Guest Memory Protection -- Current Status and Future
summary
Status update on a working Guest Memory Protection prototype that integrates into Linux KVM and QEMU and leverages hardware page‑table extensions (EPT/VMX) to enforce read/write/execute limits on guest pages. The demo protects whole VM regions (prototype tests cover up to 8 GB) via a kernel patch and a userland test harness, shows microbenchmark numbers (median overhead about 3%), and outlines missing hardware hooks and the short roadmap to make enforcement efficient and mainstream.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 3:37Guest memory protection explained
- 7:45Current challenges and solutions
- 12:20Future directions and improvements
- 16:45Q&A and summary
related talks
38mUnmapped Private Memory for Confidential Guests
41mHypervisor-Enforced Kernel Integrity (Heki) for KVM
39mHeki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
20mUnmapped Private Memory for Confidential Guests
50mProtected KVM on Arm64: A Technical Deep Dive
38mKernel Hardening: Protecting the Protection Mechanisms
32mSeeing Through The Same Lens...
17mStatus Update on TDX Support