Re: [PATCH 11/28] KVM: x86/mmu: pass pte_access for final nGPA->GPA walk

[Paolo Bonzini <pbonzini@redhat.com>]

On 4/28/26 13:09, Paolo Bonzini wrote:
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 0fc362508a19..c82d151ca6c1 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -4349,7 +4349,7 @@ static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
>   	if (exception)
>   		exception->error_code = 0;
>   	return kvm_translate_gpa(vcpu, mmu, vaddr, access | PFERR_GUEST_FINAL_MASK,
> -				 exception);
> +				 exception, ACC_ALL);

Note: Sashiko suggests using ACC_ALL & ~ACC_USER_MASK here, which is 
incorrect.  It says very confidently "According to the Intel SDM (Vol. 
3C, 'Mode-Based Execute Control for EPT'), when paging is disabled 
(CR0.PG = 0), all linear accesses must be treated as supervisor-mode 
accesses", but the actual quote is

   Paging maps a linear address as a user-mode address if the U/S flag is
   1 in all of the paging-structure entries controlling the translation
   of the linear address. If paging is disabled (CR0.PG = 0), every
   linear address is a user-mode address.

(There's also no section titled 'Mode-Based Execute Control for EPT', 
the quote is from '29.3.3.2 EPT violations').

Paolo