Re: [RFC KVM 02/27] KVM: x86: Introduce address_space_isolation module parameter

[Alexandre Chartre]

On 5/13/19 5:46 PM, Andy Lutomirski wrote:
> On Mon, May 13, 2019 at 7:39 AM Alexandre Chartre
> <alexandre.chartre@xxxxxxxxxx> wrote:
> > From: Liran Alon <liran.alon@xxxxxxxxxx>
> >
> > Add the address_space_isolation parameter to the kvm module.
> >
> > When set to true, KVM #VMExit handlers run in isolated address space
> > which maps only KVM required code and per-VM information instead of
> > entire kernel address space.
>
> Does the *entry* also get isolated?  If not, it seems less useful for
> side-channel mitigation.

Yes, context is switched before VM entry. We switch back to kernel address
space if VM-exit handler needs it or when exiting the KVM_RUN ioctl.

alex.