Abstract
PCI Passthrough is an x86 virtualization technology that enables low overhead, high performance I/O virtualization. It is an established technology in server and cloud computing environments and a promising technology for sharing I/O devices in future Cyber Physical Systems that consolidate mixed-criticality applications on multi-core CPUs. In this paper, we show that current implementations of x86 PCI Passthrough are prone to Denial-of-Service attacks. We demonstrate that attacks can be launched from within Virtual Machine environments and affect the performance of every I/O device on the interconnect. This means that malicious or malfunctioning applications inside Virtual Machines can impair the I/O performance of co-residential Virtual Machines. For example, attacking an SR-IOV capable Gigabit Ethernet NIC causes its TCP throughput to drop by 326 Mbit/s; latencies for reading 32 bit words from the NIC increase by over 650%. We investigate which hardware parameters influence the impact of such attacks and introduce three protection approaches.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Barham, P., Dragovic, B., Fraser, K., Hand, S., Harris, T., Ho, A., Neugebauer, R., Pratt, I., Warfield, A.: Xen and the art of virtualization. In: ACM SIGOPS Operating Systems Review, vol. 37, pp. 164–177. ACM (2003)
Dong, Y., Yang, X., Li, J., Liao, G., Tian, K., Guan, H.: High performance network virtualization with sr-iov. Journal of Parallel and Distributed Computing (2012)
Dong, Y., Yu, Z., Rose, G.: Sr-iov networking in xen: architecture, design and implementation. In: Proceedings of the First Conference on I/O Virtualization, pp. 10–10. USENIX Association (2008)
Intel: Intel 7 series / c216 chipset family platform controller hub (pch) datasheet (2012)
Jing, W.: Performance Isolation for Mixed Criticality Real-time System on Multicore with Xen Hypervisor. Master’s thesis, Uppsala University, Department of Information Technology (2013)
Kotaba, O., Nowotsch, J., Paulitsch, M., Petters, S.M., Theiling, H.: Multicore in real-time systems–temporal isolation challenges due to shared resources. In: Workshop on Industry-Driven Approaches for Cost-effective Certification of Safety-Critical, Mixed-Criticality Systems, WICERT (2013)
Navet, N., Monot, A., Bavoux, B., Simonot-Lion, F.: Multi-source and multicore automotive ecus-os protection mechanisms and scheduling. In: International Symposium on Industrial Electronics-ISIE 2010 (2010)
Nowotsch, J., Paulitsch, M.: Leveraging multi-core computing architectures in avionics. In: 2012 Ninth European Dependable Computing Conference (EDCC), pp. 132–143 (2012)
Paoloni, G.: How to benchmark code execution times on intel ia-32 and ia-64 instruction set architectures. White paper. Intel Corporation (2010)
Reinhardt, D., Kaule, D., Kucera, M.: Achieving a scalable e/e-architecture using autosar and virtualization. In: SAE World Congress (2013)
Sang, F.L., Lacombe, E., Nicomette, V., Deswarte, Y.: Exploiting an i/ommu vulnerability. In: 2010 5th International Conference on Malicious and Unwanted Software (MALWARE), pp. 7–14. IEEE (2010)
Sugerman, J., Venkitachalam, G., Lim, B.H.: Virtualizing i/o devices on vmware workstation’s hosted virtual machine monitor. In: Proceedings of the General Track: 2002 USENIX Annual Technical Conference, pp. 1–14 (2001)
Wojtczuk, R., Rutkowska, J.: Following the white rabbit: Software attacks against intel vt-d technology (2011)
Zhuravlev, S., Blagodurov, S., Fedorova, A.: Addressing shared resource contention in multicore processors via scheduling. In: ACM SIGARCH Computer Architecture News, pp. 129–142. ACM (2010)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer International Publishing Switzerland
About this paper
Cite this paper
Richter, A., Herber, C., Rauchfuss, H., Wild, T., Herkersdorf, A. (2014). Performance Isolation Exposure in Virtualized Platforms with PCI Passthrough I/O Sharing. In: Maehle, E., Römer, K., Karl, W., Tovar, E. (eds) Architecture of Computing Systems – ARCS 2014. ARCS 2014. Lecture Notes in Computer Science, vol 8350. Springer, Cham. https://doi.org/10.1007/978-3-319-04891-8_15
Download citation
DOI: https://doi.org/10.1007/978-3-319-04891-8_15
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-04890-1
Online ISBN: 978-3-319-04891-8
eBook Packages: Computer ScienceComputer Science (R0)