3 ms·
If sensitive data is isolated in an EL1 pKVM VM, it is protected from compromise of host OS that is also at EL1, thanks to hypervisor at EL2.
by transpute 2y ago
If sensitive data is isolated in an EL1 pKVM VM, it is protected from compromise of host OS that is also at EL1, thanks to hypervisor at EL2.
- sulandor 2y agothat's a matter of terminology. i'd argue that what you describe as "host" is rather a management vm which is allowed to talk directly to the hypervisor. though, through this privilege is most likely able to compromise it and all other guests. but this doesn't really matter as the attack vector we are talking about already has dma and does not care about any of that.