core dump: re-purpose VM_ALWAYSDUMP to user controlled VM_NODUMP
Subsystems (14)
v2 cover core dump: re-purpose VM_ALWAYSDUMP to user controlled VM_NODUMP
Hi,
The motivation for this change was that I was looking at a way for a qemu-kvm process, to exclude the guest memory from its core dump, which can be quite large. There are already a number of filter flags in /proc/<pid>/coredump_filter, however, these allow one to specify 'types' of kernel memory, not specific address ranges (which is needed in this case).
Since there are no more vma flags available, the first patch eliminates the need for the 'VM_ALWAYSDUMP' flag. The flag is used internally by the kernel to mark vdso and vsyscall pages. However, it is simple enough to check if a vma covers a vdso or vsyscall page without the need for this flag.
The second patch then replaces the 'VM_ALWAYSDUMP' flag with a new 'VM_NODUMP' flag, which can be set by userspace using new madvise flags:
'MADV_NODUMP', and unset via 'MADV_CLEAR_NODUMP'. The core dump filters continue to work the same as before unless 'MADV_NODUMP' is set on the region.
The qemu code which implements this features is at:
http://people.redhat.com/~jbaron/qemu-dump/qemu-dump.patch
In my testing the qemu core dump shrunk from 383MB -> 13MB with this patch.
I also believe that the 'MADV_NODUMP' flag might be useful for security sensitive apps, which might want to select which areas are dumped.
Thanks,
-Jason
Changes from v1 to v2:
1. simplified 'always_dump_vma()' logic
2. Removed no longer necessary comments about VM_ALWAYSDUMP
3. Added more comments around these changes
4. renamed:
VM_DONTDUMP -> VM_NODUMP, MADV_DONTDUMP -> MADV_NODUMP, MADV_DUMP -> MADV_CLEAR_NODUMP
Jason Baron (2):
core dump: drop VM_ALWAYSDUMP flag
core dump: add VM_NODUMP, MADV_NODUMP, MADV_CLEAR_NODUMP
arch/arm/kernel/process.c | 2 +- arch/hexagon/kernel/vdso.c | 3 +-- arch/mips/kernel/vdso.c | 3 +-- arch/powerpc/kernel/vdso.c | 10 ++-------- arch/s390/kernel/vdso.c | 10 ++-------- arch/sh/kernel/vsyscall/vsyscall.c | 3 +-- arch/tile/mm/elf.c | 8 +------- arch/unicore32/kernel/process.c | 2 +- arch/x86/um/mem_32.c | 8 -------- arch/x86/um/vdso/vma.c | 3 +-- arch/x86/vdso/vdso32-setup.c | 17 ++--------------- arch/x86/vdso/vma.c | 3 +-- fs/binfmt_elf.c | 30 ++++++++++++++++++++++++++++-- include/asm-generic/mman-common.h | 4 ++++ include/linux/mm.h | 2 +- mm/madvise.c | 8 ++++++++ mm/memory.c | 8 +------- 17 files changed, 56 insertions(+), 68 deletions(-)
Signature · 1 line
1.7.7.6
PATCH v2 1/2 core dump: drop VM_ALWAYSDUMP flag
The VM_ALWAYSDUMP flag is currently used by the coredump code to indicate that a vma is part of a vsyscall or vdso section. However, we can determine if a vma is in one these sections by checking it against the gate_vma and checking for a non-NULL return value from arch_vma_name(). Thus, freeing a valuable vma bit.
