From: Leonardo Bras <leo.bras@arm.com>
To: Wei-Lin Chang <weilin.chang@arm.com>
Cc: Leonardo Bras <leo.bras@arm.com>,
linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
linux-kernel@vger.kernel.org, Marc Zyngier <maz@kernel.org>,
Oliver Upton <oupton@kernel.org>, Fuad Tabba <tabba@google.com>,
Joey Gouly <joey.gouly@arm.com>,
Steffen Eiden <seiden@linux.ibm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Zenghui Yu <yuzenghui@huawei.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>,
Itaru Kitayama <itaru.kitayama@fujitsu.com>,
Sebastian Ene <sebastianene@google.com>
Subject: Re: [PATCH v2 6/6] KVM: arm64: ptdump: Introduce the shadow ptdump file
Date: Thu, 2 Jul 2026 12:00:10 +0100 [thread overview]
Message-ID: <akZEujlMp2H1cYOH@LeoBrasDK> (raw)
In-Reply-To: <w6ffknve2o3l5pgk7mblovsu5xzjwsgf7qyjd66nqwbtsea4ue@h5wj26fbb6kb>
On Wed, Jul 01, 2026 at 06:35:41PM +0100, Wei-Lin Chang wrote:
> On Wed, Jul 01, 2026 at 04:28:35PM +0100, Leonardo Bras wrote:
> > On Tue, Jun 30, 2026 at 01:10:05PM +0100, Wei-Lin Chang wrote:
> > > Create a ptdump file for all shadow page tables. It will dump out all
> > > valid shadow page tables at the time of request, with the mmu's index,
> > > guest VTCR_EL2, VTTBR_EL2, and whether the guest stage-2 is enabled or
> > > not.
> > >
> > > Also detach the nested mmu array under the mmu_lock in
> > > kvm_arch_flush_shadow_all() so readers cannot race with the array being
> > > removed, then free the old array after dropping the lock.
> >
> > Out of curiosity: why drop the lock before kfree'ing ?
>
> Because kvfree() can sleep! :)
>
Damn, I was certain to read kfree, not kvfree(), LOL
You are right, then :)
Thanks!
Leoy
> Thanks,
> Wei-Lin Chang
>
> >
> > Thanks!
> > Leo
> >
> > >
> > > Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
> > > ---
> > > arch/arm64/kvm/nested.c | 12 ++++++--
> > > arch/arm64/kvm/ptdump.c | 61 ++++++++++++++++++++++++++++++++++++++++-
> > > 2 files changed, 69 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> > > index 6435efd65cb5..17a180ddf6ca 100644
> > > --- a/arch/arm64/kvm/nested.c
> > > +++ b/arch/arm64/kvm/nested.c
> > > @@ -1283,6 +1283,7 @@ void kvm_nested_s2_flush(struct kvm *kvm)
> > >
> > > void kvm_arch_flush_shadow_all(struct kvm *kvm)
> > > {
> > > + struct kvm_s2_mmu *mmus;
> > > int i;
> > >
> > > for (i = 0; i < kvm->arch.nested_mmus_size; i++) {
> > > @@ -1291,9 +1292,14 @@ void kvm_arch_flush_shadow_all(struct kvm *kvm)
> > > if (!WARN_ON(atomic_read(&mmu->refcnt)))
> > > kvm_free_stage2_pgd(mmu);
> > > }
> > > - kvfree(kvm->arch.nested_mmus);
> > > - kvm->arch.nested_mmus = NULL;
> > > - kvm->arch.nested_mmus_size = 0;
> > > +
> > > + scoped_guard(write_lock, &kvm->mmu_lock) {
> > > + mmus = kvm->arch.nested_mmus;
> > > + kvm->arch.nested_mmus = NULL;
> > > + kvm->arch.nested_mmus_size = 0;
> > > + }
> > > +
> > > + kvfree(mmus);
> > > kvm_uninit_stage2_mmu(kvm);
> > > }
> > >
> > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > index 40f93b7c7ad9..1649eaa75798 100644
> > > --- a/arch/arm64/kvm/ptdump.c
> > > +++ b/arch/arm64/kvm/ptdump.c
> > > @@ -181,6 +181,50 @@ static int kvm_ptdump_guest_canonical_show(struct seq_file *m, void *unused)
> > > return 0;
> > > }
> > >
> > > +static int kvm_ptdump_guest_nested_show(struct seq_file *m, void *unused)
> > > +{
> > > + int ret = 0, i;
> > > + struct kvm_ptdump_guest_state *st = m->private;
> > > + struct kvm *kvm = st->kvm;
> > > + struct kvm_pgtable_walker walker = (struct kvm_pgtable_walker) {
> > > + .cb = kvm_ptdump_visitor,
> > > + .arg = &st->parser_state,
> > > + .flags = KVM_PGTABLE_WALK_LEAF,
> > > + };
> > > +
> > > + guard(write_lock)(&kvm->mmu_lock);
> > > +
> > > + if (!kvm->arch.nested_mmus)
> > > + return 0;
> > > +
> > > + for (i = 0; i < kvm->arch.nested_mmus_size; i++) {
> > > + struct kvm_s2_mmu *mmu = &kvm->arch.nested_mmus[i];
> > > +
> > > + if (!mmu->pgt)
> > > + continue;
> > > +
> > > + if (kvm_s2_mmu_valid(mmu)) {
> > > + memset(st, 0, sizeof(*st));
