[2019] Pushing Device Emulation into the Guest by Alexander Graf

Описание: Ever since KVM was created, the tenant split has always been very clear: KVM inside the Linux kernel provides an abstraction layer for CPU and close-to-CPU hardware, guests run as if they were on real hardware and user space (QEMU usually) emulates real world hardware.

It's about time we start to reconsider that split though. With spectre mitigations in place, exiting guest context suddenly becomes much more expensive than before. From a general security point of view we ideally want to run as little code as we can in host context. Also, with device assignment becoming commodity, maybe we can build faster virtual devices if we think out of the box.

In this presentation I will introduce a prototype I've been working on that implements legacy device emulation inside guest firmware and explain all the security as well as tenant split benefits that brings.

---

Alexander Graf
Amazon
Principal Software Engineer

Alexander joined Amazon just this year. In his previous life he worked on fancy things like SUSE Studio, QEMU, KVM, openSUSE and SLES on ARM and U-Boot. Whenever something really useful comes to his mind, he tends to implement it. Among others he did Mac OS X virtualization using KVM, nested SVM, KVM on PowerPC, a lot of work in QEMU for openSUSE on ARM and the UEFI compatibility layer in U-Boot.