Re: [RFC PATCH 1/5] KVM: x86/mmu: Log dirty GPAs only for the nested GPA walk

["Nikunj A. Dadhania" <nikunj@amd.com>]

On 10/15/2026 4:25 PM, sashiko-bot@kernel.org wrote:
> [You don't often get email from sashiko-bot@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] kvm: x86/mmu: L2 GFN type confusion and missed PML logs for L2 page tables
> --
> 
> commit 39018b0fb43ef6b337e5d8b61b880163828654c8
> Author: Nikunj A Dadhania <nikunj@amd.com>
> 
> KVM: x86/mmu: Log dirty GPAs only for the nested GPA walk
> 
> This patch gates PML logging on the walk being the nested GPA walk, assuming
> only that walk yields an L2 GPA. No functional change is intended as the EPT
> template only backs the nested GPA walk.
> 
>> diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
>> index 8e350095508c5..043d0ec02b272 100644
>> --- a/arch/x86/kvm/mmu/paging_tmpl.h
>> +++ b/arch/x86/kvm/mmu/paging_tmpl.h
>> @@ -235,7 +235,9 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
>>                               !(pte & PT_GUEST_DIRTY_MASK)) {
>>                       trace_kvm_mmu_set_dirty_bit(table_gfn, index, sizeof(pte));
>>  #if PTTYPE == PTTYPE_EPT
>> -                     if (kvm_nested_call(write_log_dirty)(vcpu, addr))
>> +                     /* Only the nested GPA walk yields an L2 GPA to log. */
>> +                     if (w == &vcpu->arch.ngpa_walk &&
>> +                         kvm_nested_call(write_log_dirty)(vcpu, addr))
> 
> [Severity: High]
> Does this change miss PML logs for L2 page table modifications that occur
> during an L2 gva_walk?

No, those are logged, just not from the gva_walk.  Walking L2's page
tables translates each page-table page through the nested walk, as a
write:

      walk_addr_generic(w = gva_walk)
        nested_access = (have_ad ? PFERR_WRITE_MASK : 0) | PFERR_USER_MASK;
        kvm_translate_gpa(gva_walk, gfn_to_gpa(table_gfn), nested_access | ...)
          svm_translate_nested_gpa()           /* switches w to ngpa_walk */
            walk_addr_generic(w = ngpa_walk)   /* write_fault is set */
              update_accessed_dirty_bits()
                write_log_dirty(vcpu, addr)    /* L2 GPA of the page table */

Logging from the gva_walk would be wrong rather than extra: 'addr' there
is an L2 GVA, not a GPA.

> 
> When KVM emulates setting A/D bits in an L2 page table (during an L2
> gva_walk), it is writing to an L2 GPA. Hardware logs page table updates
> to the PML buffer, so it seems KVM must do the same.
> 
> By ignoring gva_walk, does this fail to log L2 page table modifications
> to L1's PML buffer, breaking L1's dirty page tracking?

Regards,
Nikunj