...digging into kvm exit with EPT_VIOLATION reason, I've noted the following:
Code:
root@unl02:~# root@unl02:~# trace-cmd start -e kvm:kvm_exit -f 'exit_reason == 48' -e kvm:kvm_page_fault
/sys/kernel/debug/tracing/events/kvm/kvm_exit/filter
/sys/kernel/debug/tracing/events/kvm/kvm_page_fault/filter
root@unl02:~# trace-cmd show
# tracer: nop
#
# entries-in-buffer/entries-written: 8/8 #P:48
#
# _-----=> irqs-off
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / delay
# TASK-PID CPU# |||| TIMESTAMP FUNCTION
# | | | |||| | |
<...>-41584 [008] .... 579988.037495: kvm_exit: reason EPT_VIOLATION rip 0x9a2d6ac info 181 0
<...>-41584 [008] .... 579988.037498: kvm_page_fault: address bfe28dea error_code 181
<...>-41584 [008] .... 579988.037554: kvm_exit: reason EPT_VIOLATION rip 0x8977012 info 183 0
<...>-41584 [008] .... 579988.037555: kvm_page_fault: address bfc4745a error_code 183
kvm-based VM is running a guest OS using 4KB (or even 2MB) page size so I would expect guest physical address (gpa) reported by kvm exit ept_violation handler (via trace_kvm_page_fault tracepoint) should have last 3 hex digits equal to the last 3 hex digits of guest RIP value into VMCS' VM-exit "exit reason" field.
According kvm source code (
http://lxr.free-electrons.com/source/arch/x86/kvm/vmx.c), error code reported there (e.g. 181 or 183) should not point to an EPT violation occurrence due to an access to any of guest paging hierarchy entry (PML4T, PDPT, PT or PG depending of guest translation model used) during guest page walking.....thus, why we don not get the same values for the last 3 hex digits ?