--- arch/arm/kernel/process.c | 2 +- arch/hexagon/kernel/vdso.c | 3 +-- arch/mips/kernel/vdso.c | 3 +-- arch/powerpc/kernel/vdso.c | 10 ++-------- arch/s390/kernel/vdso.c | 10 ++-------- arch/sh/kernel/vsyscall/vsyscall.c | 3 +-- arch/tile/mm/elf.c | 8 +------- arch/unicore32/kernel/process.c | 2 +- arch/x86/um/mem_32.c | 8 -------- arch/x86/um/vdso/vma.c | 3 +-- arch/x86/vdso/vdso32-setup.c | 17 ++--------------- arch/x86/vdso/vma.c | 3 +-- fs/binfmt_elf.c | 27 +++++++++++++++++++++++++-- include/linux/mm.h | 1 - mm/memory.c | 8 +------- 15 files changed, 40 insertions(+), 68 deletions(-)
arch/arm/kernel/process.c +1 -1
@@ -536,7 +536,7 @@ int vectors_user_mapping(void)return install_special_mapping (mm,0xffff0000 ,PAGE_SIZE ,VM_READ |VM_EXEC |VM_MAYREAD |VM_MAYEXEC | -VM_ALWAYSDUMP |VM_RESERVED , +VM_RESERVED ,NULL ); }
arch/hexagon/kernel/vdso.c +1 -2
@@ -78,8 +78,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)/* MAYWRITE to allow gdb to COW and set breakpoints. */ ret =install_special_mapping (mm, vdso_base,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , &vdso_page);if (ret)
arch/mips/kernel/vdso.c +1 -2
@@ -88,8 +88,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) ret =install_special_mapping (mm, addr,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , &vdso_page);if (ret)
arch/powerpc/kernel/vdso.c +2 -8
@@ -263,17 +263,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)* the "data" page of the vDSO or you'll stop getting kernel updates * and your nice userland gettimeofday will be totally dead. * It's fine to use that for setting breakpoints in the vDSO code -* pages though -* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to see -* what PC values meant. +* pages though. */ rc =install_special_mapping (mm, vdso_base, vdso_pages <<PAGE_SHIFT ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdso_pagelist);if (rc) { current->mm->context.vdso_base =0 ;
arch/s390/kernel/vdso.c +2 -8
@@ -253,17 +253,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)* on the "data" page of the vDSO or you'll stop getting kernel * updates and your nice userland gettimeofday will be totally dead. * It's fine to use that for setting breakpoints in the vDSO code -* pages though -* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to see -* what PC values meant. +* pages though. */ rc =install_special_mapping (mm, vdso_base, vdso_pages <<PAGE_SHIFT ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdso_pagelist);if (rc) current->mm->context.vdso_base =0 ;
arch/sh/kernel/vsyscall/vsyscall.c +1 -2
@@ -73,8 +73,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) ret =install_special_mapping (mm, addr,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , syscall_pages);if (unlikely (ret)) goto up_fail;
arch/tile/mm/elf.c +1 -7
@@ -117,17 +117,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,/* * MAYWRITE to allow gdb to COW and set breakpoints -* -* Make sure the vDSO gets into every core dump. Dumping its -* contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to -* see what PC values meant. */ vdso_base =VDSO_BASE ; retval =install_special_mapping (mm, vdso_base,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdso_pages);#ifndef __tilegx__
arch/unicore32/kernel/process.c +1 -1
@@ -381,7 +381,7 @@ int vectors_user_mapping(void)return install_special_mapping (mm,0xffff0000 ,PAGE_SIZE ,VM_READ |VM_EXEC |VM_MAYREAD |VM_MAYEXEC | -VM_ALWAYSDUMP |VM_RESERVED , +VM_RESERVED ,NULL ); }
arch/x86/um/mem_32.c +0 -8
@@ -23,14 +23,6 @@ static int __init gate_vma_init(void) gate_vma.vm_flags =VM_READ |VM_MAYREAD |VM_EXEC |VM_MAYEXEC ; gate_vma.vm_page_prot = __P101; -/* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to see -* what PC values meant. -*/ - gate_vma.vm_flags |=VM_ALWAYSDUMP ; -return 0 ; }__initcall (gate_vma_init);
arch/x86/um/vdso/vma.c +1 -2
@@ -64,8 +64,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) err =install_special_mapping (mm, um_vdso_addr,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdsop);up_write (&mm->mmap_sem);
arch/x86/vdso/vdso32-setup.c +2 -15
