Matthew GarrettMy annual plea for a thing: I want a type 1 hypervisor that just has a small isolated VM and then passes through the rest of the hardware to the main VM which runs Linux. The small VM is intended to be used to run small pieces of code that the main OS should not be able to interfere with. Does such a thing exist? (Think Xen, but with a Dom0 that can't see into DomUs)
bluca@mjg59 there's work in progress by @l0kod but don't think it's merged yet: https://lore.kernel.org/all/2024050313[email protected]/
Mickaël Salaün@mjg59 @bluca kind of, Heki is the equivalent of Windows's Virtualization Based Security (foundation of Credential Guard and other security mechanisms) for Linux (with KVM or Hyper-V). The host/VMM is part of the TCB like the hypervisor, but the Linux guest VM requests the hypervisor to protect itself (guest). For now this is only CR-pinning (v3) and memory permissions (v2). We could probably implement the same mechanism with Jailhouse, but that would remove a lot of VM use cases