5 ms·

PVM Virtualization Framework Proposed for Linux – Built Atop the KVM Hypervisor

• westurner 3y ago
  > Pagetable Virtual Machine >> for safety, nested virtualization is disabled in the L0 hypervisor, so we cannot use KVM directly. Additionally, the current nested architecture involves complex and expensive transitions between the L0 hypervisor and L1 hypervisor. >> "So the over-arching goals of PVM are to completely decouple secure container hosting from the host hypervisor and hardware virtualization support to: [1. Enable nested virtualization, and 2.] avoid costly exits to the host hypervisor and devise efficient world switching mechanisms. Intel VT and AMD-V were not built for pagetable virtualization. What CPU changes would make Pagetable Virtualization more efficient?
  • njubee 3y ago
    Nothing changed to the CPU that favors PVM. PVM is more efficient than Intel VT and AMD-V on nested virtualization since PVM doesn't cause VMexit back to L0 hypervisor in (al)most cases while Intel VT and AMD-V often involve L0/L1/L2 dancing. The name "Pagetable Virtual Machine" mainly comes from its privilege-separation. X86_64 doesn't have ring1 nor enforce segment limits, so it cannot use ring1+segment like xenpv 32-bit. Separated pagetables are the only solution for privilege-separation. Except for virtualizing addresses, pagetables are also crucial for mapping the switcher, emulating SMEP/SMAP, and so on.
• henrytan 3y ago
  > The downside of PVM is the shadow paging that can take on a significant performance hit if the guest application is frequently modifying the page table. By codesign of the guest and host kernels, it may be possible to unify the guest, shadow, and host page tables into a single set of host page tables.