> > > + ret = kvm_ptdump_parser_init(st, kvm, mmu->pgt);
> > > + if (ret)
> > > + return ret;
> > > + st->parser_state = (struct ptdump_pg_state) {
> > > + .marker = &st->ipa_marker[0],
> > > + .level = -1,
> > > + .pg_level = &st->level[0],
> > > + .seq = m,
> > > + };
> > > + seq_printf(m, "nested mmu %d VTCR: 0x%016llx VTTBR: 0x%016llx s2: %s\n",
> > > + i, mmu->tlb_vtcr, mmu->tlb_vttbr,
> > > + mmu->nested_stage2_enabled ? "enabled" : "disabled");
> > > + ret = kvm_pgtable_walk(mmu->pgt, 0, BIT(mmu->pgt->ia_bits), &walker);
> > > + if (ret)
> > > + return ret;
> > > + }
> > > + }
> > > + return ret;
> > > +}
> > > +
> > > static int kvm_ptdump_guest_open(struct inode *m, struct file *file,
> > > int (*show)(struct seq_file *, void *))
> > > {
> > > @@ -212,6 +256,11 @@ static int kvm_ptdump_guest_canonical_open(struct inode *m, struct file *file)
> > > return kvm_ptdump_guest_open(m, file, kvm_ptdump_guest_canonical_show);
> > > }
> > >
> > > +static int kvm_ptdump_guest_nested_open(struct inode *m, struct file *file)
> > > +{
> > > + return kvm_ptdump_guest_open(m, file, kvm_ptdump_guest_nested_show);
> > > +}
> > > +
> > > static int kvm_ptdump_guest_close(struct inode *m, struct file *file)
> > > {
> > > struct kvm *kvm = m->i_private;
> > > @@ -230,6 +279,13 @@ static const struct file_operations kvm_ptdump_guest_canonical_fops = {
> > > .release = kvm_ptdump_guest_close,
> > > };
> > >
> > > +static const struct file_operations kvm_ptdump_guest_nested_fops = {
> > > + .open = kvm_ptdump_guest_nested_open,
> > > + .read = seq_read,
> > > + .llseek = seq_lseek,
> > > + .release = kvm_ptdump_guest_close,
> > > +};
> > > +
> > > static int kvm_pgtable_range_show(struct seq_file *m, void *unused)
> > > {
> > > struct kvm *kvm = m->private;
> > > @@ -307,6 +363,9 @@ void kvm_s2_ptdump_create_debugfs(struct kvm *kvm)
> > > kvm, &kvm_pgtable_range_fops);
> > > debugfs_create_file("stage2_levels", 0400, kvm->debugfs_dentry,
> > > kvm, &kvm_pgtable_levels_fops);
> > > - if (cpus_have_final_cap(ARM64_HAS_NESTED_VIRT))
> > > + if (cpus_have_final_cap(ARM64_HAS_NESTED_VIRT)) {
> > > kvm->arch.debugfs_nv_dentry = debugfs_create_dir("nested", kvm->debugfs_dentry);
> > > + debugfs_create_file("shadow_page_tables", 0400, kvm->arch.debugfs_nv_dentry,
> > > + kvm, &kvm_ptdump_guest_nested_fops);
> > > + }
> > > }
> > > --
> > > 2.43.0
> > >
next prev parent reply other threads:[~2026-07-02 11:00 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-30 12:09 [PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 1/6] KVM: arm64: ptdump: Remove shadow ptdump files Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 2/6] KVM: arm64: ptdump: Undo making the ptdump code mmu aware Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 3/6] KVM: arm64: ptdump: Fix UAF when mmu->pgt is freed Wei-Lin Chang
2026-07-01 15:00 ` Leonardo Bras
2026-07-01 17:27 ` Wei-Lin Chang
2026-07-02 10:58 ` Leonardo Bras
2026-06-30 12:10 ` [PATCH v2 4/6] KVM: arm64: ptdump: Factor out initialization of kvm_ptdump_guest_state Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 5/6] KVM: arm64: ptdump: Extract kvm_ptdump_guest_open() from canonical ptdump path Wei-Lin Chang
2026-06-30 12:10 ` [PATCH v2 6/6] KVM: arm64: ptdump: Introduce the shadow ptdump file Wei-Lin Chang
2026-07-01 15:28 ` Leonardo Bras
2026-07-01 17:35 ` Wei-Lin Chang
2026-07-02 11:00 ` Leonardo Bras [this message]
2026-07-02 21:48 ` Itaru Kitayama
2026-07-02 6:55 ` [PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes Itaru Kitayama
2026-07-02 7:41 ` Wei-Lin Chang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=akZEujlMp2H1cYOH@LeoBrasDK \
--to=leo.bras@arm.com \
--cc=catalin.marinas@arm.com \
--cc=itaru.kitayama@fujitsu.com \
--cc=joey.gouly@arm.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oupton@kernel.org \
--cc=sebastianene@google.com \
--cc=seiden@linux.ibm.com \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=weilin.chang@arm.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox