level_core+0x13b/0x1b0
[   11.355975][    T0]  ? hugetlb_get_unmapped_area+0x5b0/0x5b0
[   11.355975][    T0]  ? trace_hardirqs_on+0x3a/0x160
[   11.355975][    T0]  ? ptdump_walk_pgd_level_core+0x1b0/0x1b0
[   11.355975][    T0]  ? efi_delete_dummy_variable+0xa9/0xd0
[   11.355975][    T0]  ? __enc_copy+0x90/0x90
[   11.355975][    T0]  ptdump_walk_pgd_level+0x15/0x20
[   11.355975][    T0]  efi_dump_pagetable+0x35/0x37
[   11.355975][    T0]  efi_enter_virtual_mode+0x72a/0x737
[   11.355975][    T0]  start_kernel+0x607/0x6a9
[   11.355975][    T0]  ? thread_stack_cache_init+0xb/0xb
[   11.355975][    T0]  ? idt_setup_from_table+0xd9/0x130
[   11.355975][    T0]  x86_64_start_reservations+0x24/0x26
[   11.355975][    T0]  x86_64_start_kernel+0xf4/0xfb
[   11.355975][    T0]  secondary_startup_64+0xb6/0xc0
[   11.355975][    T0]
==================================================================
[   11.355975][    T0] Disabling lock debugging due to kernel taint
[   11.355991][    T0] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
KASAN NOPTI
[   11.364049][    T0] CPU: 0 PID: 0 Comm: swapper/0 Tainted:
G    B             5.4.0-rc5-mm1+ #1
[   11.365975][    T0] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385
Gen10, BIOS A40 07/10/2019
[   11.365975][    T0] RIP: 0010:ptdump_pte_entry+0x39/0x60
[   11.365975][    T0] Code: 55 41 54 49 89 fc 48 8d 79 18 53 48 89 cb e8 5e 0e
fa ff 48 8b 5b 18 48 89 df e8 52 0e fa ff 4c 89 e7 4c 8b 2b e8 47 0e fa ff <49>
8b 0c 24 4c 89 f6 48 89 df ba 05 00 00 00 e8 03 1d 9b 00 31 c0
[   11.365975][    T0] RSP: 0000:ffffffffaf8079d0 EFLAGS: 00010282
[   11.365975][    T0] RAX: 0000000000000000 RBX: ffffffffaf807cf0 RCX:
ffffffffae374306
[   11.365975][    T0] RDX: 0000000000000007 RSI: dffffc0000000000 RDI:
ffffffffafef2bf4
[   11.365975][    T0] RBP: ffffffffaf8079f0 R08: fffffbfff5fdbb22 R09:
fffffbfff5fdbb22
[   11.365975][    T0] R10: fffffbfff5fdbb21 R11: ffffffffafedd90b R12:
000f887fee5ff000
[   11.365975][    T0] R13: ffffffffae2aee40 R14: 0000000011a00000 R15:
0000000011a01000
[   11.365975][    T0] FS:  0000000000000000(0000) GS:ffff888843400000(0000)
knlGS:0000000000000000
[   11.365975][    T0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   11.365975][    T0] CR2: ffff8890779ff000 CR3: 0000000baf412000 CR4:
00000000000406b0
[   11.365975][    T0] Call Trace:
[   11.365975][    T0]  walk_pgd_range+0xb75/0xce0
[   11.365975][    T0]  __walk_page_range+0x206/0x230
[   11.365975][    T0]  ? vmacache_find+0x3a/0x170
[   11.365975][    T0]  walk_page_range+0x136/0x210
[   11.365975][    T0]  ? __walk_page_range+0x230/0x230
[   11.365975][    T0]  ? find_held_lock+0xca/0xf0
[   11.365975][    T0]  ptdump_walk_pgd+0x76/0xd0
[   11.365975][    T0]  ptdump_walk_pgd_level_core+0x13b/0x1b0
[   11.365975][    T0]  ? hugetlb_get_unmapped_area+0x5b0/0x5b0
[   11.365975][    T0]  ? trace_hardirqs_on+0x3a/0x160
[   11.365975][    T0]  ? ptdump_walk_pgd_level_core+0x1b0/0x1b0
[   11.365975][    T0]  ? efi_delete_dummy_variable+0xa9/0xd0
[   11.365975][    T0]  ? __enc_copy+0x90/0x90
[   11.365975][    T0]  ptdump_walk_pgd_level+0x15/0x20
[   11.365975][    T0]  efi_dump_pagetable+0x35/0x37
[   11.365975][    T0]  efi_enter_virtual_mode+0x72a/0x737
