Address Space Isolation is ready
summary
Claims ASI now defends against native attackers as well as KVM guests and shows a working prototype that fixes the page-cache slowdown that previously killed performance. Implementation uses a new allocator flag (GFP_UNMAP) and a local mapping primitive (merm map) to avoid TB shootdowns; initial series splits into ~21 patches with a full set expected nearer 40–100. Prototype measurements show large wins over current mitigations on SMT/Skylake workloads and the repo/branch and RFC are being prepared for patch review.
AI-written summary · about
chapters (12)
- 0:00Introduction and status
- 2:07Why CPU mitigations aren't enough
- 5:19ASI mitigates VMs before we knew
- 9:29Current code status and challenges
- 14:49Page table refactoring ideas
- 23:14Architecture-specific vs generic code
- 26:54Optional task isolation with ASI
- 28:21Solving guest memory unmap issues
- 35:44MerMap for CPU-local mappings
- 41:03Performance benefits of ASI
- 43:35Next steps and patch expectations
- 47:39Q&A and closing
related talks
49mKVM Address Space Isolation
27mMitigating speculative execution attacks with ASI - follow up
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
30mRestricted Address Spaces for Container Security
24mShielding Software From Privileged Side-Channel Attacks
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
25mKernel Self-Protection Project
38mUnmapped Private Memory for Confidential Guests