On Fri, Jun 25, 2021 at 10:57:51AM +0200, Paolo Bonzini wrote: > On 25/06/21 10:47, Yu Zhang wrote: > > > But if L1 is crafty, it can load a new CR4 on VM-Exit and toggle LA57 > > > without having to bounce through an unpaged section. L1 can also load a > > > > May I ask how this is done by the guest? Thanks! > > It can set HOST_CR3 and HOST_CR4 to a value that is different from the one > on vmentry. Thanks, Paolo. Do you mean the L1 can modify its paging mode by setting HOST_CR3 as root of a PML5 table in VMCS12 and HOST_CR4 with LA57 flipped in VMCS12, causing the GUEST_CR3/4 being changed in VMCS01, and eventually updating the CR3/4 when L0 is injecting a VM Exit from L2? B.R. Yu > Paolo >
