What are the limits of traditional desktop virtualization? BLACK BOX

Transcription

1 What are the limits of traditional desktop virtualization? BLACK BOX The benefits of using VirtuaCore technology as part of a strategy to reduce costs. VirtuaCore Opti-WAN blackbox.com Opti-Net

2 Table of Contents Introduction... 3 Desktop Virtualization Explained... 4 How Is It Done?... 4 Security Issues... 5 The Technology of VirtuaCore... 5 High-Performance Communication... 5 Device Sharing... 5 Security Policies... 5 Trusted Computing Base... 5 Small Trusted Computing Base... 6 The Future: Many Cores... 6 Building Value Computer Sharing and VirtuaCore Control Kernel Technology... 6 VirtuaCore Applied in Real-World Applications... 7 How It Works... 7 Why It s An Ideal Solution for Schools... 8 About Box Network Services... 9 We re here to help! If you have any questions about your application, our products, or this white paper, contact Box Tech Support at or go to blackbox.com and click on Talk to Box. You ll be live with one of our technical experts in less than 30 seconds blackbox.com Page 2

3 Introduction Personal computer (PC) replacement and/or cost reduction strategies that use thin client/server-based computing solutions have been a hot topic for enterprises for quite some time. Technologies that drive these solutions include Citrix, Microsoft Terminal Services, and other terminal-based inventions. Although they have the ability to greatly reduce acquisition and operating costs, thin client/server-based computing does not have the same capabilities as a standard PC and usually requires the support of a complex data center. True computer sharing, as defined in this paper, will become an important and very different strategy in this area of enterprise solutions and even, as it will be shown, important to the non-enterprise. Computer sharing, as defined herein, is not a thin client, nor is it a clever server, nor is it fast user switching. These technologies lack the ability to provide smooth 32-bit video, are unable to launch applications that aren t designed to be launched with multiple and concurrent users, pirate software, and require more technology to manage. So by being inherently limited, these technologies cannot be true replacements for PCs. On the other hand, computer sharing like that of Box s VirtuaCore, which uses a containerized operating system for simultaneous use by multiple concurrent users, does provide all the benefits an actual PC but without a dedicated PC or any other thin hardware. Accomplishing this, computer sharing using VirtuaCore containerized system technology defines a new method of desktop virtualization spawned from a PC, unlike traditional desktop virtualization that originated with a server. It is, therefore, critical for customers evaluating the various technologies to understand the power and limitations of traditional desktop virtualization in this space and to accurately evaluate what technology is suitable for their applications. There are inherent differences between the server based style of desktop virtualization or traditional desktop virtualization (like VMware or Xen ) and desktop virtualization as it applies to computer sharing or computer sharing systems. The limitations of traditional virtualization approaches will be discussed, specifically as it applies to computer sharing systems and why they are not suitable as an add-on for these computer sharing systems. These limitations relate to the highly-integrated nature of computer sharing systems and their particular reliability and security requirements. An explanation of how to use a control kernel as a specific approach to new desktop virtualization will also be discussed, as well as why this approach is the only suitable solution for computer sharing systems. It will detail how a control kernel, especially what s used in Box s VirtuaCore, overcomes the limitations of plain virtualization. Finally, we ll move beyond the technical subject matter to discuss how VirtuaCore technology can be applied in real-world applications. Specifically, we ll it has been developed as a desktop virtualization solution for K 12 educators looking to cut PC hardware and maintenance costs blackbox.com Page 3

4 Desktop Virtualization Explained A virtual machine (VM) typically used in traditional virtualization provides an environment allowing an operating system to run as an application on another piece of software. To the VM, this base software appears as if it is a piece of hardware; this is known as emulation. On the other hand, a control kernel can run as if on bare hardware. In the control kernel environment, such a VM is an efficient, isolated duplicate of the real machine. The control kernel presents an interface that looks like real hardware to the guest operating system. The control kernel has several important characteristics: 1. The control kernel provides an environment that uses as much of the original machine as possible. It is essentially identical with the original machine. 2. Overhead to run the virtual machine is very low. Programs run in this environment show very little decrease in apparent speed. 3. The control kernel is in complete control of system resources. All three of these characteristics are important. The first characteristic ensures that most of the components of the real machine are the same as the components of the VM. This enables the same driver code to work for the control kernel and the VM, and is directly related to the second characteristic. Good efficiency ensures the desktop virtualization is usable from the customer s point of view. The ability of the control kernel to control the system resources completely prevents any software from breaking out of the VM. How Is It Done? First, it is important not to use emulation, like that provided by QEMU, bochs, or Virtual PC. Because resources are already shared across multiple seats, any further resource inefficiency will adversely affect the user experience by slowing applications. To be efficient, the vast majority of instructions must be directly executed by the hardware; every interpretation replaces one virtual machine instruction with many instructions, requiring the virtual hardware to be identical to the physical hardware on which the VM is hosted. These instructions, which access physical resources, are intercepted by the VM monitor. Examples of acceptable differences in the instructions include: Different memory-management units The virtual machine may be an older version of the same basic architecture of the host PC and used to run legacy code The virtual machine may be a not yet implemented newer version of the host PC architecture. As long as the differences are small and the different instructions are not constantly used, the desktop virtualization can be almost as efficient as if the hardware was the same. Any other differences in the directions are not acceptable. The VM executes most instructions directly. In some cases, this may cause an exception, which invokes the control kernel interpreting the instruction. Because the virtual machine s code is now executing in a non-privileged execution mode on the processor, pure desktop virtualization is achieved. Almost all contemporary systems allowed sensitive instructions that were not privileged to run on the physical, rather than the virtual, machine, causing kernel traps and context errors, not exceptions. This has been addressed by all major processor manufacturers. They have added virtualization extensions that enable the processor to be run in a manner that forces all sensitive instructions to cause exceptions. Unfortunately, this doesn t allow multiple operating systems to run natively they must be controlled by a virtual machine monitor. Ultimately, the fewer exceptions occurring, the better the environment. Exceptions are expensive and will completely drain the pipeline, delaying processing. Some processors have exception costs that run into the hundreds of CPU cycles. The two classes of instructions that must be handled by the VM are control-sensitive and behavior-sensitive instructions. Controlsensitive instructions control the machine, and, therefore, interfere with the control kernel s control over resources. Behavior-sensitive instructions read the state of the machine, indicating the status of resources, and do not change the resources or their allocations, which enables the instructions to understand what is real and what is virtual. It is important that code running in the VM does not execute sensitive instructions. The control kernel is what ensures that doesn t happen blackbox.com Page 4

5 Security Issues Desktop virtualization is used as a method of enhancing security. A virtual machine is, by definition, a subsystem, and as such, it cannot interfere with other subsystems. Desktop virtualization protects critical subsystems, such as the control kernel stack, from a compromised application not procured from a trusted source. CPU core affinities can be set and allow each VM to have its own CPU core, but this threat is relevant even if the application OS runs on its own processor core. If the operating system is compromised by a buffer or stack overflow, any software running on top of it can be compromised. Other subsystems can be protected by this VM in a properly built control kernel. The Technology of VirtuaCore. Historically, many aspects of computer sharing virtualization have proven to be difficult and seemingly impossible to solve, including high-performance communication, device sharing, security policies, dealing with a trusted computing base, and ensuring the trusted computing base remains small. The technology used by Box s VirtuaCore overcomes all of these issues. It is based on the kernel and usermode policy module, making it the total trusted computing base. As code progresses, more is possible. The inherent efficiency of the VirtuaCore code base makes it possible to use mathematical algorithms to enhance the speed and efficiency of the code. High-Performance Communication Tight cooperation requires highly efficient communication between the VM and the host PC. This concept differs from the virtual machine model, in which each VM is considered a system of its own communicating with other systems via file systems or networks. The communication required between components of a computer sharing system uses shared memory and low-latency signaling, demands that simply do not fit the virtual machine model. This communication requirement has many aspects. The first requirement is the bulk data transfer between subsystems, such as a media file downloaded via the communications subsystem and displayed by a media player. It is important for overall performance, as well as energy conservation, that such data is not copied unnecessarily. This is normally achieved by depositing it in a shared buffer (securely) between subsystems. Although this is not currently supported by the virtual-machine model, VirtuaCore technology provides a method within the concurrent computer sharing model to allow sophisticated communication. Device Sharing Integrating multiple virtual machines requires the sharing of physical devices, which must be accessed in a controlled manner by different VMs and their associated subsystems. A desktop virtualization approach supports running device drivers in their native (guest) OS, but this means a device is owned by a particular guest and not accessible by others, and the guest is trusted to drive the particular device. Security Policies Even though virtualization helps to separate different guest operating systems, it does not address security requirements by itself. And even though subsystems must communicate effectively, virtualization must be disabled where it is not needed. If it is not disabled, there could be a leakage of critical information. Specifically, it is absolutely necessary to deliver well-defined security policies defining which communication is allowed across components. Trusted Computing Base Many computer sharing systems contain highly security-critical components caused from multiple guest VMs running on the same real machine. Each VM must be particularly well-protected from security compromises. Because almost all software contains bugs, it is important to reduce the security exposure as much as possible by minimizing the amount of code upon which the VMs operate. Due to its extreme importance, VirtuaCore s mechanism is highly optimized for minimal latency and maximum efficiency. The control kernel provides the right mechanisms for efficiently supporting desktop virtualization and it serves as the virtual machine manager, catching desktop virtualization traps. Unlike other virtualization approaches, VirtuaCore s control kernel forwards the exception to a user-mode desktop virtualization component, recompiling the code for future use or forcing it to run in Ring blackbox.com Page 5

