Virtualization P. A. Wilsey The text highlighted in green in these slides contain external hyperlinks. 1 / 16
Conventional System Viewed as Layers This illustration is a common presentation of the application/operating system/hardware components. It can be deceiving in that it seems to show that the application runs through the O/S to the hardware layer. In order to gain a clear view of system operation and virtualization, it is first necessary to break this view and remember that all of the application and operating system services run through the system CPU/Core one at a time. We will restructure this view in the next few slides. Applications O/S CPU/Core Recall that the hardware control unit is configured to control access to certain resources (instructions, registers, memory, devices, etc) based on some configuration data regarding the program/task that it is currently executing. Generally this means that the system executes in either user mode (where some accesses are not allowed) or privileged mode (where access to all system resources is allowed). This configuration data is generally set when the task is scheduled into the CPU/Core and generally resides in one or more CPU (not general purpose) registers. Before we examine further the system level view, it may be instructive to first review the operation of the control unit and execution of programs/tasks within the CPU/Core. 2 / 16
The Control Unit Consider the operation of the control unit as a sequential algorithm (see pseudo-code). This example highlights two locations where hardware interrupts continued interpretation of instruction execution. The first occurs when an attempt is made to access a protected resource when operating in user mode. The second trap is a timeout trap that occurs when the system is running in user mode and the timer reaches zero. This timeout trap is used to facilitate time sharing of the CPU/Core by the running programs. There are numerous other traps in the system but these will suffice to illustrate our needs. One other comment that needs to be made here is with respect to virtual memory. With virtual memory, the system remaps the addresses from the virtual (program) space to the physical space where the O/S places the program page. Thus, the hardware will also have to support traps (virtual memory faults) when the mapping of these spaces has not already been performed (by the O/S). Furthermore, if you think about it, you will realize that when the user mode program/task accesses memory, it is accessing a privileged resource that the system must while true do instrregister = MM[PC]; PC++; decode instrregister; if (executing in user mode and a privileged resource is being accessed) then trap the program/terminate execution; else allow the instruction to be executed; end if (executing in user mode and timeout has occurred) then trap the program/context swap; end end protect. Since a running program has a large number of memory accesses, we cannot have the O/S services process all of these requests. Thus, we migrate the address translation process into the hardware so that user programs can run most efficiently and yet the shared hardware resources (memory) are protected from errant (or malicious) access by non-privileged tasks. Similar techniques are used in virtualization for performance. All tasks, including operating system tasks run sequentially, one at a time, through the CPU/Core. When a user mode task requests access to a privileged service, the hardware prevents it from doing so directly. When the trap occurs, the operating system interrupt service routines will look for the reason for the trap and service the request on behalf of the user task that initiated the request (provided the O/S approves/allows the request to be performed). 3 / 16
System Viewed as Executing Tasks Contrasting the conventional view (shown in a previous slide), the accompanying figure restructures the relation of the operating system tasks and applications to the executing hardware platform (CPU/Core). All of the O/S tasks and all of the application programs are actually executed through the CPU/Core one at a time in a time-shared manner. In general all of the application programs are executed in user mode and most (but not necessarily all) operating system tasks are run in privileged mode. O/S Tasks CPU/Core Applications Time Shared execution on CPU/Core Now from the perspective of virtualization, one possible organization is to simply add another runtime layer/mode to the hardware platform (hypervisor mode), add a box for the virtual machine state (interrupts, etc) and add another box containing the hypervisor (or Virtual Machine Monitor, VMM) to our picture: Virtual Machine State VMM O/S Tasks Applications Time Shared execution on CPU/Core CPU/Core Virtual Machine State O/S Tasks Applications And from here, we will begin to discuss the nuts and bolts of virtualization. BTW: multiple cores do not really change the picture much. You simply have another hardware resource that can simultaneously process another instruction stream. The O/S just has to schedule the Core (of course there are shared memory issues, to be addressed, but that s another topic altogether). 4 / 16
