All of lore.kernel.org
 help / color / mirror / Atom feed
From: Leonardo Bras <leo.bras@arm.com>
To: Wei-Lin Chang <weilin.chang@arm.com>
Cc: Leonardo Bras <leo.bras@arm.com>,
	linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
	linux-kernel@vger.kernel.org, Marc Zyngier <maz@kernel.org>,
	Oliver Upton <oupton@kernel.org>, Fuad Tabba <tabba@google.com>,
	Joey Gouly <joey.gouly@arm.com>,
	Steffen Eiden <seiden@linux.ibm.com>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Zenghui Yu <yuzenghui@huawei.com>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	Itaru Kitayama <itaru.kitayama@fujitsu.com>,
	Sebastian Ene <sebastianene@google.com>
Subject: Re: [PATCH v2 6/6] KVM: arm64: ptdump: Introduce the shadow ptdump file
Date: Thu,  2 Jul 2026 12:00:10 +0100	[thread overview]
Message-ID: <akZEujlMp2H1cYOH@LeoBrasDK> (raw)
In-Reply-To: <w6ffknve2o3l5pgk7mblovsu5xzjwsgf7qyjd66nqwbtsea4ue@h5wj26fbb6kb>

On Wed, Jul 01, 2026 at 06:35:41PM +0100, Wei-Lin Chang wrote:
> On Wed, Jul 01, 2026 at 04:28:35PM +0100, Leonardo Bras wrote:
> > On Tue, Jun 30, 2026 at 01:10:05PM +0100, Wei-Lin Chang wrote:
> > > Create a ptdump file for all shadow page tables. It will dump out all
> > > valid shadow page tables at the time of request, with the mmu's index,
> > > guest VTCR_EL2, VTTBR_EL2, and whether the guest stage-2 is enabled or
> > > not.
> > > 
> > > Also detach the nested mmu array under the mmu_lock in
> > > kvm_arch_flush_shadow_all() so readers cannot race with the array being
> > > removed, then free the old array after dropping the lock.
> > 
> > Out of curiosity: why drop the lock before kfree'ing ?
> 
> Because kvfree() can sleep! :)
> 

Damn, I was certain to read kfree, not kvfree(), LOL

You are right, then :)

