Hyper-V's Virtual Secure Mode in KVM project update
summary
A VSM proof-of-concept for KVM exists and a first patch series is imminent; two concrete designs compete: keep VTLs as separate vCPUs with kernel VTL awareness or implement a struct KVM per-vTL and push complexity to userspace. The prototype copies CPU registers through userspace (currently “blazingly fast” at boot), but challenges remain: per-VTL EPTs and memory attributes, explosion of page-table reference counts, thousands of VTL switches during Windows boot, and a proposed get_many_regs ioctl plus overlay/memslot changes to avoid massive syscall overhead.
AI-written summary · about
chapters (11)
- 0:00Introduction to VSM in KVM
- 1:48Two VSM implementation approaches
- 3:34Kernel complexity vs user space
- 6:45Hardware support for VSM
- 8:12Customer demand for VSM
- 10:01Performance overhead of VTL transitions
- 12:14State sharing between VTLs
- 14:00Register synchronization methods
- 16:29Memory slot control granularity
- 19:02Polling and event sources
- 21:11Multi-KVM alignment for VSM
related talks
21mEmulating Hyper-V in 2022
47mLinux Virtualization Based Security
12mSecurity and Performance in the Delegated User-level Virtualization
32mLVBS and Advanced Kernel Integrity
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
38mPanel Discussion: KVM-based Virtualization Contributor Q&A
50mPanel Discussion: KVM-based Virtualization Contributor Q&A