[PATCH v2 0/6] KVM: arm64: ptdump: Shadow ptdump fixes

[Wei-Lin Chang]

Hi,

This is v2 of fixing shadow ptdump debugfs files. Unfortunately I couldn't make
per mmu ptdump files work after all, mainly because there isn't a clean way to
locate the specific nested mmu for each ptdump file as the nested mmus could be
freed when the file gets opened. Therefore in this series a single file
"shadow_page_tables" is created that dumps all valid mmus' page table
information.

An advantage of this is that this new ptdump file have a lifetime identical to
other ptdump files i.e. stage2_page_tables, ipa_range, etc., hence avoiding the
dentry UAF found last time [1].

With this all ptdump files are only removed when the last kvm reference gets
dropped and kvm_destroy_vm_debugfs() is called, in their open(), show()
functions the nested mmu array and mmu->pgt are checked with mmu_lock held to
prevent UAF.

Patch 1-2: Undo previous shadow ptdump implementation.
Patch 3:   Fix a mmu->pgt UAF that happens when ptdump files are read after
           mmu->pgt is freed.
Patch 4-5: Preparation for the shadow page table dump file.
Patch 6:   Implementation of the shadow page table dump file.

The fixes are tested with CONFIG_PROVE_LOCKING,
CONFIG_DEBUG_ATOMIC_SLEEP, and CONFIG_KASAN.

Thanks!

* Changes from v1 ([2]):

  - Move from per mmu ptdump files to one file that will dump all shadow page
    tables.

[1]: https://lore.kernel.org/kvmarm/ajty6I7ZqodP4ous@sm-arm-grace07/
[2]: https://lore.kernel.org/kvmarm/20260623142443.648972-1-weilin.chang@xxxxxxx/

Wei-Lin Chang (6):
  KVM: arm64: ptdump: Remove shadow ptdump files
  KVM: arm64: ptdump: Undo making the ptdump code mmu aware
  KVM: arm64: ptdump: Fix UAF when mmu->pgt is freed
  KVM: arm64: ptdump: Factor out initialization of
    kvm_ptdump_guest_state
  KVM: arm64: ptdump: Extract kvm_ptdump_guest_open() from canonical
    ptdump path
  KVM: arm64: ptdump: Introduce the shadow ptdump file

 arch/arm64/include/asm/kvm_host.h |   5 +-
 arch/arm64/include/asm/kvm_mmu.h  |   4 -
 arch/arm64/kvm/nested.c           |  18 +--
 arch/arm64/kvm/ptdump.c           | 185 ++++++++++++++++++++----------
 4 files changed, 135 insertions(+), 77 deletions(-)

-- 
2.43.0