[PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Wei-Lin Chang]

Currently the guest stage-2 page table dump has the executable attribute
printed in reverse, showing "X" for a non-executable region and showing
" " for an executable one. This is caused by misjudgement of which
string gets printed for the executable and non-executable case. Fix it
by swapping the two strings.

Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
---
 arch/arm64/kvm/ptdump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
index 098416d7e5c25..99fc13f1c11fb 100644
--- a/arch/arm64/kvm/ptdump.c
+++ b/arch/arm64/kvm/ptdump.c
@@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
 	}, {
 		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
 		.val	= PTE_VALID,
-		.set	= " ",
-		.clear	= "X",
+		.set	= "X",
+		.clear	= " ",
 	}, {
 		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
 		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
-- 
2.50.1

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Anshuman Khandual]

On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> Currently the guest stage-2 page table dump has the executable attribute
> printed in reverse, showing "X" for a non-executable region and showing
> " " for an executable one. This is caused by misjudgement of which
> string gets printed for the executable and non-executable case. Fix it
> by swapping the two strings.
> 
> Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
> ---
>  arch/arm64/kvm/ptdump.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> index 098416d7e5c25..99fc13f1c11fb 100644
> --- a/arch/arm64/kvm/ptdump.c
> +++ b/arch/arm64/kvm/ptdump.c
> @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
>  	}, {
>  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
>  		.val	= PTE_VALID,
> -		.set	= " ",
> -		.clear	= "X",
> +		.set	= "X",
> +		.clear	= " ",
>  	}, {
>  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
>  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,

Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
that means the entry is not executable and vice versa.

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Wei-Lin Chang]

Hi Anshuman,

On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
> 
> 
> On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> > Currently the guest stage-2 page table dump has the executable attribute
> > printed in reverse, showing "X" for a non-executable region and showing
> > " " for an executable one. This is caused by misjudgement of which
> > string gets printed for the executable and non-executable case. Fix it
> > by swapping the two strings.
> > 
> > Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
> > ---
> >  arch/arm64/kvm/ptdump.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > index 098416d7e5c25..99fc13f1c11fb 100644
> > --- a/arch/arm64/kvm/ptdump.c
> > +++ b/arch/arm64/kvm/ptdump.c
> > @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
> >  	}, {
> >  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
> >  		.val	= PTE_VALID,
> > -		.set	= " ",
> > -		.clear	= "X",
> > +		.set	= "X",
> > +		.clear	= " ",
> >  	}, {
> >  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> >  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> 
> Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
> XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
> that means the entry is not executable and vice versa.

Yes you are correct. However in dump_prot() we have:

if ((st->current_prot & bits->mask) == bits->val)
	s = bits->set;
else
	s = bits->clear;

Analysis:

1. region is executable:
    - st->current_prot == PTE_VALID (ignore other bits)
    - st->current_prot & bits->mask gets PTE_VALID
    - if condition is true (.val is PTE_VALID)
    - prints bits->set

2. region is not executable:
    - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
    - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
    - if condition is false
    - prints bits->clear

Therefore we want .set = "X", and .clear = " ".

Thanks,
Wei-Lin Chang

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Mark Rutland]

On Mon, Aug 04, 2025 at 08:41:35PM +0800, Wei-Lin Chang wrote:
> Hi Anshuman,
> 
> On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
> > 
> > 
> > On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> > > Currently the guest stage-2 page table dump has the executable attribute
> > > printed in reverse, showing "X" for a non-executable region and showing
> > > " " for an executable one. This is caused by misjudgement of which
> > > string gets printed for the executable and non-executable case. Fix it
> > > by swapping the two strings.
> > > 
> > > Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
> > > ---
> > >  arch/arm64/kvm/ptdump.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > index 098416d7e5c25..99fc13f1c11fb 100644
> > > --- a/arch/arm64/kvm/ptdump.c
> > > +++ b/arch/arm64/kvm/ptdump.c
> > > @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
> > >  	}, {
> > >  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
> > >  		.val	= PTE_VALID,
> > > -		.set	= " ",
> > > -		.clear	= "X",
> > > +		.set	= "X",
> > > +		.clear	= " ",
> > >  	}, {

I think the big problem here is that we've included the 'PTE_VALID' bit
in the mask. We don't bother with that for the Stage-1 ptdump code, e.g.

        {
                .mask   = PTE_PXN,
                .val    = PTE_PXN,
                .set    = "NX",
                .clear  = "x ",
        },

.... so do we actually need to take the PTE_VALID bit into account here? Do
invalid Stage-2 entries have anything we don't want to report?