@@ -250,13 +250,7 @@ static int __init gate_vma_init(void) gate_vma.vm_end =FIXADDR_USER_END ; gate_vma.vm_flags =VM_READ |VM_MAYREAD |VM_EXEC |VM_MAYEXEC ; gate_vma.vm_page_prot = __P101; -/* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to see -* what PC values meant. -*/ - gate_vma.vm_flags |=VM_ALWAYSDUMP ; +return 0 ; }
@@ -343,17 +337,10 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)if (compat_uses_vma || !compat) {/* * MAYWRITE to allow gdb to COW and set breakpoints -* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully -* interpretable later without matching up the same -* kernel and hardware config to see what PC values -* meant. */ ret =install_special_mapping (mm, addr,PAGE_SIZE ,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdso32_pages);if (ret)
arch/x86/vdso/vma.c +1 -2
@@ -124,8 +124,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) ret =install_special_mapping (mm, addr, vdso_size,VM_READ |VM_EXEC | -VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC | -VM_ALWAYSDUMP , +VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC , vdso_pages);if (ret) { current->mm->context.vdso =NULL ;
fs/binfmt_elf.c +25 -2
@@ -1095,6 +1095,29 @@ out:*/ /* +* The purpose of always_dump_vma() is to make sure that special kernel mappings +* that are useful for post-mortem analysis are included in every core dump. +* In that way we ensure that the core dump is fully interpretable later +* without matching up the same kernel and hardware config to see what PC values +* meant. These special mappings include - vDSO, vsyscall, and other +* architecture specific mappings +*/ +static bool always_dump_vma (struct vm_area_struct *vma) +{ +/* Any vsyscall mappings? */ +if (vma ==get_gate_vma (vma->vm_mm)) +return true; +/* +* arch_vma_name() returns non-NULL for special architecture mappings, +* such as vDSO sections. +*/ +if (arch_vma_name (vma)) +return true; + +return false; +} + +/* * Decide what to dump of a segment, part, all or none. */ static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -1102,8 +1125,8 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, {#define FILTER (type) (mm_flags & (1UL << MMF_DUMP_##type)) -/* The vma can be set up to tell us the answer directly. */ -if (vma->vm_flags &VM_ALWAYSDUMP ) +/* always dump the vdso and vsyscall sections */ +if (always_dump_vma (vma)) goto whole;/* Hugetlb memory check */
include/linux/mm.h +0 -1
@@ -111,7 +111,6 @@ extern unsigned int kobjsize(const void *objp);#define VM_HUGEPAGE 0x01000000/* MADV_HUGEPAGE marked this vma */ #endif #define VM_INSERTPAGE 0x02000000/* The vma has had "vm_insert_page()" done on it */ -#define VM_ALWAYSDUMP 0x04000000/* Always include in core dumps */ #define VM_CAN_NONLINEAR 0x08000000/* Has ->fault & does nonlinear pages */ #define VM_MIXEDMAP 0x10000000/* Can contain "struct page" and pure PFN pages */
mm/memory.c +1 -7
@@ -3611,13 +3611,7 @@ static int __init gate_vma_init(void) gate_vma.vm_end =FIXADDR_USER_END ; gate_vma.vm_flags =VM_READ |VM_MAYREAD |VM_EXEC |VM_MAYEXEC ; gate_vma.vm_page_prot = __P101; -/* -* Make sure the vDSO gets into every core dump. -* Dumping its contents makes post-mortem fully interpretable later -* without matching up the same kernel and hardware config to see -* what PC values meant. -*/ - gate_vma.vm_flags |=VM_ALWAYSDUMP ; +return 0 ; }__initcall (gate_vma_init);
Signature · 1 line
1.7.7.6
Re: [PATCH 1/2 v2] core dump: drop VM_ALWAYSDUMP flag
PATCH v2 2/2 core dump: add VM_NODUMP, MADV_NODUMP, MADV_CLEAR_NODUMP
In reply to Jason BaronSince we no longer need the VM_ALWAYSDUMP flag, let's use the freed bit for 'VM_NODUMP' flag. The idea is is to add a new madvise() flag: MADV_NODUMP, which can be set by applications to specifically request memory regions which should not dump core. The specific application I have in mind is qemu: we can add a flag there that wouldn't dump all of guest memory when qemu dumps core. This flag might also be useful for security sensitive apps that want to absolutely make sure that parts of memory are not dumped. To clear the flag
use: MADV_CLEAR_NODUMP.
