From nobody Thu Sep 24 12:06:08 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C7A5040801D; Thu, 24 Sep 2026 09:50:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790243449; cv=none; b=LbEqGveW/coVUd4b4Je6EUPnxuADbbAwa1uNV/QikajnUaqS76eSqeQb6ohLvgPHG/mOlpog0nEZXCg13cQ8GZLsNxWNQpVwJXJAQEp7JWcx4L3XqzL1n2gHNAGeM3zYPSzOIddsXFEzRyWBiQdeouE7opBZeiI4ksooSgWuHlg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790243449; c=relaxed/simple; bh=8EeDJUKWzmbKZHvSf5EzOlL7Hm/HRnxcUKk/qxOp0jQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lklwDlnZjwXiFCNoIGIR5icHYyiZVsYEz5Ou2si/RX6dhUCM4di5mNrry8E6v9GpsBV4MdC1MhIyCcaCJQyNxRZi33SK12ocOOgnNmhCExKhEAwezW8RYYCcYAHL+JcgwIN+6qHvIh/ua7I0kRCMVGmglNAktwqJwXEaPfs8Dzo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=qfWYrEUB; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="qfWYrEUB" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 97B80152B; Thu, 24 Sep 2026 02:50:29 -0700 (PDT) Received: from workstation-e142269.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7FEA13F86F; Thu, 24 Sep 2026 02:50:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1790243433; bh=8EeDJUKWzmbKZHvSf5EzOlL7Hm/HRnxcUKk/qxOp0jQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qfWYrEUB5j3U+8mgY0E3CjMBvSOqzbpp456E3vbet8uflDlSnbRssfEFdaOBqUsLN NuyhALNLlfoYjc1CRYHyltNa52hifvRoDEucaedFOBaGznMxbD5JoEDvQZVvbOpFv1 txrpvLYdBl2qL2VEEhGWnLaqbkkOXlX9/VbRJWaI= From: Wei-Lin Chang To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Marc Zyngier , Oliver Upton , Fuad Tabba , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Mark Rutland , Sebastian Ene , Vincent Donnefort , Itaru Kitayama , Wei-Lin Chang , Sashiko AI , stable@vger.kernel.org Subject: [PATCH v4 1/2] KVM: arm64: ptdump: Check the page tables aren't freed when accessing Date: Thu, 24 Sep 2026 10:49:50 +0100 Message-ID: <20260924094951.727352-2-weilin.chang@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260924094951.727352-1-weilin.chang@arm.com> References: <20260924094951.727352-1-weilin.chang@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable An open debugfs file keeps the KVM structure alive, but does not prevent mmu notifier release from freeing the stage-2 page tables when the VMM=E2= =80=99s address space is torn down. Therefore page tables belonging to the mmus could have been freed when a thread opens or reads the ptdump files. Take the mmu_lock and check mmu->pgt is still alive before accessing the page tables. Also for the ipa_range file and stage2_levels file, switch from keeping the pointer to the page tables to keeping the pointer to the mmu. Fixes: 7c4f73548ed1 ("KVM: arm64: Register ptdump with debugfs on guest cre= ation") Reported-by: Sashiko AI Closes: https://lore.kernel.org/kvmarm/20260623144054.B91D21F000E9@smtp.ker= nel.org/ Reviewed-by: Vincent Donnefort Tested-by: Vincent Donnefort Tested-by: Itaru Kitayama Signed-off-by: Wei-Lin Chang Cc: stable@vger.kernel.org --- arch/arm64/kvm/ptdump.c | 43 +++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c index 69899797dbad..b5a0584260e8 100644 --- a/arch/arm64/kvm/ptdump.c +++ b/arch/arm64/kvm/ptdump.c @@ -115,15 +115,28 @@ static int kvm_ptdump_build_levels(struct ptdump_pg_l= evel *level, u32 start_lvl) =20 static struct kvm_ptdump_guest_state *kvm_ptdump_parser_create(struct kvm_= s2_mmu *mmu) { + struct kvm *kvm =3D kvm_s2_mmu_to_kvm(mmu); struct kvm_ptdump_guest_state *st; - struct kvm_pgtable *pgtable =3D mmu->pgt; + s8 start_level; int ret; =20 + /* + * We only need the pgt start level to initialize the ptdump, get it + * while holding the mmu_lock. It's fine if the pgt gets freed + * afterwards, we'll check again when doing the actual dump. + */ + scoped_guard(read_lock, &kvm->mmu_lock) { + if (mmu->pgt) + start_level =3D mmu->pgt->start_level; + else + return ERR_PTR(-ENOENT); + } + st =3D kzalloc_obj(struct kvm_ptdump_guest_state, GFP_KERNEL_ACCOUNT); if (!st) return ERR_PTR(-ENOMEM); =20 - ret =3D kvm_ptdump_build_levels(&st->level[0], pgtable->start_level); + ret =3D kvm_ptdump_build_levels(&st->level[0], start_level); if (ret) { kfree(st); return ERR_PTR(ret); @@ -149,6 +162,9 @@ static int kvm_ptdump_guest_show(struct seq_file *m, vo= id *unused) }; =20 guard(write_lock)(&kvm->mmu_lock); + if (!mmu->pgt) + return 0; + st->parser_state =3D (struct ptdump_pg_state) { .marker =3D &st->ipa_marker[0], .end_address =3D BIT(mmu->pgt->ia_bits), @@ -211,17 +227,27 @@ static const struct file_operations kvm_ptdump_guest_= fops =3D { =20 static int kvm_pgtable_range_show(struct seq_file *m, void *unused) { - struct kvm_pgtable *pgtable =3D m->private; + struct kvm_s2_mmu *mmu =3D m->private; + struct kvm *kvm =3D kvm_s2_mmu_to_kvm(mmu); + + guard(read_lock)(&kvm->mmu_lock); + + if (mmu->pgt) + seq_printf(m, "%2u\n", mmu->pgt->ia_bits); =20 - seq_printf(m, "%2u\n", pgtable->ia_bits); return 0; } =20 static int kvm_pgtable_levels_show(struct seq_file *m, void *unused) { - struct kvm_pgtable *pgtable =3D m->private; + struct kvm_s2_mmu *mmu =3D m->private; + struct kvm *kvm =3D kvm_s2_mmu_to_kvm(mmu); + + guard(read_lock)(&kvm->mmu_lock); + + if (mmu->pgt) + seq_printf(m, "%1d\n", KVM_PGTABLE_MAX_LEVELS - mmu->pgt->start_level); =20 - seq_printf(m, "%1d\n", KVM_PGTABLE_MAX_LEVELS - pgtable->start_level); return 0; } =20 @@ -230,15 +256,12 @@ static int kvm_pgtable_debugfs_open(struct inode *m, = struct file *file, { struct kvm_s2_mmu *mmu =3D m->i_private; struct kvm *kvm =3D kvm_s2_mmu_to_kvm(mmu); - struct kvm_pgtable *pgtable; int ret; =20 if (!kvm_get_kvm_safe(kvm)) return -ENOENT; =20 - pgtable =3D mmu->pgt; - - ret =3D single_open(file, show, pgtable); + ret =3D single_open(file, show, mmu); if (ret < 0) kvm_put_kvm(kvm); return ret; --=20 2.43.0 From nobody Thu Sep 24 12:06:08 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id A38A445198E; Thu, 24 Sep 2026 09:50:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790243445; cv=none; b=u0MZUgArPM6hzfpQ50GNM5bjx4J3ymYFA54l4OPEGVe8PoLkL5PlkiQGmOoWK7KYlo0+2bRCLi8XnLwWDnNwOPaLrUs0NkEcpWRfk5hfBQA6PKr/sVvnAznfG8Ta4Ap9zNxTEwpqW0kSR8tiTHpPIPYouPNnE8oq7Wo7CwWC0cA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790243445; c=relaxed/simple; bh=h9DMwVgMyVEjJSxHYcFdf/Z7LbKxPqp5s1bmB8n+ZkY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hqW6odUZfghjoNFP329WAkxB0dg2mr+ZoIMi8tiuWWjE6sZ0/l10f3R1opPwW1xo3LPLYd5QX19r8c9FX6xyRqVkDC4Ym2jRm7yH84kdqtkbMf/7fc/ScAkxtYZIaIi0VYrkjakgCASfXlteVgCtcFyD8iD9QviesK9IbqaDfb8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=aPpBKxmC; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="aPpBKxmC" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6CD7F1570; Thu, 24 Sep 2026 02:50:32 -0700 (PDT) Received: from workstation-e142269.