Effective Virtual CPU Configuration with QEMU and Libvirt

Effective Virtual CPU Configuration with QEMU and Libvirt

<p><strong>Effective Virtual CPU Configuration with QEMU and libvirt </strong></p><p>Kashyap Chamarthy &lt;[email protected]&gt; </p><p>Open Source Summit Edinburgh, 2018 </p><p>1 / 38 </p><p><strong>Timeline of recent CPU flaws, 2018 (a) </strong></p><p>Jan 03&nbsp;• <strong>Spectre v1</strong>: Bounds Check Bypass Jan 03&nbsp;• <strong>Spectre v2</strong>: Branch Target Injection Jan 03&nbsp;• <strong>Meltdown</strong>: Rogue Data Cache Load May 21&nbsp;• <strong>Spectre-NG</strong>: Speculative Store <br>Bypass </p><p>Jun 21&nbsp;• <strong>TLBleed</strong>: Side-channel attack over shared TLBs </p><p>2 / 38 </p><p><strong>Timeline of recent CPU flaws, 2018 (b) </strong></p><p>Jun 29&nbsp;• <strong>NetSpectre</strong>: Side-channel attack over local network </p><p>Jul 10&nbsp;• <strong>Spectre-NG</strong>: Bounds Check Bypass <br>Store </p><p>Aug 14&nbsp;• <strong>L1TF</strong>: "L1 Terminal Fault" </p><p><strong>. . .&nbsp;</strong>• </p><p>?</p><p>3 / 38 </p><p><strong>What this talk is not about </strong></p><p>4 / 38 </p><p><strong>What this talk is not about </strong></p><p><strong>Out of scope: </strong></p><p>Internals of various side-channel attacks How to exploit Meltdown &amp; Spectre variants Details of performance implications </p><p>4 / 38 </p><p><strong>What this talk is not about </strong></p><p><strong>Out of scope: </strong></p><p>Internals of various side-channel attacks How to exploit Meltdown &amp; Spectre variants Details of performance implications </p><p>&nbsp;&nbsp;<strong>Related talks in the ‘References’ section </strong></p><p>4 / 38 </p><p><strong>KVM-based virtualization components </strong></p><p>Linux with KVM </p><p>5 / 38 </p><p><strong>KVM-based virtualization components </strong></p><p>QEMU </p><p>VM1 </p><p>QEMU </p><p>VM2 </p><p></p><ul style="display: flex;"><li style="flex:1">Disk1 </li><li style="flex:1">Disk2 </li></ul><p></p><p><strong>ioctl() </strong></p><p>Linux with KVM </p><p>5 / 38 </p><p><strong>KVM-based virtualization components </strong></p><p>libvirtd <br>QEMU </p><p>VM1 </p><p>QEMU </p><p>VM2 </p><p></p><ul style="display: flex;"><li style="flex:1">Disk1 </li><li style="flex:1">Disk2 </li></ul><p></p><p><strong>ioctl() </strong></p><p>Linux with KVM </p><p>5 / 38 </p><p><strong>KVM-based virtualization components </strong></p><p>OpenStack, et al. </p><p><strong>Virt Driver </strong></p><p>libvirtd <br>QEMU </p><p>VM1 </p><p>QEMU </p><p>VM2 </p><p></p><ul style="display: flex;"><li style="flex:1">Disk1 </li><li style="flex:1">Disk2 </li></ul><p></p><p><strong>ioctl() </strong></p><p>Linux with KVM </p><p>5 / 38 </p><p><strong>KVM-based virtualization components </strong></p><p>OpenStack, et al. </p><p>libguestfs </p><p><strong>Virt Driver </strong></p><p>(guestfish) libvirtd </p><p>QEMU </p><p>VM1 </p><p>QEMU </p><p>VM2 </p><p><strong>Custom Appliance </strong></p><p></p><ul style="display: flex;"><li style="flex:1">Disk1 </li><li style="flex:1">Disk2 </li></ul><p></p><p><strong>ioctl() </strong></p><p>Linux with KVM </p><p>5 / 38 </p><p><strong>QEMU and KVM </strong></p><p><strong>QEMU </strong></p><p>Guest RAM </p><ul style="display: flex;"><li style="flex:1">e1000e </li><li style="flex:1">NVMe Virtio-SCSI </li></ul><p></p><ul style="display: flex;"><li style="flex:1">vCPU-2 </li><li style="flex:1">vCPU-1 </li></ul><p></p><p><strong>ioctl()</strong>→<strong>/dev/kvm </strong></p><p><strong>Host kernel </strong></p><p>[kvm.ko; kvm-intel.ko] VMX modes: guest↔host </p><p>Emulation: CPUID, irqchip </p><p><strong>VMLAUNCH, ... </strong></p><p><strong>Hardware: </strong>Intel VMX extensions </p><p>6 / 38 </p><p><strong>QEMU and KVM </strong></p><p><strong>QEMU </strong></p><p>Guest RAM </p><ul style="display: flex;"><li style="flex:1">e1000e </li><li style="flex:1">NVMe Virtio-SCSI </li></ul><p></p><ul style="display: flex;"><li style="flex:1">vCPU-2 </li><li style="flex:1">vCPU-1 </li></ul><p></p><p><strong>ioctl()</strong>→<strong>/dev/kvm </strong></p><p>To inspect, use Linux tools: </p><p><strong>Host kernel </strong></p><p>[kvm.ko; kvm-intel.ko] VMX modes: guest↔host </p><p>Emulation: CPUID, irqchip </p><p>top, kill, ... </p><p><strong>VMLAUNCH, ... </strong></p><p><strong>Hardware: </strong>Intel VMX extensions </p><p>6 / 38 </p><p><strong>Hardware-based virtualization with KVM </strong></p><p>KVM prepares </p><p><strong>VMENTER </strong></p><p>to enter CPU Guest Mode </p><p>QEMU issues </p><p>ioctl(KVM_RUN) </p><p>Perform in-kernel emulation <br>Execute natively </p><p>in Guest Mode. (CPU with VMX) </p><p><strong>VMEXIT </strong></p><p>Yes No <br>QEMU emulates hardware <br>Emulate </p><p>in-kernel? </p><p>7 / 38 </p><p>Part I </p><p><strong>Interfaces to configure vCPUs </strong></p><p>8 / 38 </p><p><strong>x86: QEMU’s default CPU models (a) </strong></p><p>The default models (qemu32, qemu64) work on any host CPU </p><p>9 / 38 </p><p><strong>x86: QEMU’s default CPU models (a) </strong></p><p>The default models (qemu32, qemu64) work on any host CPU </p><p>But they are dreadful choices! </p><p>9 / 38 </p><p><strong>x86: QEMU’s default CPU models (a) </strong></p><p>The default models (qemu32, qemu64) work on any host CPU </p><p>But they are dreadful choices! </p><p>No AES / AES-NI: critical for TLS performance No RDRAND: important for entropy No PCID: performance- &amp; security-critical (thanks, Meltdown) </p><p>9 / 38 </p><p><strong>x86: QEMU’s default CPU models (b) </strong></p><p>$ cd /sys/devices/system/cpu/vulnerabilities/ $ grep . * </p><p>l1tf:Mitigation: PTE Inversion meltdown:Mitigation: PTI </p><p>spec_store_bypass:Vulnerable </p><p>spectre_v1:Mitigation: __user pointer sanitization spectre_v2:Mitigation: Full generic retpoline </p><p>10 / 38 </p><p><strong>x86: QEMU’s default CPU models (b) </strong></p><p>$ cd /sys/devices/system/cpu/vulnerabilities/ $ grep . * </p><p>On a guest running with qemu64 </p><p>l1tf:Mitigation: PTE Inversion meltdown:Mitigation: PTI </p><p>spec_store_bypass:Vulnerable </p><p>spectre_v1:Mitigation: __user pointer sanitization spectre_v2:Mitigation: Full generic retpoline </p><p>10 / 38 </p>

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    77 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us