pvm

Host and guest kernel build pipelines for PVM (pagetable-based virtualization): run Cloud Hypervisor microVMs on hosts without hardware virtualization — any GCP instance with no nested-virt, any cloud VM whose provider disables it. Ships Ubuntu-installable host kernel debs carrying the kvm_pvm module, and a module-free direct-boot guest vmlinux, both built from one pinned kernel tree.

Documentation: https://cocoonstack.github.io/pvm/

Highlights

• Host pipeline — newest Ubuntu linux-gcp config as base + a one-line fragment (CONFIG_KVM_PVM=m) → bindeb-pkg. Install, reboot, and stock Cloud Hypervisor binaries use /dev/kvm unchanged.
• Guest pipeline — sandbox-style module-free config + PVM enlightenment (CONFIG_X86_PIE, CONFIG_PVM_GUEST) → vmlinux-pvm-amd64, booted via --kernel like any cocoon/sandbox guest kernel.
• One pin — kernel.pin points both pipelines at cocoonstack/linux-pvm, our mirror of virt-pvm/linux branch pvm-612 (Linux 6.12 LTS).
• Hard limits (by PVM's design, see docs): x86_64 only, direct kernel boot only — no UEFI firmware path, therefore no Windows guests.

Quick start

On a GCP Ubuntu 24.04 instance (Secure Boot off):

# host: install the PVM kernel, one-shot boot, validate, then commit
sudo ./install.sh .          # debs from the latest release
sudo reboot
lsmod | grep kvm_pvm && ls /dev/kvm
sudo ./install.sh --commit .

# guest: boot the released vmlinux with stock Cloud Hypervisor
./cloud-hypervisor --kernel vmlinux-pvm-amd64 \
  --cmdline "console=ttyS0 root=/dev/vda rw" \
  --disk path=rootfs.img --serial tty --console off \
  --cpus boot=2 --memory size=1024M

Layout

• kernel.pin — the single source pin both pipelines build from
• configs/ — config fragments; configs/upstream/ vendors virt-pvm's reference configs for diffing
• guest/, host/ — the two build pipelines
• scripts/ — source fetch, smoke test, GCP end-to-end validation
• .github/workflows/ — CI: per-path builds, tag-driven releases

Development

make guest, make host (dockerized local builds), make smoke, make lint.

Related projects

• cocoon — the MicroVM platform these kernels plug into
• sandbox — AI-agent sandboxes; its guest boot chain is the template for the guest pipeline here
• linux-pvm — pinned kernel source mirror

License

MIT for everything in this repository. Released kernel binaries are GPL-2.0; their complete corresponding source is the kernel.pin commit of cocoonstack/linux-pvm.