Re: [PATCH 6.18.y 3/3] KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits

[Sean Christopherson <seanjc@google.com>]

On Fri, Oct 30, 2026, Bjoern Doebel wrote:
> From: Kevin Cheng <chengkev@google.com>
> 
> [ Upstream commit 96b067b59ad9ccede585fcadab27543188353bff ]
> 
> When injecting an EPT Violation into L2 in response to a fault detected
> while emulating an L2 GVA access, synthesize the GVA_IS_VALID and
> GVA_TRANSLATED bits using information provided by the walker, instead of
> pulling the bits from vmcs02.EXIT_QUALIFICATION.  The information in
> vmcs02.EXIT_QUALIFICATION is valid/correct if and only if the fault being
> injected into L1 is the direct result of an EPT Violation VM-Exit from L2.
> 
> E.g. if KVM is emulating an I/O instruction and the memory operand's
> translation through L1's EPT fails, using vmcs02.EXIT_QUALIFICATION is
> wrong as the semantics for EXIT_QUALIFICATION would be for an I/O exit,
> not an EPT Violation exit.
> 
> Opportunistically clean up the formatting for creating the mask of bits
> to pull from vmcs02.EXIT_QUALIFICATION.
> 
> Signed-off-by: Kevin Cheng <chengkev@google.com>
> [sean: use plumbed in @access bits, massage changelog]
> Link: https://patch.msgid.link/20260522232701.3671446-5-seanjc@google.com
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> [doebel: no advanced EPT vmexit info here, so the mask keeps only the two
> GVA bits; set GVA_TRANSLATED via !(access & PFERR_GUEST_PAGE_MASK)]

...

> @@ -509,6 +509,21 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
>  		if (fetch_fault)
>  			walker->fault.exit_qualification |= EPT_VIOLATION_ACC_INSTR;
>  
> +		/*
> +		 * KVM doesn't emulate features that access GPAs directly, e.g.
> +		 * Intel Processor Trace.  Assume the GVA is always valid; when
> +		 * propagating faults from hardware, KVM will discard this info
> +		 * and use the EXIT_QUALIFICATION bits from the VMCS.
> +		 */
> +		walker->fault.exit_qualification |= EPT_VIOLATION_GVA_IS_VALID;
> +
> +		/*
> +		 * Accesses to guest paging structures are not the translation of
> +		 * a guest linear address, i.e. GVA_TRANSLATED must be left clear.
> +		 */
> +		if (!(access & PFERR_GUEST_PAGE_MASK))
> +			walker->fault.exit_qualification |= EPT_VIOLATION_GVA_TRANSLATED;

Yeesh, I was going to say I'd prefer to keep the original:

		/*
		 * Accesses to guest paging structures are either "reads" or
		 * "read+write" accesses, so consider them the latter if write_fault
		 * is true.
		 */
		if (access & PFERR_GUEST_PAGE_MASK)
			walker->fault.exit_qualification |= EPT_VIOLATION_ACC_READ;
		else
			walker->fault.exit_qualification |= EPT_VIOLATION_GVA_TRANSLATED;

but I don't really want to decipher whether or not that's needed and/or correct
without upstream commit a8827c1961462 ("KVM: x86/mmu: introduce ACC_READ_MASK").
So yeah, this seems like the way to go.