Kernel

The original PVM kernel tree was based on Linux 6.12.x, while current Linux master had reached 7.2. This note records the commands I used to build, package, and boot the forward port. The resulting tree is available in the pvm-720 branch. PVM in short PVM (Pagetable-based Virtual Machine) is a KVM guest hypervisor designed for running nested workloads without requiring VMX or SVM. Essentially native or nested virtualization HW functionality is NOT required! It uses a small shared region for privilege transitions and efficient shadow page tables for memory virtualization. The design is described in the SOSP '23 paper PVM: Efficient Shadow Paging for Deploying Secure Containers in Cloud-native Environments. The original code is in the virt-pvm/linux repository. ...

"While minimal kernels cannot prevent every vulnerability, reducing attack surface by removing unnecessary kernel features, drivers, and services can proactively mitigate many classes of security issues and reduce exploitability." For a long time, Linux optimization work was seen mostly as a performance exercise. Faster boot times. Smaller images. Lower RAM usage. Better cache behavior. But over the years, something interesting became increasingly obvious: Optimization and security are often deeply related. ...