On 5/13/19 5:46 PM, Andy Lutomirski wrote:
On Mon, May 13, 2019 at 7:39 AM Alexandre Chartre
<alexandre.chartre@xxxxxxxxxx> wrote:
From: Liran Alon <liran.alon@xxxxxxxxxx>
Add the address_space_isolation parameter to the kvm module.
When set to true, KVM #VMExit handlers run in isolated address space
which maps only KVM required code and per-VM information instead of
entire kernel address space.
Does the *entry* also get isolated? If not, it seems less useful for
side-channel mitigation.
Yes, context is switched before VM entry. We switch back to kernel address
space if VM-exit handler needs it or when exiting the KVM_RUN ioctl.
alex.
