On Tue, 2024-02-27 at 09:27 -0800, Sean Christopherson wrote: > > The bulk of the pain with nested hardware virtualization lies in having to emulate > VMX/SVM, and shadow L1's TDP page tables. Hyper-V's eVMCS takes some of the sting > off nVMX in particular, but eVMCS is still hobbled by its desire to be almost > drop-in compatible with VMX. > > If we're willing to define a fully PV interface between L0 and L1 hypervisors, I > suspect we provide performance far, far better than nVMX/nSVM. E.g. if L0 provides > a hypercall to map an L2=>L1 GPA, then L0 doesn't need to shadow L1 TDP, and L1 > doesn't even need to maintain hardware-defined page tables, it can use whatever > software-defined data structure best fits it needs. I'd like to understand how, if at all, this intersects with the requirements we have for pKVM on x86. For example, would pKVM run the untrusted part of the kernel as a PVM guest using this model? Would the PV interface of which you speak also map to the calls from the kernel into the secure pKVM hypervisor... ?
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
