On 10/19/2018 10:49 PM, Peter Feiner wrote: > > What about handling an spte with AD bits? Don't you have to mark the pfn dirty if the D bit is set? And that would require a TLB shootdown *after* clearing the D bit, right? Which would require 2 EPT walks to be implemented using a single shoot down. ... What am I missing here? This function is only used for write-protection, not clearing D bits. The D-bit test/clear happens in a different code path, through spte_test_and_clear_dirty(). We do need a TLB shootdown afterwards, but it can be done just once after going over the whole memory slot. Thanks, Junaid