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 6DE2E3F86F; Thu, 24 Sep 2026 02:50:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1790243435; bh=h9DMwVgMyVEjJSxHYcFdf/Z7LbKxPqp5s1bmB8n+ZkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aPpBKxmC4c2mX2VdSPyWSo+YvaCILFmA6WNUEmp8NUKnxktFdaHGmjtzRm0V8W2v7 dHXx89OAbduLpmmSIJS2CCwsSaVriA66W8VJNHXJF1WG8FvhNEcXrUbwZoMPvitdXh VeJGk0m2ob7Nja6v9PJ/E/RgMUzGKz8TtkYFBPI0= From: Wei-Lin Chang To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Marc Zyngier , Oliver Upton , Fuad Tabba , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Mark Rutland , Sebastian Ene , Vincent Donnefort , Itaru Kitayama , Wei-Lin Chang , stable@vger.kernel.org Subject: [PATCH v4 2/2] KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem Date: Thu, 24 Sep 2026 10:49:51 +0100 Message-ID: <20260924094951.727352-3-weilin.chang@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260924094951.727352-1-weilin.chang@arm.com> References: <20260924094951.727352-1-weilin.chang@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Previously we exposed shadow page tables by creating a debugfs ptdump file whenever a nested mmu instance gets bound to a new context, and deleting the debugfs file whose context was getting unbound. This turned out to be buggy, as the instance<->context binding process is done with the mmu_lock held, and debugfs creation/deletion can sleep. Change the approach and create a shadow ptdump file for each nested mmu instead during kvm_vcpu_init_nested(), in a sleepable context. The files will be named nested_mmu, and reading it will return the nested context's VTTBR, VTCR, and s2 enabled or not before dumping the shadow page tables, given the nested mmu is valid. Fixes: 19e15dc73f0f ("KVM: arm64: nv: Expose shadow page tables in debugfs") Reported-by: Itaru Kitayama Closes: https://lore.kernel.org/kvmarm/aiuF0KSvvv-ZozI1@sm-arm-grace07/ Tested-by: Itaru Kitayama Signed-off-by: Wei-Lin Chang Cc: stable@vger.kernel.org --- arch/arm64/include/asm/kvm_host.h | 4 ---- arch/arm64/include/asm/kvm_mmu.h | 6 ++---- arch/arm64/kvm/nested.c | 9 ++++----- arch/arm64/kvm/ptdump.c | 32 +++++++++++++++---------------- 4 files changed, 21 insertions(+), 30 deletions(-) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm= _host.h index cd9b9d2462f9..db177af9149f 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -217,10 +217,6 @@ struct kvm_s2_mmu { */ bool nested_stage2_enabled; =20 -#ifdef CONFIG_PTDUMP_STAGE2_DEBUGFS - struct dentry *shadow_pt_debugfs_dentry; -#endif - /* * true when this MMU needs to be unmapped before being used for a new * purpose. diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_= mmu.h index 6eae7e7e2a68..ac2b0637692a 100644 --- a/arch/arm64/include/asm/kvm_mmu.h +++ b/arch/arm64/include/asm/kvm_mmu.h @@ -392,12 +392,10 @@ static inline bool kvm_supports_cacheable_pfnmap(void) =20 #ifdef CONFIG_PTDUMP_STAGE2_DEBUGFS void kvm_s2_ptdump_create_debugfs(struct kvm *kvm); -void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu); -void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *mmu); +void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu, int idx); #else static inline void kvm_s2_ptdump_create_debugfs(struct kvm *kvm) {} -static inline void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *= mmu) {} -static