Hello, My host is an x86-64 with EPT enabled, my guest is 32b. I'd like to observe all read accesses to a kernel guest page. I thought of mapping this page unreadable, and then monitor tdp_page_fault() to catch accesses to the interesting guest page. According to the Intel manual (Table 28-6, Volume 3C), bits 0, 1, 2 of an EPT entry indicate if a page is readable, writable, and executable, respectively. My understanding is that if I clean the 0 bit of an EPT entry, an access to its page will trigger a violation, which I would see it in the tdp_page_fault() function. I thought that an spte in kvm represents an EPT entry. However, mmu.c checks the PRESENT bit on an spte, e.g., __rmap_write_protect(), which would suggest that I completely misunderstand what's going on. Thus, I'm worried that if I clean the 0 bit of an spte, it will all explode. I've started studying the KVM mmu code only very recently, so I'm not sure how to achieve what I need. All help will be appreciated. Thanks a lot! Best, asia -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
