When a mem access occurs and the accessed bit in the PT is 0, it triggers a microcode assist that walks the PT and sets the accessed bit in each level.
In oredr for the assist's code to write the accessed bit to the levels of the PT, it needs to know thier virtual addresses. But the pointers in cr3 and to the next level in the PT have phisycal addresses.
So how does the assist's code gets the virtual addresses?
The access used a virtual address, so I assume it's like a page fault where the fault handler can get the virtual address (from CR2 in that case).
It's microcode so the mechanism doesn't have to be architecturally visible. But in general it's normal that a fault / trap handler can get some data from the thing that triggered it, including for microcode assists using some internal register.