Now You See Me, Now You Don't: Splitting pKVM Into Discrete, Mutually Exclusive Addr... Marc Zyngier
Channel: The Linux Foundation
Date: 08/10/2022

Now You See Me, Now You Don't: Splitting pKVM Into Discrete, Mutually Exclusive Address Spaces - Marc Zyngier, Google

pKVM is a confidential computing extension to KVM/arm64, ensuring mutual distrust between host and guests. Part of the hypervisor is separated from the de-privileged Linux host, and provides the required isolation primitives, which includes simple platform specific drivers (to program the IOMMUs, for example). However, isolation does not necessarily mean immunity to arbitrary read gadgets that could potentially leak some of the guest state, nor does it mean that drivers are perfect and won't mistakenly access data they have no business accessing. A proposed extension to pKVM adds a set of separate, independently tagged address spaces, each one containing either the state of a vcpu being currently managed by the hypervisor by a single physical CPU, or a driver that runs on that CPU in a de-privileged environment. By preventing vcpus and drivers from being co-resident on a physical CPU, pKVM can ensure a higher degree of isolation, mitigate the effect of potential bugs, and reduce the requirement for trust in drivers. This talk will revisit the way the hypervisor provides isolation, and put in perspective some of the common constructs used to prevent accidental data leakages.