Re: Trying to switch EPTP for execute-protecting guest pages

[Paolo Bonzini <pbonzini@redhat.com>]

On 23/11/2015 18:11, Estrada, Zachary J wrote:
> I'm playing around with EPTs and kvm to track execution in the guest. 
> I've created a separate set of EPTs (and copied the last level entries
> from the real tables, minus execute permissions) but I'm not getting
> exits where I expect. I also have code in handle_ept_violation to
> preserve those permissions for any non-execute ept violations.
> 
> Here is what I am calling within a VM Exit handler:
> ---
> kvm_mmu_unload(vcpu);
> vcpu->arch.mmu.root_hpa = eptp;
> kvm_x86_ops->set_tdp_cr3(vcpu, eptp);
> kvm_mmu_load(vcpu);
> kvm_flush_remote_tlbs(vcpu->kvm);
> ---
> 
> I think some of this is overkill, but am I missing something? I think I
> may need to flush the rmaps too, but I'm not exactly sure how.

My suggestion is:

1) use tracing and check that kvm_mmu_get_page is being called correctly.

2) there is already code for write protection.  Try copying that code
instead of doing a complete reimplementation.

Paolo