[PATCH v2 1/7] x86/nestedvmx: Preserve hardware access bits in reflected EPT violations

[chunjie.zhu@xxxxxxxxxx]

From: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>

nept_translate_l2ga() rebuilds the exit qualification handed to L1 from
rwx_acc, which is derived from the npfec set up by ept_handle_violation().
That function deliberately treats every write violation as a read as well
(read_access = q.read || q.write), because the SDM leaves bit 0 undefined
for read-modify-write accesses.

As a result, a plain write by L2 that violates L1's EPT is reflected to L1
with bits 0 and 1 both set, whereas bare metal reports only bit 1 (data
write).  The widened access bits are an L0 implementation detail for its
own permission checks and should not leak into L1's view.

Keep bits 0-2 of the qualification as reported by hardware, and only
replace the GPA permission bits (3-5) with those from L1's EPT entries.
rwx_acc is still used for the permission check itself.

Signed-off-by: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
---
 xen/arch/x86/mm/hap/nested_ept.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/mm/hap/nested_ept.c b/xen/arch/x86/mm/hap/nested_ept.c
index d88d677825f1..e116d8254824 100644
--- a/xen/arch/x86/mm/hap/nested_ept.c
+++ b/xen/arch/x86/mm/hap/nested_ept.c
@@ -255,7 +255,12 @@ int nept_translate_l2ga(struct vcpu *v, paddr_t l2ga,
         rc = EPT_TRANSLATE_VIOLATION;
     /* Fall through to EPT violation if permission check fails. */
     case EPT_TRANSLATE_VIOLATION:
-        *exit_qual = (*exit_qual & 0xffffffc0) | (rwx_bits << 3) | rwx_acc;
+        /*
+         * Keep the access bits (0-2) as the hardware reported them.  rwx_acc
+         * treats every write as a read too, which is not what L1 would see
+         * on bare metal for a plain write.
+         */
+        *exit_qual = (*exit_qual & 0xffffffc7) | (rwx_bits << 3);
         *exit_reason = EXIT_REASON_EPT_VIOLATION;
         break;
 
-- 
2.34.1