[PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes

[Itaru Kitayama]

Hi Wei-Lin,
On Tue, Jun 30, 2026 at 01:09:59PM +0100, Wei-Lin Chang wrote:
> Hi,
> 
> This is v2 of fixing shadow ptdump debugfs files. Unfortunately I couldn't make
> per mmu ptdump files work after all, mainly because there isn't a clean way to
> locate the specific nested mmu for each ptdump file as the nested mmus could be
> freed when the file gets opened. Therefore in this series a single file
> "shadow_page_tables" is created that dumps all valid mmus' page table
> information.
> 
> An advantage of this is that this new ptdump file have a lifetime identical to
> other ptdump files i.e. stage2_page_tables, ipa_range, etc., hence avoiding the
> dentry UAF found last time [1].
> 
> With this all ptdump files are only removed when the last kvm reference gets
> dropped and kvm_destroy_vm_debugfs() is called, in their open(), show()
> functions the nested mmu array and mmu->pgt are checked with mmu_lock held to
> prevent UAF.
> 
> Patch 1-2: Undo previous shadow ptdump implementation.
> Patch 3:   Fix a mmu->pgt UAF that happens when ptdump files are read after
>            mmu->pgt is freed.
> Patch 4-5: Preparation for the shadow page table dump file.
> Patch 6:   Implementation of the shadow page table dump file.
> 
> The fixes are tested with CONFIG_PROVE_LOCKING,
> CONFIG_DEBUG_ATOMIC_SLEEP, and CONFIG_KASAN.
> 
> Thanks!

Running your shadow stage 2 kselftest with bpftrace shows me that __kvm_pgtable_stage2_init()
for shadow stage 2 translation tables are built with ia_bits = 52 and
start_level = 0, but the debugfs entry for the active shadow stage 2 tables prints
out that's 3 levels. Is this fully expected?

Thanks,
Itaru.

> 
> * Changes from v1 ([2]):
> 
>   - Move from per mmu ptdump files to one file that will dump all shadow page
>     tables.
> 
> [1]: https://lore.kernel.org/kvmarm/ajty6I7ZqodP4ous@sm-arm-grace07/
> [2]: https://lore.kernel.org/kvmarm/20260623142443.648972-1-weilin.chang@arm.com/
> 
> Wei-Lin Chang (6):
>   KVM: arm64: ptdump: Remove shadow ptdump files
>   KVM: arm64: ptdump: Undo making the ptdump code mmu aware
>   KVM: arm64: ptdump: Fix UAF when mmu->pgt is freed
>   KVM: arm64: ptdump: Factor out initialization of
>     kvm_ptdump_guest_state
>   KVM: arm64: ptdump: Extract kvm_ptdump_guest_open() from canonical
>     ptdump path
>   KVM: arm64: ptdump: Introduce the shadow ptdump file
> 
>  arch/arm64/include/asm/kvm_host.h |   5 +-
>  arch/arm64/include/asm/kvm_mmu.h  |   4 -
>  arch/arm64/kvm/nested.c           |  18 +--
>  arch/arm64/kvm/ptdump.c           | 185 ++++++++++++++++++++----------
>  4 files changed, 135 insertions(+), 77 deletions(-)
> 
> -- 
> 2.43.0
>