... or can we change the Stage-2 ptdump code to have:

	{
		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN,
		.val	= KVM_PTE_LEAF_ATTR_HI_S2_XN,
		.set	= "NX",
		.clear	= "x ",
	},

... and match the Stage-1 code?

Otherwise, maybe we can add a separate valid-only filter.

> > >  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > >  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > 
> > Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
> > XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
> > that means the entry is not executable and vice versa.
> 
> Yes you are correct. However in dump_prot() we have:
> 
> if ((st->current_prot & bits->mask) == bits->val)
> 	s = bits->set;
> else
> 	s = bits->clear;
> 
> Analysis:
> 
> 1. region is executable:
>     - st->current_prot == PTE_VALID (ignore other bits)
>     - st->current_prot & bits->mask gets PTE_VALID
>     - if condition is true (.val is PTE_VALID)
>     - prints bits->set
> 
> 2. region is not executable:
>     - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
>     - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
>     - if condition is false
>     - prints bits->clear

As above, this is because the PTE_VALID bit has been placed into the
mask, and that's not how the ptdump code was intended to be used.

> Therefore we want .set = "X", and .clear = " ".

That'll work around the problem, but I'm not sure that's the right fix.
If nothing else, it's *very* confusing.

Mark.

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Anshuman Khandual]

On 04/08/25 8:52 PM, Mark Rutland wrote:
> On Mon, Aug 04, 2025 at 08:41:35PM +0800, Wei-Lin Chang wrote:
>> Hi Anshuman,
>>
>> On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
>>>
>>>
>>> On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
>>>> Currently the guest stage-2 page table dump has the executable attribute
>>>> printed in reverse, showing "X" for a non-executable region and showing
>>>> " " for an executable one. This is caused by misjudgement of which
>>>> string gets printed for the executable and non-executable case. Fix it
>>>> by swapping the two strings.
>>>>
>>>> Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
>>>> ---
>>>>  arch/arm64/kvm/ptdump.c | 4 ++--
>>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
>>>> index 098416d7e5c25..99fc13f1c11fb 100644
>>>> --- a/arch/arm64/kvm/ptdump.c
>>>> +++ b/arch/arm64/kvm/ptdump.c
>>>> @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
>>>>  	}, {
>>>>  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
>>>>  		.val	= PTE_VALID,
>>>> -		.set	= " ",
>>>> -		.clear	= "X",
>>>> +		.set	= "X",
>>>> +		.clear	= " ",
>>>>  	}, {
> 
> I think the big problem here is that we've included the 'PTE_VALID' bit
> in the mask. We don't bother with that for the Stage-1 ptdump code, e.g.
> 
>         {
>                 .mask   = PTE_PXN,
>                 .val    = PTE_PXN,
>                 .set    = "NX",
>                 .clear  = "x ",
>         },
> 
> .... so do we actually need to take the PTE_VALID bit into account here? Do
> invalid Stage-2 entries have anything we don't want to report?
> 
> ... or can we change the Stage-2 ptdump code to have:
> 
> 	{
> 		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN,
> 		.val	= KVM_PTE_LEAF_ATTR_HI_S2_XN,
> 		.set	= "NX",
> 		.clear	= "x ",
> 	},
> 
> ... and match the Stage-1 code?
> 
> Otherwise, maybe we can add a separate valid-only filter.

Agreed.

PTE_VALID should be removed from all these existing filters here
and then add it back as a separate filter like Stage-1. Ohh, but
it is already in there. Checking for PTE_VALID along with other
intended filter masks does not make sense.

> 
>>>>  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
>>>>  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
>>>
>>> Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
>>> XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
>>> that means the entry is not executable and vice versa.
>>
>> Yes you are correct. However in dump_prot() we have:
>>
>> if ((st->current_prot & bits->mask) == bits->val)
>> 	s = bits->set;
>> else
>> 	s = bits->clear;
>>
>> Analysis:
>>
>> 1. region is executable:
>>     - st->current_prot == PTE_VALID (ignore other bits)
>>     - st->current_prot & bits->mask gets PTE_VALID
>>     - if condition is true (.val is PTE_VALID)
>>     - prints bits->set
>>
>> 2. region is not executable:
>>     - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
>>     - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
>>     - if condition is false
>>     - prints bits->clear
> 
> As above, this is because the PTE_VALID bit has been placed into the
> mask, and that's not how the ptdump code was intended to be used.
> 
>> Therefore we want .set = "X", and .clear = " ".
> 
> That'll work around the problem, but I'm not sure that's the right fix.
> If nothing else, it's *very* confusing.
> 
> Mark.

