Re: Trying to switch EPTP for execute-protecting guest pages

[Paolo Bonzini <pbonzini@redhat.com>]

On 24/11/2015 16:52, Estrada, Zachary J wrote:
>> I'm not sure if this is your problem, but perhaps you want to record in
>> the role whether the page comes from your version or the original?  The
>> role is like the hash key, if the role is the same you get the same PTE.
>
> This is extremely helpful, I had not noticed this. I'm using my new
> root_hpa as the base_role.word - does that make sense? I just tried it
> and I seem to get EPT_VIOLATIONS that I was expecting, but missing.

I think you should add a new bit to the role meaning "should I clear
some X bits?" :) that is computed based on the VCPU state.  For an
example see commit 699023e2 ("KVM: x86: add SMM to the MMU role, support
SMRAM address space"), which does

+       context->base_role.smm = is_smm(vcpu);

in init_kvm_tdp_mmu.  BTW, based on what you told me offlist, what you
are doing should also just work with shadow page tables.

Paolo

> Thanks a ton, it appears that the role was exactly the thing I was
> looking for!