On 14/02/19 18:31, Jim Mattson wrote: >> Theoretically we can use the single stepping with CR4.SMAP=0. > > SEV allows the hypervisor to override the guest OS's CR4.SMAP > setting?!? That seems counter-intuitive, given SEV's intended use. > Doesn't this potentially give a ring-3 agent in the guest an avenue to > privilege escalation through collusion with the hypervisor? The first version does not protect any register content. See this paper for an example: https://arxiv.org/pdf/1612.01119.pdf Paolo
