Panel Discussion: KVM-based Virtualization Contributor Q&A
summary
Panel covers concrete engineering tradeoffs for confidential VMs: hardware key management, cache tagging and memory-controller encryption, and migration of encrypted memory. Use cases beyond public clouds include BYOD and edge consolidation. Vendors discuss integrating features into AMD SEV and Intel TDX, offering cryptographic plus logical isolation, and exposing key IDs to QEMU/libvirt. Notes include practical tooling (Firecracker/cloud-hypervisor, Rust VMMs), upstream timing problems, and advice to submit small patches and prototype in emulation.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 1:00Richard Jones
- 1:30Peter Maida
- 1:55Frank
- 7:30Isolation
- 8:20What do we do
- 9:00Is it prudent to think about this
- 10:50Cloud and hardware
- 11:30Innovation
- 13:15Portability
- 15:25Thoughts on Arm
- 16:50CPU Architectures
- 17:30Encrypted VMs
- 19:25Uniform software interface
- 20:10Collaboration
- 21:20Management stacks
- 21:50How has libbert changed
- 27:10Specialization vs generalization
- 27:50Personal preferences
- 30:05Intel
- 37:30Getting into Open Source
- 38:00Stop submitting patches
- 38:35Working at a low level
- 40:35How to get started
- 42:45Making it harder to contribute
- 43:40Raising standards
- 44:50Containers vs VMs
- 45:20Container security
- 47:45Is this a final choice
- 48:45Economic impact
related talks
38mPanel Discussion: KVM-based Virtualization Contributor Q&A
27mDay 2 Keynote Sessions
23mHyper-V's Virtual Secure Mode in KVM project update
23mDemystifying Confidential Computing: An update for enthusiasts & professionals
18mSecurely booting confidential VMs with encrypting disk
16mUnifying KVM API for protected VM and utilities
26mDay 1 Keynote Sessions
31mKVM Nested Virtualization: Workings and Usecases