Now You See Me, Now You Don't: Splitting pKVM Into Discrete, Mutually Exclusive Addr...
summary
pKVM adds a set of mutually exclusive address spaces so each vCPU state and its hypervisor stack live only on one physical CPU at a time, using an extra TTBR/ASID slot to atomically switch page-table root and ASID. Implementation requires one extra page-table set, one TL2 stack page per CPU, an ASID allocator (≈2^16 entries), and a zero page for idle CPUs. It yields per-vCPU fixed maps and prevents driver modules from co-residence with vCPUs, improving isolation without breaking execution flow.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:16Buggy Software
- 5:45Exception Levels
- 13:29Extras
- 16:05VCPU Isolation
- 22:08Mobile Isolation
related talks
49mKVM Address Space Isolation
38mUnmapped Private Memory for Confidential Guests
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
30mRestricted Address Spaces for Container Security
50mMPK/PKS Linux Kernel Compartmentalization
23mHyper-V's Virtual Secure Mode in KVM project update
20mUnmapped Private Memory for Confidential Guests