Leaking data through recursive mappings forces 4KiB pages in the hypervisor

[dancrossnyc]

The recursive paging technique allows us to access entries in our page tables at fixed virtual addresses, meaning that we can manipulate virtual mappings without, e.g., a direct-offset map from physical to virtual memory. The side-loading technique allows us to access another page table similar fixed virtual addresses.

However, note that this means that Huge become Large pages, and Large pages become 4KiB pages in the recursive areas, still mapping to page data, not just page table entries: the recursive entry effectively cuts one level off of the page table walk, but since walks for Huge and Large pages terminate "early", we can still reach data.

Much of the use of design of virtual memory in Hypatia is predicated on using recursive page mappings.

Thus, for any data that we deem sensitive, we must take special care to ensure those memory regions are mapped in the hypervisor using 4KiB pages. We can still use Huge and Large pages for hypervisor text and read-only data (we we presume aren't secret, since Hypatia is open source), but we shouldn't use them for anything else.