On Thu, Mar 07, 2019 at 10:59:46AM -0800, Sean Christopherson wrote: > I think what we could do is repurpose role's nxe, cr0_wp, and > sm{a,e}p_andnot_wp bits to uniquely identify a nested EPT/NPT entry. Ignore the "NPT" comment, this would only apply to EPT. > E.g. cr0_wp=1 and sm{a,e}p_andnot_wp=1 are an impossible combination. > I'll throw together a patch to see what breaks. In fact, I think we > could revamp kvm_calc_shadow_ept_root_page_role() to completely ignore > all legacy paging bits, i.e. handling changes in L2's configuration is > L1's problem.