Re: Nested EPT Write Protection

[Paolo Bonzini <pbonzini@redhat.com>]

On 22/06/2015 15:28, Hu Yaohui wrote:
> 
> */2504             pseudo_gfn = base_addr >> PAGE_SHIFT;
> 2505             sp = kvm_mmu_get_page(vcpu, pseudo_gfn, iterator.addr,
> 2506                           iterator.level - 1,
> 2507                           1, ACC_ALL, iterator.sptep);/*
> 2508             if (!sp) {
> 2509                 pgprintk("nonpaging_map: ENOMEM\n");
> 2510                 kvm_release_pfn_clean(pfn);
> 2511                 return -ENOMEM;
> 2512             }
>                                    .........
> 
> </code>
> it will get a pseudo_gfn to allocate a kvm_mmu_page. What if a
> pseudo_gfn itself causes a tdp_page_fault?
> Will it make the corresponding EPT page table entry marked as readonly also?

If tdp_page_fault is used (meaning non-nested KVM: nested KVM uses
ept_page_fault instead), sp->unsync is always true:

	/* in kvm_mmu_get_page - __direct_map passes direct == true */
        if (!direct) {
                if (rmap_write_protect(vcpu, gfn))
                        kvm_flush_remote_tlbs(vcpu->kvm);
                if (level > PT_PAGE_TABLE_LEVEL && need_sync)
                        kvm_sync_pages(vcpu, gfn);

                account_shadowed(vcpu->kvm, sp);
        }

so mmu_need_write_protect always returns false.

Note that higher in kvm_mmu_get_page there is another conditional:

                if (!need_sync && sp->unsync)
                        need_sync = true;

but it only applies to the !direct case.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe kvm" in