Peter Feiner asked me an intriguing question the other day. If you have a hypervisor that walks its guest's x86 page tables in software during emulation, how can you make that software page walk behave exactly like a hardware page walk? In particular, when the hypervisor is running as an L1 guest, how is it possible to write the software page walk so that accesses to L2's x86 page tables are treated as reads if L0 isn't using EPT A/D bits, but they're treated as writes if L0 is using EPT A/D bits? (Paravirtualization is not allowed.) It seems to me that this behavior isn't virtualizable. Am I wrong?