6 Small Trusted Computing Base Virtually all of the VirtuaCore code is built outside of the operating system core. When Linux is used, the kernel itself can be made very small and efficient around 16,000 lines enforcing a strict separation of policies and mechanisms. It also ensures high security and helps to prevent denial of service attacks as well as minimizes the amount of code to be trusted. In contrast to plain virtualization approaches designed to be always used with a guest OS underneath any other software, the amount of trusted user-mode code can be kept much smaller. The Future: Many Cores. Many questions exist when contemplating the future of computer sharing systems: How are computer sharing systems and desktop virtualization going to impact control kernel technology? Will control kernel technology become more or less relevant and what is needed to keep it relevant? Is this technology heading in the right direction? One thing that is a certainty is that PCs are becoming much more powerful through the addition of more cores to the CPU. The problem with multiple cores in competing technology is the inability of the application software to use these cores effectively. Multi-core chips are already common in high-end computing systems and manycores (chips containing 16 or more CPUs) are only a few years away. While legacy operating systems will find it increasingly hard to scale to such chips, the VirtuaCore control kernel technology automatically utilizes these cores and partitions the chip into subdomains containing a small or moderate number of processors handled by a single guest OS. In addition, testing has shown that a PC equipped with VirtuaCore desktop computer sharing technology and an Intel Quad Core processor has enough excess capacity to host many stations while still maintaining normal performance. The results are quite a contrast to other product solutions such as thin clients and blade PCs that significantly limit performance and are also tied to complicated servers. The VirtuaCore solution is a standalone hardware-savings solution that does not need the help of other thin devices or servers. Building Value Computer Sharing and VirtuaCore Control Kernel Technology. In an environment of almost bare metal desktop virtualization, the guest OS is the lowest layer of software on which everything else is built. Everything depends on it. It is absolutely essential that computer sharing system developers understand how control kernel technology will meet the challenges of the future. When considering desktop virtualization technology, this understanding doubles in importance. Technology requires control kernel technology to adapt to future challenges. VirtuaCore s technology is unique in several related respects: The underlying open-source technology has a long track record of research, development, and testing unmatched by competing products. Testing has demonstrated how this code base can be scaled to quad-core processors and beyond. The components are evolving and a new, lightweight component technology aimed specifically at computer sharing systems has been developed. These components are the basis for delivering a modern software-engineering framework, along with the control kernel, that will support even higher performance, excellent fault tolerance, and security. It is important that results are tested, verified, and ushered (when finished) through triple redundant tollgate procedures using basic operation and installation verification testing, unit testing, regression testing, and failover testing. Verification is also enabled by the efficient and disciplined design of the VirtuaCore control kernel. Most testing is performed for code running on bare metal. It is difficult to test code running on a virtual machine, even if most of the VM is running on bare metal. This is being addressed by examining the methods of running complete timing analyses on the underlying code, which would give the ability to guarantee speeds approaching real-time. As development progresses, the current code base will ultimately be replaced with a security enhanced kernel, such as SELinux, and a smooth upgrade path to this advanced technology will be provided blackbox.com Page 6

7 VirtuaCore Applied in Real-World Applications. How It Works. The VirtuaCore solution from Box works as a computer add-on and will have both hardware and software components. Hardware components consist of a multi-head video card and a connection hub. The VirtuaCore video card is installed into the PCI express slot of a computer, whereby multiple display monitors are then connected. Then, a separate VirtuaCore hub connects via a USB cable to link multiple keyboards, mice, and audio. The software that drives VirtuaCore consists of an open sourced Linux based kernel and other proprietary software that actually containerizes multiple operating systems (OS) and keeps them separate and dedicated for each user. If four users are set up, four versions of Vista, for instance, will need to be installed. The wall between the containers is so effective that each OS thinks that it is the only OS on the system and works exactly as expected. Because the operating systems are running concurrently, there are no delays, buffering, booting, or tiling of windows required. The coordination for all inputs and outputs is controlled by the VirtuaCore technology, but all other functions are controlled by the hosted OS, as normal. This means that Vista or Mac OS X works the same on the VirtuaCore desktop as it does on any other desktop. In addition, with VirtuaCore, video is transferred via a standard video connection (as opposed to a thin client), which means resolution and speed are maintained. This is not a clever Remote Desktop Protocol (RDP) or Citrix workaround, but a true CPU sharing technology that lets all connected terminals behave like they have dedicated computers. Workstation 4-port USB Hub VirtuaCore (VC004A) The VirtuaCore Computer Sharing system includes the Cube, a 4-port USB hub, a PCI video card, an adapter, cables, and an installation CD-ROM. Workstation CPU Workstation VirtuaCore (VC004A) 4-port USB Hub Workstation VirtuaCore 2-User Cube (VC002A), in middle of desk, enables one CPU to power two separate and fully functioning workstations with their own monitors, keyboards, and mice blackbox.com Page 7

