linux-kernel - Re: [PATCH v9 0/5] arm64: ptdump: View the second stage page-tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <864j72vzmw.wl-maz@kernel.org>
Date: Fri, 30 Aug 2024 15:44:39 +0100
From: Marc Zyngier <maz@...nel.org>
To: Sebastian Ene <sebastianene@...gle.com>
Cc: akpm@...ux-foundation.org,
	alexghiti@...osinc.com,
	ankita@...dia.com,
	ardb@...nel.org,
	catalin.marinas@....com,
	christophe.leroy@...roup.eu,
	james.morse@....com,
	vdonnefort@...gle.com,
	mark.rutland@....com,
	oliver.upton@...ux.dev,
	rananta@...gle.com,
	ryan.roberts@....com,
	shahuang@...hat.com,
	suzuki.poulose@....com,
	will@...nel.org,
	yuzenghui@...wei.com,
	kvmarm@...ts.linux.dev,
	linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	kernel-team@...roid.com
Subject: Re: [PATCH v9 0/5] arm64: ptdump: View the second stage page-tables

Hi Seb,

On Tue, 27 Aug 2024 09:45:43 +0100,
Sebastian Ene <sebastianene@...gle.com> wrote:
> 
> Hi,
> 
> 
> This series extends the ptdump support to allow dumping the guest
> stage-2 pagetables. When CONFIG_PTDUMP_STAGE2_DEBUGFS is enabled, ptdump
> registers the new following files under debugfs:
> - /sys/debug/kvm/<guest_id>/stage2_page_tables
> - /sys/debug/kvm/<guest_id>/stage2_levels
> - /sys/debug/kvm/<guest_id>/ipa_range
> 
> This allows userspace tools (eg. cat) to dump the stage-2 pagetables by
> reading the 'stage2_page_tables' file.
> The output format has the following fields:
> <IPA range> <size> <level> <access permissions> <mem_attributes>
> 
> Below is the output of a guest stage-2 pagetable dump running under Qemu.
> After a VM is created, the following files are available:
> 
> # cat /sys/kernel/debug/kvm/256-4/stage2_levels 
> 4
> # cat /sys/kernel/debug/kvm/256-4/ipa_range 
> 44
> # cat /sys/kernel/debug/kvm/256-4/stage2_page_tables 
> ---[ Guest IPA ]---
> 0x0000000000000000-0x0000000001000000          16M 2
> 0x0000000001000000-0x0000000001020000         128K 3
> 0x0000000001020000-0x0000000001021000           4K 3   R W X AF    
> 0x0000000001021000-0x0000000001200000        1916K 3
> 0x0000000001200000-0x0000000040000000        1006M 2
> 0x0000000040000000-0x0000000080000000           1G 0
> 0x0000000080000000-0x0000000081200000          18M 2   R W   AF BLK
> 0x0000000081200000-0x0000000081a00000           8M 2   R W X AF BLK
> 0x0000000081a00000-0x0000000081c00000           2M 2   R W   AF BLK
> 0x0000000081c00000-0x0000000082200000           6M 2   R W X AF BLK
> 0x0000000082200000-0x0000000082400000           2M 2   R W   AF BLK
> 0x0000000082400000-0x0000000082800000           4M 2   R W X AF BLK
> 0x0000000082800000-0x0000000082a00000           2M 2   R W   AF BLK
> 0x0000000082a00000-0x0000000082c00000           2M 2
> 0x0000000082c00000-0x0000000083200000           6M 2   R W X AF BLK
> 0x0000000083200000-0x0000000083400000           2M 2
> 0x0000000083400000-0x0000000083a00000           6M 2   R W X AF BLK
> 0x0000000083a00000-0x000000008fe00000         196M 2
> 0x000000008fe00000-0x0000000090000000           2M 2   R W   AF BLK
> 0x0000000090000000-0x0000000099400000         148M 2
> 0x0000000099400000-0x0000000099600000           2M 2   R W X AF BLK
> 0x0000000099600000-0x000000009b600000          32M 2
> 0x000000009b600000-0x000000009be00000           8M 2   R W X AF BLK
> 0x000000009be00000-0x000000009c000000           2M 2   R W   AF BLK
> 0x000000009c000000-0x00000000c0000000         576M 2

I've been giving this a go on my test systems with 16k pages, and it
doesn't really work as advertised:

root@...ette:/sys/kernel/debug/kvm# cat 2573-13/stage2_*
2
---[ Guest IPA ]---
0x0000000000000000-0x0000000008000000         128M 
0x0000000008000000-0x00000000090a0000       17024K 3
0x00000000090a0000-0x00000000090a4000          16K 3   R W X AF    
0x00000000090a4000-0x000000000a000000       15728K 3

Only 16kB mapped? This is a full Linux guest running the Debian
installer, and just the kernel is about 20MB (the VM has 4GB of RAM,
and is using QEMU as the VMM)

So clearly something isn't playing as expected. Also, this '128M'
without a level being displayed makes me wonder. It is probably the
QEMU flash, but then the rest of the addresses don't make much sense
(RAM on QEMU is at 1GB, not at 128MB.

On another system with kvmtool, I get something similar:

root@...denum:/home/maz# cat /sys/kernel/debug/kvm/*/stage2_*
2
---[ Guest IPA ]---
0x0000000000000000-0x0000000001020000       16512K 3
0x0000000001020000-0x0000000001024000          16K 3   R W X AF    
0x0000000001024000-0x0000000002000000       16240K 3

and kvmtool places the RAM at 2GB. Clearly not what we're seeing here.

Could you please verify this?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.