Vitaly Kuznetsov

A whole bunch of CPU vulnerabilities were revealed in the past few years: Meltdown and Spectre, SSB, L1TF and MDS -- and there's little hope that we've seen them all. Every time there is a new vulnerability released, big cloud provides on day 1 claim that their hosts were updated and that their users are secure. Is this so or do we also need to do something inside our Linux guests to mitigate these vulnerabilities? And, do we have the required tools to actually do the mitigations? Are all of them enabled by default or not? And, if not, why? In the talk I'll try to answer these questions.

The talk will cover recently discovered CPU vulnerabilities starting with Meltdown and Spectre. I will go through them and try to highlight 'public cloud specifics': what has/can to be done in the infrastructure of the cloud and what has/can be done inside Linux guests depending on the desired level of security and usage patterns.

Is running a Windows guest any different from Linux from KVM's perspective? KVM can pretend being Hyper-V and this is actively used for running Windows guests. Following Hyper-V naming convention, individual features are named "enlightenments": some of them are already mature, some of them were just added to KVM and some are still waiting to be implemented. What are these features and how Windows guests use them? How is it different from Linux?

Attendees of the talk will get to know the current status and the ongoing work for Hyper-V emulation in KVM, how this impacts Windows guests. Some benchmarks won't be missing too. The talk is intended for virtualization development engineers as well as system administration running KVM in production. In the talk both the internals of Hyper-V emulation in KVM and practical advises on how to run Windows guests on KVM will be discussed.

This may come as a surprise but it is already possible to run nested KVM inside Hyper-V VMs (and this includes several instance types on Azure). Such workloads, however, may not always perform very well. Some limitations come from x86 architecture and conceptual differences between KVM and Hyper-V, other issues could be dealt with within KVM. In this talk Vitaly will go through different performance bottlenecks of nested KVM-on-Hyper-V deployments. The presentation will mainly be focused on low-level features: hardware support for nested virtualization, clocksources and clockevents, virtual device drivers. Benchmark data and general thoughts on the usefulness of such deployments won't be missing too.

In the talk Vitaly will try to highlight challenges in heterogeneous nested virtualization, namely the current status, issues and future work for running KVM on top of Hyper-V. The talk is intended for everyone interested in virtualization technologies. Less experienced people may learn about the very basics of virtualization in nested environments (and, actually, virtualization in general), experienced developers may find something interesting in learning about 'non-traditional' nesting, review the suggested approaches or even suggest a solution.