From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 291F63ED3C9; Tue, 4 Aug 2026 14:44:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785854681; cv=none; b=c/Q+ZXqIvT7VH0nh7syfs2FRTLOvc2bhqkJ+S1JespEuMxXP3rwyuWRnDDHy1sb9tROWs8zvLyW4e3i08NDeSszN8pwE0fQdYQVm5q40DTYRwMayiY3Km796bFIw25jkXoz91/Rl6J5jpIf4GIIAvPD3L6K1LEo8aqqpKuiLv/4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785854681; c=relaxed/simple; bh=FCEaBQlDRUm6dYO31Sm2WtF5WhrmLg76I6xWT8Sy9u8=; h=Date:Message-ID:From:To:Cc:Subject:In-Reply-To:References: MIME-Version:Content-Type; b=BJs6Nm1ovbixAzb61dUe09z+m5lOv3ulINDX+vEK37l67CDT0S7BX8Qyf7RSCaaMw581Kr2DmBNS5YQ7VxH2cMqHPHJIWNw8pbLXTU0VqO51EnoKSqjaWj13g2t9IK9Bwk/G0xX8b6TKGGGIRKirzXcW5gELadI0gK1iUvNjIp0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aByPNJbb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aByPNJbb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE5D41F000E9; Tue, 4 Aug 2026 14:44:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785854679; bh=aZ8CvjTsE8imig+joKU5SQ3EWoaGRndjO4SfRE71EXM=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=aByPNJbbjlQ57OPBmEl8tJNjWE3LtGyGGF4aZBkdplun7csv9BKs4dRrYmdhKBYSe TggmkPB8+7WHmXzFr7Bg+vxLadqT/keWhiSLB72UTErsJe1SQzaS8OFc/40nSt+RJq 7GO7Tdw7BEpH0cIdWugqErMXWn5aE2wtRr7ogLFkjq0wjY1qbCzwP45hf4GFE9SVri HNBz420P0E0eo7+v3hTrjywcmA3Mt88KUROBncPZiL2gGwznHgBpYpuqyryB16DFQh JkbkOoJByf+quO6BbHh196/3uAcjVbuKwQ8oGH7w+EBrZdkPUYPHPcm8BrWtU5EY3k JTIB9tLgGObFg== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wrGNh-0000000CFYa-0bPg; Tue, 04 Aug 2026 14:44:37 +0000 Date: Tue, 04 Aug 2026 15:44:36 +0100 Message-ID: <86ldamaqsr.wl-maz@kernel.org> From: Marc Zyngier To: Karl Mehltretter Cc: Oliver Upton , Fuad Tabba , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Paolo Bonzini , Shuah Khan , linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH 2/2] KVM: arm64: selftests: Add a nested S2 MMU realloc test In-Reply-To: <20260803224405.41468-2-kmehltretter@gmail.com> References: <20260803224405.41468-1-kmehltretter@gmail.com> <20260803224405.41468-2-kmehltretter@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: kmehltretter@gmail.com, oupton@kernel.org, tabba@google.com, joey.gouly@arm.com, seiden@linux.ibm.com, suzuki.poulose@arm.com, yuzenghui@huawei.com, pbonzini@redhat.com, shuah@kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-kselftest@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false On Mon, 03 Aug 2026 23:44:05 +0100, Karl Mehltretter wrote: > > Add a regression test for a stale vcpu->arch.hw_mmu reference when > initialising a vCPU grows the nested S2 MMU table. > > The test drives vCPU0 into L2 through a minimal L1 stage-2 identity map, > pins it to a second pCPU where it spins in L2, and then initialises > vCPU1. That initialisation grows the nested MMU table while vCPU0 still > holds one of its entries; keeping vCPU0 on a pCPU of its own means the > reference stays live without relying on hw_mmu being retained across a > schedule-out. vCPU0 is then released and has to run to completion. > > Creating vCPU1 up front is what allows the in-kernel VGIC to be used: > kvm_arch_vcpu_precreate() refuses KVM_CREATE_VCPU once the VGIC has been > initialised, which the test does before its first KVM_RUN. Creation on > its own increments online_vcpus, so deferring vCPU1's KVM_ARM_VCPU_INIT > until vCPU0 is in L2 still grows the table. > > With KASAN enabled, an unfixed kernel reports a slab-use-after-free in > kvm_handle_guest_abort(); with the fix it completes cleanly. The problem is that we can't mandate selftests to rely on KASAN on the host. Selftests are there to verify that we match the architecture requirements. If anything, this is a nice hack to demonstrate the problem (and yes, it fires here). > > Assisted-by: Claude:claude-fable-5 > Signed-off-by: Karl Mehltretter > --- > > The test requires nested virtualization and two pCPUs. Under QEMU TCG > it takes ~233s, exceeding the 120s timeout in > tools/testing/selftests/kvm/settings; psci_test takes ~167s in the same > boot, so emulating the second vCPU is the dominant cost. # time /host/home/maz/nested_mmu_realloc_test Random seed: 0x6b8b4567 Running control thread on pCPU 0, vCPU thread on pCPU 1 vCPU0 is running in L2; initializing vCPU1 to grow the table vCPU1 initialized; releasing vCPU0 vCPU0 resumed after nested MMU resize real 0m0.161s user 0m0.007s sys 0m0.109s This is with KVM running as an L1 already... M. -- Without deviation from the norm, progress is not possible.