--- fs/binfmt_elf.c | 3 +++ include/asm-generic/mman-common.h | 4 ++++ include/linux/mm.h | 1 + mm/madvise.c | 8 ++++++++ 4 files changed, 16 insertions(+), 0 deletions(-)
fs/binfmt_elf.c +3 -0
@@ -1129,6 +1129,9 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,if (always_dump_vma (vma)) goto whole; +if (vma->vm_flags &VM_NODUMP ) +return 0 ; +/* Hugetlb memory check */ if (vma->vm_flags &VM_HUGETLB ) {if ((vma->vm_flags &VM_SHARED ) &&FILTER (HUGETLB_SHARED ))
include/asm-generic/mman-common.h +4 -0
@@ -48,6 +48,10 @@#define MADV_HUGEPAGE 14/* Worth backing with hugepages */ #define MADV_NOHUGEPAGE 15/* Not worth backing with hugepages */ +#define MADV_NODUMP 16/* Explicity exclude from the core dump, +overrides the coredump filter bits */ +#define MADV_CLEAR_NODUMP 17/* Clear the MADV_NODUMP flag */ +/* compatibility flags */ #define MAP_FILE 0
include/linux/mm.h +1 -0
@@ -111,6 +111,7 @@ extern unsigned int kobjsize(const void *objp);#define VM_HUGEPAGE 0x01000000/* MADV_HUGEPAGE marked this vma */ #endif #define VM_INSERTPAGE 0x02000000/* The vma has had "vm_insert_page()" done on it */ +#define VM_NODUMP 0x04000000/* Do not include in the core dump */ #define VM_CAN_NONLINEAR 0x08000000/* Has ->fault & does nonlinear pages */ #define VM_MIXEDMAP 0x10000000/* Can contain "struct page" and pure PFN pages */
mm/madvise.c +8 -0
@@ -65,6 +65,12 @@ static long madvise_behavior(struct vm_area_struct * vma, } new_flags &= ~VM_DONTCOPY ;break ; +case MADV_NODUMP : + new_flags |=VM_NODUMP ; +break ; +case MADV_CLEAR_NODUMP : + new_flags &= ~VM_NODUMP ; +break ;case MADV_MERGEABLE :case MADV_UNMERGEABLE : error =ksm_madvise (vma, start, end, behavior, &new_flags);
@@ -293,6 +299,8 @@ madvise_behavior_valid(int behavior)case MADV_HUGEPAGE :case MADV_NOHUGEPAGE :#endif +case MADV_NODUMP : +case MADV_CLEAR_NODUMP :return 1 ;default :
Signature · 1 line
1.7.7.6
Re: [PATCH 2/2 v2] core dump: add VM_NODUMP, MADV_NODUMP, MADV_CLEAR_NODUMP
I'm vaguely dubious about the desireability of using this new feature. (I would hate to try to debug a qemu bug from a dump where half the interesting state was intentionally hidden from me.) But I don't see any problem with the implementation.
As to the interface, I think the bits are OK but it would be more in keeping with the existing MADV_* names to call the new values MADV_DONTDUMP and MADV_DODUMP.
Thanks,
Roland
Andrew Morton
maintainerRe: [PATCH 2/2 v2] core dump: add VM_NODUMP, MADV_NODUMP, MADV_CLEAR_NODUMP
Quoted 3 lines · On Thu, 8 Mar 2012 13:44:17 -0800 (PST) Roland McGrath <[email protected]>…
I'm vaguely dubious about the desireability of using this new feature. (I would hate to try to debug a qemu bug from a dump where half the interesting state was intentionally hidden from me.)
yup. But the dumpability is fully controllable by userspace: one can easily envisage large vma's full of data which just isn't interesting for a dump. Plus if you're a developer who is looking at a dump and important data isn't there, you can often delete one line, rebuild and run the test again.
Quoted 6 lines
But I don't see
any problem with the implementation.As to the interface, I think the bits are OK but it would be more in keeping with the existing MADV_* names to call the new values
MADV_DONTDUMPandMADV_DODUMP.
Yup. I queued a patch to do that.