[   11.365975][    T0]  start_kernel+0x607/0x6a9
[   11.365975][    T0]  ? thread_stack_cache_init+0xb/0xb
[   11.365975][    T0]  ? idt_setup_from_table+0xd9/0x130
[   11.365975][    T0]  x86_64_start_reservations+0x24/0x26
[   11.365975][    T0]  x86_64_start_kernel+0xf4/0xfb
[   11.365975][    T0]  secondary_startup_64+0xb6/0xc0
[   11.365975][    T0] Modules linked in:
[   11.365988][    T0] ---[ end trace 8e90dc89e2468d55 ]---
[   11.375984][    T0] RIP: 0010:ptdump_pte_entry+0x39/0x60
[   11.381335][    T0] Code: 55 41 54 49 89 fc 48 8d 79 18 53 48 89 cb e8 5e 0e
fa ff 48 8b 5b 18 48 89 df e8 52 0e fa ff 4c 89 e7 4c 8b 2b e8 47 0e fa ff <49>
8b 0c 24 4c 89 f6 48 89 df ba 05 00 00 00 e8 03 1d 9b 00 31 c0
[   11.385982][    T0] RSP: 0000:ffffffffaf8079d0 EFLAGS: 00010282
[   11.395982][    T0] RAX: 0000000000000000 RBX: ffffffffaf807cf0 RCX:
ffffffffae374306
[   11.403864][    T0] RDX: 0000000000000007 RSI: dffffc0000000000 RDI:
ffffffffafef2bf4
[   11.405982][    T0] RBP: ffffffffaf8079f0 R08: fffffbfff5fdbb22 R09:
fffffbfff5fdbb22
[   11.415982][    T0] R10: fffffbfff5fdbb21 R11: ffffffffafedd90b R12:
000f887fee5ff000
[   11.425982][    T0] R13: ffffffffae2aee40 R14: 0000000011a00000 R15:
0000000011a01000
[   11.435982][    T0] FS:  0000000000000000(0000) GS:ffff888843400000(0000)
knlGS:0000000000000000
[   11.445982][    T0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   11.452466][    T0] CR2: ffff8890779ff000 CR3: 0000000baf412000 CR4:
00000000000406b0
[   11.455981][    T0] Kernel panic - not syncing: Fatal exception
[   11.462246][    T0] ---[ end Kernel panic - not syncing: Fatal exception ]---

> 
> Changes since v13:
> https://lore.kernel.org/lkml/20191024093716.49420-1-steven.price@arm.com/
>  * Fixed typo in arc definition of pmd_leaf() spotted by the kbuild test
>    robot
>  * Added tags
> 
> Changes since v12:
> https://lore.kernel.org/lkml/20191018101248.33727-1-steven.price@arm.com/
>  * Correct code format in riscv pud_leaf()/pmd_leaf()
>  * v12 may not have reached everyone because of mail server problems
>    (which are now hopefully resolved!)
> 
> Changes since v11:
> https://lore.kernel.org/lkml/20191007153822.16518-1-steven.price@arm.com/
>  * Use "-1" as dummy depth parameter in patch 14.
> 
> Changes since v10:
> https://lore.kernel.org/lkml/20190731154603.41797-1-steven.price@arm.com/
>  * Rebased to v5.4-rc1 - mainly various updates to deal with the
>    splitting out of ops from struct mm_walk.
>  * Deal with PGD_LEVEL_MULT not always being constant on x86.
> 
> Changes since v9:
> https://lore.kernel.org/lkml/20190722154210.42799-1-steven.price@arm.com/
>  * Moved generic macros to first page in the series and explained the
>    macro naming in the commit message.
>  * mips: Moved macros to pgtable.h as they are now valid for both 32 and 64
>    bit
>  * x86: Dropped patch which changed the debugfs output for x86, instead
>    we have...
>  * new patch adding 'depth' parameter to pte_hole. This is used to
>    provide the necessary information to output lines for 'holes' in the
>    debugfs files
>  * new patch changing arm64 debugfs output to include holes to match x86
>  * generic ptdump KASAN handling has been simplified and now works with
>    CONFIG_DEBUG_VIRTUAL.
