| 1 | <?xml version='1.0' encoding='UTF-8'?>
|
|---|
| 2 | <!DOCTYPE topic PUBLIC "-//OASIS//DTD DITA Topic//EN" "topic.dtd">
|
|---|
| 3 | <topic xml:lang="en-us" id="disable-nested-paging-mitigation">
|
|---|
| 4 | <title>Disable Nested Paging</title>
|
|---|
| 5 |
|
|---|
| 6 | <body>
|
|---|
| 7 | <p>
|
|---|
| 8 | By disabling nested paging (EPT), the VMM will construct page
|
|---|
| 9 | tables shadowing the ones in the guest. It is no possible for
|
|---|
| 10 | the guest to insert anything fishy into the page tables, since
|
|---|
| 11 | the VMM carefully validates each entry before shadowing it.
|
|---|
| 12 | </p>
|
|---|
| 13 | <p>
|
|---|
| 14 | As a side effect of disabling nested paging, several CPU
|
|---|
| 15 | features will not be made available to the guest. Among these
|
|---|
| 16 | features are AVX, AVX2, XSAVE, AESNI, and POPCNT. Not all
|
|---|
| 17 | guests may be able to cope with dropping these features after
|
|---|
| 18 | installation. Also, for some guests, especially in SMP
|
|---|
| 19 | configurations, there could be stability issues arising from
|
|---|
| 20 | disabling nested paging. Finally, some workloads may
|
|---|
| 21 | experience a performance degradation.
|
|---|
| 22 | </p>
|
|---|
| 23 | </body>
|
|---|
| 24 |
|
|---|
| 25 | </topic>
|
|---|
