linux-kernel - Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <yzl5a3r3vq42kbcsetdlmmtfaafzsyhcqzpfmlbhy3fqh4eylm@hocbkksrt2nj>
Date: Thu, 7 Aug 2025 11:12:55 +0800
From: Wei-Lin Chang <r09922117@...e.ntu.edu.tw>
To: Sebastian Ene <sebastianene@...gle.com>
Cc: Anshuman Khandual <anshuman.khandual@....com>, 
	linux-arm-kernel@...ts.infradead.org, kvmarm@...ts.linux.dev, linux-kernel@...r.kernel.org, 
	Marc Zyngier <maz@...nel.org>, Oliver Upton <oliver.upton@...ux.dev>, 
	Joey Gouly <joey.gouly@....com>, Suzuki K Poulose <suzuki.poulose@....com>, 
	Zenghui Yu <yuzenghui@...wei.com>, Catalin Marinas <catalin.marinas@....com>, 
	Will Deacon <will@...nel.org>, Mark Rutland <mark.rutland@....com>
Subject: Re: [PATCH] KVM: arm64: ptdump: Fix exec attribute printing

Hi all,

On Tue, Aug 05, 2025 at 08:31:59AM +0000, Sebastian Ene wrote:
> On Mon, Aug 04, 2025 at 08:41:35PM +0800, Wei-Lin Chang wrote:
> 
> Hi Wei-Lin,
> 
> > Hi Anshuman,
> > 
> > On Sun, Aug 03, 2025 at 07:33:04PM +0530, Anshuman Khandual wrote:
> > > 
> > > 
> > > On 02/08/25 4:10 PM, Wei-Lin Chang wrote:
> > > > Currently the guest stage-2 page table dump has the executable attribute
> > > > printed in reverse, showing "X" for a non-executable region and showing
> > > > " " for an executable one. This is caused by misjudgement of which
> > > > string gets printed for the executable and non-executable case. Fix it
> > > > by swapping the two strings.
> > > > 
> > > > Signed-off-by: Wei-Lin Chang <r09922117@...e.ntu.edu.tw>
> > > > ---
> > > >  arch/arm64/kvm/ptdump.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> > > > index 098416d7e5c25..99fc13f1c11fb 100644
> > > > --- a/arch/arm64/kvm/ptdump.c
> > > > +++ b/arch/arm64/kvm/ptdump.c
> > > > @@ -44,8 +44,8 @@ static const struct ptdump_prot_bits stage2_pte_bits[] = {
> > > >  	}, {
> > > >  		.mask	= KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID,
> > > >  		.val	= PTE_VALID,
> > > > -		.set	= " ",
> > > > -		.clear	= "X",
> > > > +		.set	= "X",
> > > > +		.clear	= " ",
> > > >  	}, {
> > > >  		.mask	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > > >  		.val	= KVM_PTE_LEAF_ATTR_LO_S2_AF | PTE_VALID,
> > > 
> > > Is not KVM_PTE_LEAF_ATTR_HI_S2_XN already in the reverse semantics aka
> > > XN (Execute Never). Hence when KVM_PTE_LEAF_ATTR_HI_S2_XN macro is set
> > > that means the entry is not executable and vice versa.
> > 
> > Yes you are correct. However in dump_prot() we have:
> > 
> > if ((st->current_prot & bits->mask) == bits->val)
> > 	s = bits->set;
> > else
> > 	s = bits->clear;
> > 
> > Analysis:
> > 
> > 1. region is executable:
> >     - st->current_prot == PTE_VALID (ignore other bits)
> >     - st->current_prot & bits->mask gets PTE_VALID
> >     - if condition is true (.val is PTE_VALID)
> >     - prints bits->set
> > 
> > 2. region is not executable:
> >     - st->current_prot == KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID
> >     - st->current_prot & bits->mask gets (KVM_PTE_LEAF_ATTR_HI_S2_XN | PTE_VALID)
> >     - if condition is false
> >     - prints bits->clear
> > 
> > Therefore we want .set = "X", and .clear = " ".
> 
> 
> This seems correct but it will produce a different output than the
> stage-1 ptdump. What if we drop the PTE_VALID from the mask & value as
> Mark and Anshuman are suggesting and print NX when the bit is set and x
> otherwise as the stage-1 ptdump does ?
> 

Thank you all for the valuable feedback!
Yes, let me follow this and send a v2.

Thanks,
Wei-Lin Chang

> > 
> > Thanks,
> > Wei-Lin Chang
> 
> Thanks,
> Sebastian