Description
KVM (Kernel-based Virtual Machine) enables the use of hardware features to
improve the efficiency, performance, and security of virtual machines
created and managed by userspace. KVM was originally developed to host
and accelerate "full" virtual machines running a traditional kernel and
operating system, but has long since expanded to cover a wide array of use
cases, e.g. hosting real time workloads, sandboxing untrusted workloads,
deprivileging third party code, reducing the trusted computed base of
security sensitive workloads, etc. As KVM's use cases have grown, so too
have the requirements placed on KVM and the interactions between it and
other kernel subsystems.
The KVM Microconference will focus on how to evolve KVM and adjacent
subsystems, with a strong emphasis on all things guest_memfd.
Potential Topics:
- 1GiB hugepage support for guest_memfd[1]
- KVM Userfault, or: demand paging support for guest_memfd[2]
- Removing guest memory from the host kernel's direct map[3]
- Eliminating "struct page" for guest_memfd
- Paravirtual scheduling
- Nested virtualizaton optimizations, e.g. PV APIs for "nested" VMs
Successes from LPC 2024:
- KVM x86's mediated virtual PMU support landed in 7.0[4]
- pKVM support for protected anonymous memory landed in 7.1[5]
- In-place private<=>shared conversion for guest_memfd[6] is nearing
inclusion (likely 7.2 or 7.3)
[1] https://lore.kernel.org/all/cover.1747264138.git.ackerleytng@google.com
[2] https://lore.kernel.org/all/20250618042424.330664-1-jthoughton@google.com
[3] https://lore.kernel.org/all/20260410151746.61150-1-kalyazin@amazon.com
[4] https://lore.kernel.org/all/20251206001720.468579-1-seanjc@google.com
[5] https://lore.kernel.org/all/177505732748.363663.16964917665296494635.b4-ty@kernel.org
[6] https://lore.kernel.org/all/20260507-gmem-inplace-conversion-v6-0-91ab5a8b19a4@google.com
-
Mostafa Saleh (Google)
As Protected KVM (pKVM) progresses on arm64, achieving full isolation requires hypervisor-controlled IOMMUs to prevent DMA attacks. While there has been progress on SMMUv3 support for pKVM via trap-and-emulate on the mailing list [1], a major architectural design question remains unresolved: managing the stage-2 translation tables.
Currently, the series relies on maintaining a shadow...
Go to contribution page -
Pratyush Yadav, Tarun Sahu (Google)
Orhpaned VMs [0] is proposed to be the next evolution of hypervisor live update. It relies on a specialized micro-hypervisor, called the Caretaker, which handles VM Exits during the time between old kernel shutting down and new kernel booting up. The Caretaker reduces the downtime observed by the VM during live update by servicing VM Exits during this transition period.
The Caretaker is not...
Go to contribution page -
Pasha Tatashin
As cloud infrastructure continues to push toward zero-downtime host maintenance, extending the capabilities of kexec-based Live Update to minimize guest disruption is becoming increasingly critical. This proposal introduces the architectural concept of an "Orphaned VM"โa virtual machine that actively executes guest instructions on isolated physical hardware while completely decoupled from a...
Go to contribution page -
Ackerley Tng
To improve performance of CoCo VMs, there's active work on huge pages for guest_memfd. The first "backend" in the works for providing huge pages is HugeTLB.
Frank summarized interest in having devdax/ZONE_DEVICE memory as another backend [1] for guest_memfd.
If guest_memfd is to be the guest memory provider of KVM, it has to support (almost) any memory backend that can be configured in...
Go to contribution page -
Claudio Imbrenda (IBM)
KVM uses the mmu_notifier infrastructure to keep the guest mapping up to date. After having completely rewritten the memory management of KVM/s390 to use mmu_notifiers, I have noticed some of the shortcomings in how KVM uses the notifiers.
Some of areas where KVM's usage of the notifiers, or the mmu_notifier infrastructure itself can be improved:
- passing the reason code to the KVM...