linux-kernel - Re: [PATCH 05/54] Revert "KVM: x86/mmu: Drop kvm_mmu_extended_role.cr4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210625092902.o4kqx67zvvbudggh@linux.intel.com>
Date:   Fri, 25 Jun 2021 17:29:02 +0800
From:   Yu Zhang <yu.c.zhang@...ux.intel.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     Sean Christopherson <seanjc@...gle.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Maxim Levitsky <mlevitsk@...hat.com>
Subject: Re: [PATCH 05/54] Revert "KVM: x86/mmu: Drop
 kvm_mmu_extended_role.cr4_la57 hack"

On Fri, Jun 25, 2021 at 10:57:51AM +0200, Paolo Bonzini wrote:
> On 25/06/21 10:47, Yu Zhang wrote:
> > > But if L1 is crafty, it can load a new CR4 on VM-Exit and toggle LA57
> > > without having to bounce through an unpaged section.  L1 can also load a
> > 
> > May I ask how this is done by the guest? Thanks!
> 
> It can set HOST_CR3 and HOST_CR4 to a value that is different from the one
> on vmentry.

Thanks, Paolo.

Do you mean the L1 can modify its paging mode by setting HOST_CR3 as root of
a PML5 table in VMCS12 and HOST_CR4 with LA57 flipped in VMCS12, causing the
GUEST_CR3/4 being changed in VMCS01, and eventually updating the CR3/4 when 
L0 is injecting a VM Exit from L2? 

B.R.
Yu

  

> Paolo
>