Thanks!
Leoy


> Thanks,
> Wei-Lin Chang
> 
> > 
> > Thanks!
> > Leo
> > 
> > > 
> > > Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
> > > ---
> > >  arch/arm64/kvm/nested.c | 12 ++++++--
> > >  arch/arm64/kvm/ptdump.c | 61 ++++++++++++++++++++++++++++++++++++++++-
> > >  2 files changed, 69 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > > index 6435efd65cb5..17a180ddf6ca 100644
> > > --- a/arch/arm64/kvm/nested.c
> > > +++ b/arch/arm64/kvm/nested.c
> > > @@ -1283,6 +1283,7 @@ void kvm_nested_s2_flush(struct kvm *kvm)
> > >  
> > >  void kvm_arch_flush_shadow_all(struct kvm *kvm)
> > >  {
> > > +	struct kvm_s2_mmu *mmus;
> > >  	int i;
> > >  
> > >  	for (i = 0; i < kvm->arch.nested_mmus_size; i++) {
> > > @@ -1291,9 +1292,14 @@ void kvm_arch_flush_shadow_all(struct kvm *kvm)
> > >  		if (!WARN_ON(atomic_read(&mmu->refcnt)))
> > >  			kvm_free_stage2_pgd(mmu);
> > >  	}
> > > -	kvfree(kvm->arch.nested_mmus);
> > > -	kvm->arch.nested_mmus = NULL;
> > > -	kvm->arch.nested_mmus_size = 0;
> > > +
> > > +	scoped_guard(write_lock, &kvm->mmu_lock) {
> > > +		mmus = kvm->arch.nested_mmus;
> > > +		kvm->arch.nested_mmus = NULL;
> > > +		kvm->arch.nested_mmus_size = 0;
> > > +	}
> > > +
> > > +	kvfree(mmus);
> > >  	kvm_uninit_stage2_mmu(kvm);
> > >  }
> > >  
> > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > index 40f93b7c7ad9..1649eaa75798 100644
> > > --- a/arch/arm64/kvm/ptdump.c
> > > +++ b/arch/arm64/kvm/ptdump.c
> > > @@ -181,6 +181,50 @@ static int kvm_ptdump_guest_canonical_show(struct seq_file *m, void *unused)
> > >  	return 0;
> > >  }
> > >  
> > > +static int kvm_ptdump_guest_nested_show(struct seq_file *m, void *unused)
> > > +{
> > > +	int ret = 0, i;
> > > +	struct kvm_ptdump_guest_state *st = m->private;
> > > +	struct kvm *kvm = st->kvm;
> > > +	struct kvm_pgtable_walker walker = (struct kvm_pgtable_walker) {
> > > +		.cb	= kvm_ptdump_visitor,
> > > +		.arg	= &st->parser_state,
> > > +		.flags	= KVM_PGTABLE_WALK_LEAF,
> > > +	};
> > > +
> > > +	guard(write_lock)(&kvm->mmu_lock);
> > > +
> > > +	if (!kvm->arch.nested_mmus)
> > > +		return 0;
> > > +
> > > +	for (i = 0; i < kvm->arch.nested_mmus_size; i++) {
> > > +		struct kvm_s2_mmu *mmu = &kvm->arch.nested_mmus[i];
> > > +
> > > +		if (!mmu->pgt)
> > > +			continue;
> > > +
> > > +		if (kvm_s2_mmu_valid(mmu)) {
> > > +			memset(st, 0, sizeof(*st));
> > > +			ret = kvm_ptdump_parser_init(st, kvm, mmu->pgt);
> > > +			if (ret)
> > > +				return ret;
> > > +			st->parser_state = (struct ptdump_pg_state) {
> > > +				.marker		= &st->ipa_marker[0],
> > > +				.level		= -1,
> > > +				.pg_level	= &st->level[0],
> > > +				.seq		= m,
> > > +			};
> > > +			seq_printf(m, "nested mmu %d VTCR: 0x%016llx VTTBR: 0x%016llx s2: %s\n",
> > > +				   i, mmu->tlb_vtcr, mmu->tlb_vttbr,
> > > +				   mmu->nested_stage2_enabled ? "enabled" : "disabled");
> > > +			ret = kvm_pgtable_walk(mmu->pgt, 0, BIT(mmu->pgt->ia_bits), &walker);
> > > +			if (ret)
> > > +				return ret;
> > > +		}
> > > +	}
> > > +	return ret;
> > > +}
> > > +
> > >  static int kvm_ptdump_guest_open(struct inode *m, struct file *file,
> > >  				 int (*show)(struct seq_file *, void *))
> > >  {
> > > @@ -212,6 +256,11 @@ static int kvm_ptdump_guest_canonical_open(struct inode *m, struct file *file)
> > >  	return kvm_ptdump_guest_open(m, file, kvm_ptdump_guest_canonical_show);
> > >  }
> > >  
> > > +static int kvm_ptdump_guest_nested_open(struct inode *m, struct file *file)
> > > +{
> > > +	return kvm_ptdump_guest_open(m, file, kvm_ptdump_guest_nested_show);
> > > +}
> > > +
> > >  static int kvm_ptdump_guest_close(struct inode *m, struct file *file)
> > >  {
> > >  	struct kvm *kvm = m->i_private;
> > > @@ -230,6 +279,13 @@ static const struct file_operations kvm_ptdump_guest_canonical_fops = {
> > >  	.release	= kvm_ptdump_guest_close,
> > >  };
> > >  
> > > +static const struct file_operations kvm_ptdump_guest_nested_fops = {
> > > +	.open		= kvm_ptdump_guest_nested_open,
> > > +	.read		= seq_read,
> > > +	.llseek		= seq_lseek,
> > > +	.release	= kvm_ptdump_guest_close,
> > > +};
> > > +
> > >  static int kvm_pgtable_range_show(struct seq_file *m, void *unused)
> > >  {
> > >  	struct kvm *kvm = m->private;
> > > @@ -307,6 +363,9 @@ void kvm_s2_ptdump_create_debugfs(struct kvm *kvm)
> > >  			    kvm, &kvm_pgtable_range_fops);
> > >  	debugfs_create_file("stage2_levels", 0400, kvm->debugfs_dentry,
> > >  			    kvm, &kvm_pgtable_levels_fops);
> > > -	if (cpus_have_final_cap(ARM64_HAS_NESTED_VIRT))
> > > +	if (cpus_have_final_cap(ARM64_HAS_NESTED_VIRT)) {
> > >  		kvm->arch.debugfs_nv_dentry = debugfs_create_dir("nested", kvm->debugfs_dentry);
> > > +		debugfs_create_file("shadow_page_tables", 0400, kvm->arch.debugfs_nv_dentry,
> > > +				    kvm, &kvm_ptdump_guest_nested_fops);
> > > +	}
> > >  }
> > > -- 
> > > 2.43.0
> > > 

  reply	other threads:[~2026-07-02 11:00 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-30 12:09 [PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 1/6] KVM: arm64: ptdump: Remove shadow ptdump files Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 2/6] KVM: arm64: ptdump: Undo making the ptdump code mmu aware Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 3/6] KVM: arm64: ptdump: Fix UAF when mmu->pgt is freed Wei-Lin Chang
2026-07-01 15:00   ` Leonardo Bras
2026-07-01 17:27     ` Wei-Lin Chang
2026-07-02 10:58       ` Leonardo Bras
2026-07-03  9:26         ` Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 4/6] KVM: arm64: ptdump: Factor out initialization of kvm_ptdump_guest_state Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 5/6] KVM: arm64: ptdump: Extract kvm_ptdump_guest_open() from canonical ptdump path Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 6/6] KVM: arm64: ptdump: Introduce the shadow ptdump file Wei-Lin Chang
2026-06-30 12:27   ` sashiko-bot
2026-07-01 15:28   ` Leonardo Bras
2026-07-01 17:35     ` Wei-Lin Chang
2026-07-02 11:00       ` Leonardo Bras [this message]
2026-07-02 21:48   ` Itaru Kitayama
2026-07-03 10:27     ` Wei-Lin Chang
2026-07-02  6:55 ` [PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes Itaru Kitayama
2026-07-02  7:41   ` Wei-Lin Chang
2026-07-02 23:02     ` Itaru Kitayama
2026-07-03 10:24       ` Wei-Lin Chang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=akZEujlMp2H1cYOH@LeoBrasDK \
    --to=leo.bras@arm.com \
    --cc=catalin.marinas@arm.com \
    --cc=itaru.kitayama@fujitsu.com \
    --cc=joey.gouly@arm.com \
    --cc=kvmarm@lists.linux.dev \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maz@kernel.org \
    --cc=oupton@kernel.org \
    --cc=sebastianene@google.com \
    --cc=seiden@linux.ibm.com \
    --cc=suzuki.poulose@arm.com \
    --cc=tabba@google.com \
    --cc=weilin.chang@arm.com \
    --cc=will@kernel.org \
    --cc=yuzenghui@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.