Nesting Secure VM Hosts
summary
Nesting secure hosts on s390 implements nested secure vCPUs with about 300 lines of code and a broader Trusted Entity emulation prototype totalling 2,000 lines of KVM code (≈80 lines ABI emulation, ≈10 memory, ≈10 secure-vCPU tests). Linux and KVM unit tests run nested secure guests but full architecture compliance is unfinished. Key hurdles are memory donation and access protection, heavy API emulation, migration likely disabled, and teardown on guest reboot; performance is not yet measured.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:18Secure Host Nesting
- 3:05Reasons for Nesting
- 3:35Three Things That Are Needed To Nest Secure Vms
- 9:17Problems
- 10:00Page Management Performance
- 11:13Migration
- 13:48Vm to Hypervisor
related talks
12mSecurity and Performance in the Delegated User-level Virtualization
24mThe Common Challenges of Secure VMs
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
45mSecuring Confidential VMs with COCONUT-SVSM
23mHyper-V's Virtual Secure Mode in KVM project update
34mTailor-Made Security: Building a Kubernetes Specific Hypervisor
47mLinux Virtualization Based Security
38mUnmapped Private Memory for Confidential Guests