Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature Request] Core Scheduling #4566

Open
3 tasks done
sargun opened this issue Apr 19, 2024 · 2 comments
Open
3 tasks done

[Feature Request] Core Scheduling #4566

sargun opened this issue Apr 19, 2024 · 2 comments
Labels
Priority: Low Indicates that an issue or pull request should be resolved behind issues or pull requests labelled ` Status: Parked Indicates that an issues or pull request will be revisited later

Comments

@sargun
Copy link

sargun commented Apr 19, 2024

Feature Request

It would be valuable to have core scheduling for Firecracker, to avoid, and potentially eliminate side channel attacks.

Describe the desired solution

To add core scheduling to firecracker, and have it run the ioctl to set a new cookie for the vCPU processes.

Describe possible alternatives

One can avoid using core scheduling by disabling SMT. Unfortunately, this means everything else on the system loses capacity, and if you're running VMs with more than 1 core, you can't take advantage of SMT.

Checks

  • Have you searched the Firecracker Issues database for similar requests?
  • Have you read all the existing relevant Firecracker documentation?
  • Have you read and understood Firecracker's core tenets?
@kalyazin
Copy link
Contributor

Hi @sargun . Thanks for contacting us!
We investigated running Firecracker using Core Scheduling on a host with SMT enabled. Our results show that the performance gains/degradations are very workload-dependent, and not sufficient in magnitude to justify the risk of introducing a wide class of security issues currently excluded by disabling SMT. We may investigate the use of SMT and Core Scheduling further in the future, but for now we will not merge a PR implementing Core Scheduling because of the fundamental shift in the security posture it would introduce in Firecracker.

@xmarcalx
Copy link
Contributor

xmarcalx commented Jun 2, 2024

Hi @sargun ,

sorry for the late reply.
Actually i was interesting in some more details behind this request.
Do you want to be able to enable SMT in the system to benefit your trusted processes in the host but still running microVMs as per today basically with core scheduling?
Do you have some numbers on performance benefits you observed?

@ShadowCurse ShadowCurse added Priority: Low Indicates that an issue or pull request should be resolved behind issues or pull requests labelled ` Status: Parked Indicates that an issues or pull request will be revisited later labels Jul 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Priority: Low Indicates that an issue or pull request should be resolved behind issues or pull requests labelled ` Status: Parked Indicates that an issues or pull request will be revisited later
Projects
None yet
Development

No branches or pull requests

4 participants