From: sashiko-bot@kernel.org
To: "Kenta Akagi" <k@mgml.me>
Cc: kvm@vger.kernel.org
Subject: Re: [PATCH 5.15.y v4 06/11] KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction
Date: Mon, 28 Sep 2026 16:55:20 +0000 [thread overview]
Message-ID: <20260928165520.A30991F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260928164427.4699-7-k@mgml.me>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] tools/kvm: inverted page role bit breaks plugin_kvm.c parsing
--
commit e1e76187db8d1987f4d32cf661bdfabf00f858af
Author: Lai Jiangshan <laijs@linux.alibaba.com>
KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction
The commit renames the gpte_is_8_bytes bit in the MMU page role to
has_4_byte_gpte and inverts its logic. This removes a special case since
guests with paging disabled do not use 4-byte PTEs.
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index 2c378064a1db9..d31817fb39620 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
[ ... ]
> @@ -316,7 +316,7 @@ union kvm_mmu_page_role {
> u32 word;
> struct {
> unsigned level:4;
> - unsigned gpte_is_8_bytes:1;
> + unsigned has_4_byte_gpte:1;
[Severity: Medium]
Does this logic inversion break userspace tracing tools?
Looking at tools/lib/traceevent/plugins/plugin_kvm.c, the in-tree plugin
parses this raw bit from the role word under the assumption it represents PAE
being enabled (when set to 1):
tools/lib/traceevent/plugins/plugin_kvm.c:union kvm_mmu_page_role {
unsigned word;
struct {
unsigned level:4;
unsigned cr4_pae:1;
It then prints it as inverted if the bit is zero:
tools/lib/traceevent/plugins/plugin_kvm.c:kvm_mmu_print_role() {
trace_seq_printf(s, "%u q%u%s %s%s %spae %snxe %swp%s%s%s",
...
role.cr4_pae ? "" : "!",
Because this patch inverts the logic in the kernel's role bit without
updating the plugin, will tracing tools like trace-cmd and perf now display
an inverted PAE state (printing 'pae' when disabled, and '!pae' when
enabled)?
> unsigned quadrant:2;
> unsigned direct:1;
> unsigned access:3;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260928164427.4699-1-k@mgml.me?part=6
next prev parent reply other threads:[~2026-09-28 16:55 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-28 16:44 [PATCH 5.15.y v4 00/11] KVM: fixes for CVE-2026-46113 and related issues Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 01/11] KVM: x86/mmu: Use a bool for direct Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 02/11] KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 03/11] KVM: MMU: update comment on the number of page role combinations Kenta Akagi
2026-09-28 16:52 ` sashiko-bot
2026-09-28 16:44 ` [PATCH 5.15.y v4 04/11] KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 05/11] KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 06/11] KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction Kenta Akagi
2026-09-28 16:55 ` sashiko-bot [this message]
2026-09-28 16:44 ` [PATCH 5.15.y v4 07/11] KVM: x86/mmu: Derive shadow MMU page role from parent Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 08/11] KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 09/11] KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 10/11] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Kenta Akagi
2026-09-28 16:44 ` [PATCH 5.15.y v4 11/11] KVM: x86: Fix shadow paging use-after-free due to unexpected role Kenta Akagi
2026-09-28 18:28 ` [PATCH 5.15.y v4 00/11] KVM: fixes for CVE-2026-46113 and related issues Sean Christopherson
2026-09-28 22:39 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260928165520.A30991F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=k@mgml.me \
--cc=kvm@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.