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Sebastian Ene]

On Mon, Aug 04, 2025 at 08:41:35PM +0800, Wei-Lin Chang wrote:

Hi Wei-Lin,

> Hi Anshuman,
> 
> On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
> > 
> > 
> > On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> > > Currently the guest stage-2 page table dump has the executable attribute
> > > printed in reverse, showing "X" for a non-executable region and showing
> > > " " for an executable one. This is caused by misjudgement of which
> > > string gets printed for the executable and non-executable case. Fix it
> > > by swapping the two strings.
> > > 
> > > Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
> > > ---
> > >  arch/arm64/kvm/ptdump.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > index 098416d7e5c25..99fc13f1c11fb 100644
> > > --- a/arch/arm64/kvm/ptdump.c
> > > +++ b/arch/arm64/kvm/ptdump.c
> > > @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
> > >  	}, {
> > >  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
> > >  		.val	= PTE_VALID,
> > > -		.set	= " ",
> > > -		.clear	= "X",
> > > +		.set	= "X",
> > > +		.clear	= " ",
> > >  	}, {
> > >  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > >  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > 
> > Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
> > XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
> > that means the entry is not executable and vice versa.
> 
> Yes you are correct. However in dump_prot() we have:
> 
> if ((st->current_prot & bits->mask) == bits->val)
> 	s = bits->set;
> else
> 	s = bits->clear;
> 
> Analysis:
> 
> 1. region is executable:
>     - st->current_prot == PTE_VALID (ignore other bits)
>     - st->current_prot & bits->mask gets PTE_VALID
>     - if condition is true (.val is PTE_VALID)
>     - prints bits->set
> 
> 2. region is not executable:
>     - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
>     - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
>     - if condition is false
>     - prints bits->clear
> 
> Therefore we want .set = "X", and .clear = " ".


This seems correct but it will produce a different output than the
stage-1 ptdump. What if we drop the PTE_VALID from the mask & value as
Mark and Anshuman are suggesting and print NX when the bit is set and x
otherwise as the stage-1 ptdump does ?

> 
> Thanks,
> Wei-Lin Chang

Thanks,
Sebastian

Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

[Wei-Lin Chang]

Hi all,

On Tue, Aug 05, 2025 at 08:31:59AM +0000, Sebastian Ene wrote:
> On Mon, Aug 04, 2025 at 08:41:35PM +0800, Wei-Lin Chang wrote:
> 
> Hi Wei-Lin,
> 
> > Hi Anshuman,
> > 
> > On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
> > > 
> > > 
> > > On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> > > > Currently the guest stage-2 page table dump has the executable attribute
> > > > printed in reverse, showing "X" for a non-executable region and showing
> > > > " " for an executable one. This is caused by misjudgement of which
> > > > string gets printed for the executable and non-executable case. Fix it
> > > > by swapping the two strings.
> > > > 
> > > > Signed-off-by: Wei-Lin Chang <r09922117@csie.ntu.edu.tw>
> > > > ---
> > > >  arch/arm64/kvm/ptdump.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > > index 098416d7e5c25..99fc13f1c11fb 100644
> > > > --- a/arch/arm64/kvm/ptdump.c
> > > > +++ b/arch/arm64/kvm/ptdump.c
> > > > @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
> > > >  	}, {
> > > >  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
> > > >  		.val	= PTE_VALID,
> > > > -		.set	= " ",
> > > > -		.clear	= "X",
> > > > +		.set	= "X",
> > > > +		.clear	= " ",
> > > >  	}, {
> > > >  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > > >  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > > 
> > > Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
> > > XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
> > > that means the entry is not executable and vice versa.
> > 
> > Yes you are correct. However in dump_prot() we have:
> > 
> > if ((st->current_prot & bits->mask) == bits->val)
> > 	s = bits->set;
> > else
> > 	s = bits->clear;
> > 
> > Analysis:
> > 
> > 1. region is executable:
> >     - st->current_prot == PTE_VALID (ignore other bits)
> >     - st->current_prot & bits->mask gets PTE_VALID
> >     - if condition is true (.val is PTE_VALID)
> >     - prints bits->set
> > 
> > 2. region is not executable:
> >     - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
> >     - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
> >     - if condition is false
> >     - prints bits->clear
> > 
> > Therefore we want .set = "X", and .clear = " ".
> 
> 
> This seems correct but it will produce a different output than the
> stage-1 ptdump. What if we drop the PTE_VALID from the mask & value as
> Mark and Anshuman are suggesting and print NX when the bit is set and x
> otherwise as the stage-1 ptdump does ?
> 

Thank you all for the valuable feedback!
Yes, let me follow this and send a v2.

Thanks,
Wei-Lin Chang

> > 
> > Thanks,
> > Wei-Lin Chang
> 
> Thanks,
> Sebastian