How to unmap a spte?

Question

I am looking for a way to catch "read" on a particular gfn in kvm source.

Looks like the function stack removes the write permission for the given page, by flipping write bit using PT_WRITABLE_MASK. Thus trapping writes.

rmap_write_protect(kvm, gfn) --> kvm_mmu_rmap_write_protect(kvm, gfn, slot)

For trapping reads, I see equivalent flag PM_PRESENT_MASK. Thus one way probably is writing wrapper routines similar to above to flip both read(present) and write bits. Or would it be just enough to drop the spte instead using below function ? drop_spte()

Is kvm_flush_remote_tlbs() required after either of above approaches ?

Answer 1

kvm_flush_remote_tlbs is required because even though you write protect or drop the guest page form the current CPU their mapping might be cached in the other CPU tlbs. After you do drop_spte whenever the guest tries to access the particular gfn it will trap to the host. The corresponding entry in EPT is updated in the __direct_map function. If you want trap on every access, you should prevent kvm to create such mapping, instead you can emulate that instruction in kvm by calling emulate_instruction.