> 
> Changes since v8:
> https://lore.kernel.org/lkml/20190403141627.11664-1-steven.price@arm.com/
>  * Rename from p?d_large() to p?d_leaf()
>  * Dropped patches migrating arm64/x86 custom walkers to
>    walk_page_range() in favour of adding a generic PTDUMP implementation
>    and migrating arm64/x86 to that instead.
>  * Rebased to v5.3-rc1
> 
> Steven Price (23):
>   mm: Add generic p?d_leaf() macros
>   arc: mm: Add p?d_leaf() definitions
>   arm: mm: Add p?d_leaf() definitions
>   arm64: mm: Add p?d_leaf() definitions
>   mips: mm: Add p?d_leaf() definitions
>   powerpc: mm: Add p?d_leaf() definitions
>   riscv: mm: Add p?d_leaf() definitions
>   s390: mm: Add p?d_leaf() definitions
>   sparc: mm: Add p?d_leaf() definitions
>   x86: mm: Add p?d_leaf() definitions
>   mm: pagewalk: Add p4d_entry() and pgd_entry()
>   mm: pagewalk: Allow walking without vma
>   mm: pagewalk: Add test_p?d callbacks
>   mm: pagewalk: Add 'depth' parameter to pte_hole
>   x86: mm: Point to struct seq_file from struct pg_state
>   x86: mm+efi: Convert ptdump_walk_pgd_level() to take a mm_struct
>   x86: mm: Convert ptdump_walk_pgd_level_debugfs() to take an mm_struct
>   x86: mm: Convert ptdump_walk_pgd_level_core() to take an mm_struct
>   mm: Add generic ptdump
>   x86: mm: Convert dump_pagetables to use walk_page_range
>   arm64: mm: Convert mm/dump.c to use walk_page_range()
>   arm64: mm: Display non-present entries in ptdump
>   mm: ptdump: Reduce level numbers by 1 in note_page()
> 
>  arch/arc/include/asm/pgtable.h               |   1 +
>  arch/arm/include/asm/pgtable-2level.h        |   1 +
>  arch/arm/include/asm/pgtable-3level.h        |   1 +
>  arch/arm64/Kconfig                           |   1 +
>  arch/arm64/Kconfig.debug                     |  19 +-
>  arch/arm64/include/asm/pgtable.h             |   2 +
>  arch/arm64/include/asm/ptdump.h              |   8 +-
>  arch/arm64/mm/Makefile                       |   4 +-
>  arch/arm64/mm/dump.c                         | 148 +++-----
>  arch/arm64/mm/mmu.c                          |   4 +-
>  arch/arm64/mm/ptdump_debugfs.c               |   2 +-
>  arch/mips/include/asm/pgtable.h              |   5 +
>  arch/powerpc/include/asm/book3s/64/pgtable.h |  30 +-
>  arch/riscv/include/asm/pgtable-64.h          |   7 +
>  arch/riscv/include/asm/pgtable.h             |   7 +
>  arch/s390/include/asm/pgtable.h              |   2 +
>  arch/sparc/include/asm/pgtable_64.h          |   2 +
>  arch/x86/Kconfig                             |   1 +
>  arch/x86/Kconfig.debug                       |  20 +-
>  arch/x86/include/asm/pgtable.h               |  10 +-
>  arch/x86/mm/Makefile                         |   4 +-
>  arch/x86/mm/debug_pagetables.c               |   8 +-
>  arch/x86/mm/dump_pagetables.c                | 343 +++++--------------
>  arch/x86/platform/efi/efi_32.c               |   2 +-
>  arch/x86/platform/efi/efi_64.c               |   4 +-
>  drivers/firmware/efi/arm-runtime.c           |   2 +-
>  fs/proc/task_mmu.c                           |   4 +-
>  include/asm-generic/pgtable.h                |  20 ++
>  include/linux/pagewalk.h                     |  42 ++-
>  include/linux/ptdump.h                       |  22 ++
>  mm/Kconfig.debug                             |  21 ++
>  mm/Makefile                                  |   1 +
>  mm/hmm.c                                     |   8 +-
>  mm/migrate.c                                 |   5 +-
>  mm/mincore.c                                 |   1 +
>  mm/pagewalk.c                                | 126 +++++--
>  mm/ptdump.c                                  | 151 ++++++++
>  37 files changed, 586 insertions(+), 453 deletions(-)
>  create mode 100644 include/linux/ptdump.h
>  create mode 100644 mm/ptdump.c
> 

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