Hypervisor-managed Linear Address Translation
summary
Extension to Intel VT-x exposes a hypervisor-controlled page table that enforces guest linear-address integrity by marking ranges as a protected linear range (PLR) and adding EPT flags like a verified paging write (VPW) and a restart bit so CPU page walks fall back to guest CR3 only on deliberate restart. Prototype patches land in KVM/QEMU with unit tests and a simulator; PoC shows previously successful page-table remaps now cause EPT violations, reducing VM exits compared with trapping CR3/EPT updates.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:25Agenda
- 1:15Problem in Page Table Based Access Control
- 2:23Typical Page Table Overriding Attacks
- 5:21HLAT - Nested Page Table Walk
- 6:42HLAT - Paging Structures
- 7:33EPT Control Bit "Paging-Write"
- 9:01EPT Control Bit "Verify Paging-write"
- 9:47Prevent Alias Mapping with PW & VPW
- 10:53Enforce Guest Translation Integrity
- 13:25Security Value
- 14:17Compare with Write-protecting CR3 Page Table
- 17:51Changes to Guest Kernel
- 19:01Status and Plan
related talks
21mUnmapped Guest Memory
20mKVM-devirt: Extending KVM to a Zero-Overhead Partition Hypervisor
50mProtected KVM on Arm64: A Technical Deep Dive
19mSharing IOMMU PageTables with TDP in KVM
17mMitigating Excessive Pause-Loop-Exiting in VM-Agnostic KVM
27meBPF-based Extensible Paravirtualization
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
10mDemo: Nested Virtualization Acceleration