8 Why It s An Ideal Solution for Schools. The problem: As educators work to prepare children for the 21st century, the introduction of new technology into schools has become a major initiative. However, many schools have adopted the latest technologies only to experience unforeseen problems. Even with the introduction of laptop computers a seemingly safe integration of technology into curriculum problems have arisen, overshadowing the benefits of technology itself. The key, it seems, is to introduce appropriate technologies that can match expectations such as meeting curriculum goals or reducing resources. Determining what technology is appropriate can be a daunting task, however, especially when the selection is so vast and the dollars limited. School administrators, for instance, do not have an easy task when variables such as current mandates, affordability, and available resources are considered. The solution: VirtuaCore is product that addresses these problems. It came about as the result of developers looking for technology tools that enable schools to achieve high-priority K 12 initiatives such as 1:1 computing, project-based learning, and lab-based learning. In doing this, they focused on not the latest pocket-sized appliances, but the venerable desktop computer. As a desktop computer sharing solution, VirtuaCore leverages the attributes that still make the desktop desirable to schools. These attributes are: the power to run a full OS, run all applications (including ILS), controllability (where are all those laptops?), and easy maintenance. VirtuaCore is implemented in schools via a computer hardware and software peripheral that enables standard desktop computers to host independent terminals. This is much like what a main frame computer does best, but on a personal scale. When used for a table cluster of PC or Mac computers, one desktop computer can host up to four terminal stations without any perceived loss in performance. For the 1:1 computing initiative, for example, a school with a student to computer ratio of 16:1 can add VirtuaCore and achieve a 4:1 ratio immediately with about half the cost as purchasing a computer for each student. Field tested, too. In practice, the VirtuaCore solution has found a perfect home in K 12 school systems, where computers are normally found in clusters that can easily take advantage of what we call community computing, or the collaborative learning process with the computer as the main tool. A typical K 12 setup consists of a cluster of four computers set up on one table in a classroom or a lab. Not only does this table usually represent approximately $3000 or more worth of hardware, but also four separate computers that need to be maintained and commissioned. Using VirtuaCore, there is one desktop connected to four terminals. The cost now decreases to approximately $1600, and hardware, maintenance, and commissioning have been reduced by as much as 50%. Tailored especially for schools. Because it was created to support 1:1 computer initiatives in classrooms, VirtuaCore has many teacher-centric features embedded into its software. Features like virtual CD-ROMs allow multiple students to work from one CD-ROM image. Plus, there s a feature that enables a teacher to see what every student is doing on his or her computer, as well as a built-in search engine function that enables staff to search for educational freeware and cut software costs further. VirtuaCore was also developed to help schools with limited support staff. Specifically, the system has been designed to reduce the load on school IT departments. For instance, because the VirtuaCore technology is Linux based, the deployment and configuration of all software for downstream VirtuaCore computers can be accomplished in minutes as opposed to days in the standard Windows method of software installation. Also, because the product is PC and Mac centric, specialized skill sets, like those required for servers and thin clients, are not required. Teachers can usually take care of most problems that arise within their own clusters as they would on a typical desktop computer blackbox.com Page 8

9 About Box Box Network Services is the world s largest technical services company dedicated to designing, building, and maintaining today s complicated data and voice infrastructure systems. Box services 175,000 clients in 141 countries with 196 offices throughout the world. The Box catalog and Web site offer an extensive range of products, including KVM switches and extenders, and the VirtuaCore line of desktop virtualization computer sharing solutions (for more information, visit blackbox.com/go/virtuacore). Box also offers a wide selection of advanced console servers; WAN optimization products; content filtering/network access control (NAC) solutions; and many network switches, routers, extenders, and media converters for both large and small applications. What s more, the Company is the premier supplier of digital signage solutions and audio/video splitters, switches, extenders, and scalers, and is the industry-leading provider of cabinets, racks, cables, connectors, and other AV and data infrastructure products. To view Box s comprehensive offering, view its interactive e-catalog at blackbox.movadamedia.com/blackboxbigbook/page.aspx?id=1. Copyright All rights reserved. Box and the Double Diamond logo are registered trademarks of BB Technologies, Inc. Any third-party trademarks appearing in this white paper are acknowledged to be the property of their respective owners blackbox.com Page 9