inline void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *= mmu) {} +static inline void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *= mmu, int idx) {} #endif /* CONFIG_PTDUMP_STAGE2_DEBUGFS */ =20 #endif /* __ASSEMBLER__ */ diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c index b191365d97cc..41253fe45941 100644 --- a/arch/arm64/kvm/nested.c +++ b/arch/arm64/kvm/nested.c @@ -124,6 +124,9 @@ int kvm_vcpu_init_nested(struct kvm_vcpu *vcpu) return ret; } =20 + for (i =3D 0; i < S2_MMU_PER_VCPU; i++) + kvm_nested_s2_ptdump_create_debugfs(&tmp[i], i + kvm->arch.nested_mmus_= size); + guard(write_lock)(&kvm->mmu_lock); =20 for (i =3D 0; i < S2_MMU_PER_VCPU; i++) @@ -837,10 +840,8 @@ static struct kvm_s2_mmu *get_s2_mmu_nested(struct kvm= _vcpu *vcpu) kvm->arch.nested_mmus_next =3D (i + 1) % kvm->arch.nested_mmus_size; =20 /* Make sure we don't forget to do the laundry */ - if (kvm_s2_mmu_valid(s2_mmu)) { - kvm_nested_s2_ptdump_remove_debugfs(s2_mmu); + if (kvm_s2_mmu_valid(s2_mmu)) s2_mmu->pending_unmap =3D true; - } =20 /* * The virtual VMID (modulo CnP) will be used as a key when matching @@ -854,8 +855,6 @@ static struct kvm_s2_mmu *get_s2_mmu_nested(struct kvm_= vcpu *vcpu) s2_mmu->tlb_vtcr =3D vcpu_read_sys_reg(vcpu, VTCR_EL2); s2_mmu->nested_stage2_enabled =3D vcpu_read_sys_reg(vcpu, HCR_EL2) & HCR_= VM; =20 - kvm_nested_s2_ptdump_create_debugfs(s2_mmu); - out: atomic_inc(&s2_mmu->refcnt); =20 diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c index b5a0584260e8..7829fe376385 100644 --- a/arch/arm64/kvm/ptdump.c +++ b/arch/arm64/kvm/ptdump.c @@ -17,7 +17,7 @@ =20 #define MARKERS_LEN 2 #define KVM_PGTABLE_MAX_LEVELS (KVM_PGTABLE_LAST_LEVEL + 1) -#define S2FNAMESZ sizeof("0x0123456789abcdef-0x0123456789abcdef-s2-disabl= ed") +#define S2FNAMESZ sizeof("nested_mmu0000") =20 struct kvm_ptdump_guest_state { struct kvm_s2_mmu *mmu; @@ -173,6 +173,15 @@ static int kvm_ptdump_guest_show(struct seq_file *m, v= oid *unused) .seq =3D m, }; =20 + if (kvm_is_nested_s2_mmu(kvm, mmu)) { + if (kvm_s2_mmu_valid(mmu)) + seq_printf(m, "VTCR: 0x%016llx VTTBR: 0x%016llx s2: %s\n", + mmu->tlb_vtcr, mmu->tlb_vttbr, + mmu->nested_stage2_enabled ? "enabled" : "disabled"); + else + return 0; + } + ret =3D kvm_pgtable_walk(mmu->pgt, 0, BIT(mmu->pgt->ia_bits), &walker); if (ret) return ret; @@ -299,26 +308,15 @@ static const struct file_operations kvm_pgtable_level= s_fops =3D { .release =3D kvm_pgtable_debugfs_close, }; =20 -void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu) +void kvm_nested_s2_ptdump_create_debugfs(struct kvm_s2_mmu *mmu, int idx) { - struct dentry *dent; char file_name[S2FNAMESZ]; =20 - snprintf(file_name, sizeof(file_name), "0x%016llx-0x%016llx-s2-%sabled", - mmu->tlb_vttbr, - mmu->tlb_vtcr, - mmu->nested_stage2_enabled ? "en" : "dis"); - - dent =3D debugfs_create_file(file_name, 0400, - mmu->arch->debugfs_nv_dentry, mmu, - &kvm_ptdump_guest_fops); + snprintf(file_name, sizeof(file_name), "nested_mmu%d", idx); =20 - mmu->shadow_pt_debugfs_dentry =3D dent; -} - -void kvm_nested_s2_ptdump_remove_debugfs(struct kvm_s2_mmu *mmu) -{ - debugfs_remove(mmu->shadow_pt_debugfs_dentry); + debugfs_create_file(file_name, 0400, + mmu->arch->debugfs_nv_dentry, mmu, + &kvm_ptdump_guest_fops); } =20 void kvm_s2_ptdump_create_debugfs(struct kvm *kvm) --=20 2.43.0