PVM Virtualization Framework Proposed For Linux - Built Atop The KVM Hypervisor

Ant Group and Alibaba have proposed PVM, the Pagetable Virtual Machine, as a new virtualization framework built upon the Kernel-based Virtual Machine (KVM) hypervisor. PVM does not require hardware-assisted virtualization while working with KVM-enabled software like Kata Containers.

Ant Group and Alibaba Cloud are already using the Pagetable Virtual Machine in a production environment across "tens of thousands of secure containers daily" and now has been submitted under a Request For Comments (RFC) flag for the upstream Linux community.

The motivation for PVM was described as:

"A team in Ant Group, co-creator of Kata Containers along with Intel, deploy the VM-based containers in our public cloud VM to satisfy dynamic resource requests and various needs to isolate workloads. However, for safety, nested virtualization is disabled in the L0 hypervisor, so we cannot use KVM directly. Additionally, the current nested architecture involves complex and expensive transitions between the L0 hypervisor and L1 hypervisor.

So the over-arching goals of PVM are to completely decouple secure container hosting from the host hypervisor and hardware virtualization support to:

1) enable nested virtualization within any IaaS clouds without affecting the security, flexibility, and complexity of the cloud platform;

2) avoid costly exits to the host hypervisor and devise efficient world switching mechanisms."

PVM is compatible with existing KVM software, does not require nested virtualization hardware capabilities, works around secure container needs, and allows for lightweight container kernels.

The downside of PVM is the shadow paging that can take on a significant performance hit if the guest application is frequently modifying the page table. Bit for "long-running cloud services" the performance of PVM is said to be good and there are various optimizations to offset the performance issues.

Currently the PVM virtualization framework code amounts to nearly seven thousand lines of new kernel code spread across 73 patches. The initial RFC patches are out for discussion on the Linux kernel mailing list.