Some Outside Reading Materials Wikipedia articles: (as you read, use the embedded links to learn more!!) Virtual Machines Hardware Virtualization Full Virtualization Paravirtualization Hypervisor/Virtual Machine Monitor (VMM) x86 Virtualization. Memory: Second Level Address Translation (known as: Nested page tables/rapid virtualization indexing [AMD], Extended page tables [Intel]). Devices: IOMMU, SR-IOV. 5 / 16
Implementing Full Virtualization Emulation Binary translation Additional ring layer/de-privileged execution 6 / 16
Virtualization Hardware (or platform) virtualization provides mechanisms to have abstract virtual machines that operate as isolated entities on a common hardware platform. Virtualization enables the protected sharing of the hardware resources to the guest environments without (necessarily) requiring that the guest has knowledge of its virtualization. Device Types: Full (hardware-assisted) Virtualization: the guest machine/system has no knowledge that it is being executed virtually and all hardware devices are emulated by the host VMM. Para-virtualization: the gust system knows it is virtualized; the VMM presents an API to methods that bridge to the host devices and the guest has device drivers that use those method calls. I/O Virtualization (also known as: Direct Connect or pci-passthrough): the VMM gives direct and sole control of a device to a guest. 7 / 16
Some Terminology Virtual Machine Manager (VMM)/Hypervisor Host machine Virtual/guest machine Guest OS 8 / 16
Virtual Machine Managers (VMM) Type 1 (or native, bare medal) hypervisors: existing as a (mostly) standalone layer to virtualize the hardware. Two types: Stand-alone hypervisors: providing all hardware device drivers and services Hybrid: using resources from a special guest O/S, esp to provide device drivers (examples: Xen, VMware ESX/ESXi). Type 2 (or hosted) hypervisors: existing as a service within a host O/S (examples: Kvm, Virtual Box). 9 / 16
Performance Critical Services Virtual Memory I/O (network and disk) Services 10 / 16
Virtual Memory 00 00 00 11 11 11 00 00 00 11 11 11 000 000 000 111 111 111 000 000 000 000 000 000 000 000 000 111 111 111 111 111 111 111 111 111 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 111 Physical Memory Real Memory Actual Hardware Virtual Memory Guest O/S Guest O/S Application Application Application Application 11 / 16
Virtual Memory Shadow page tables: Hypervisor captures guest O/S page table updates and carries them forward to the shadow page table. Hardware uses the shadow page table to translate addresses. Nested page tables: add a level of indirection to the address translation mechanism to map physical addresses into real addresses. Furthermore: DMA devices add complications as they reach directly into the guest O/S physical addresses that have to be remapped to the actual physical addresses. The VMM must capture and remap these transactions. 12 / 16
I/O Services IOMMU (I/O MMU virtualization): Define memory protection domains and treat DMA addresses as DMA Virtual Addresses (DMA); then translate the addresses in H/W. Devices are bound to a specific devices (this is sometimes called PCI passthrough). IOV (PCI-SIG I/O Virtulalization): allows multiple guest O/Ss to natively share PCI-E devices. Address Translation Services (ATS): this specification provides a set of transactions for PCI Express components to exchange and use translated addresses in support of native I/O Virtualization. Single-Root IOV: 1 specifies how multiple guests on a single server with a single PCIe controller (or root) can share I/O devices without requiring a hypervisor on the main data path. Multi-Root IOV: allow multiple independent systems with separate PCIe roots to connect to I/O devices through a switch. Both SR-IOV and MR-IOV require specific support from I/O cards. 1 From wikipedia: In SR-IOV, the most common of these, a host VMM configures supported devices to create and allocate virtual shadows of their configuration spaces so that virtual machine guests can directly configure and access such shadow device resources. With SR-IOV enabled, virtualized network interfaces are able to achieve over 95% of the bare metal network bandwidth in NASA s virtualized datacenter and in the Amazon Public Cloud. 13 / 16
Performance Impact of Virtualization Virtualization runs user mode instructions at native speeds 2. Thus, if you consider that the vast majority of virtual instructions occur at native speeds, the performance implications of virtualization are largely incurred with access to privileged resources. So you can get a first order approximation of the cost of virtualization by applying Amdhal s law to those infrequent operations (and primarily I/O). Trying to go much below that level of detail and you ll begin to bump into the unpredictable measures of time-shared access and scheduling delays: which are there irrespective of virtualization. Of course virtualization may bring the temptation to deploy systems with much greater time-shared use than a typical non-virtualized environment. So the overall system performance analysis question gets murky. Sorry I don t have an easy answer for you here. 2 OK, you can try to talk about the cost of the added translation of physical to real addresses; however that cost will be slight and mostly hidden in the underlying translation buffer/high performance memory optimizations. 14 / 16
How Slow: Network Latency The graph on this page shows measurements of the 2 TCP/IP, Direct Connect 1.8 speedup of network latency between TCP/IP, Para-Virtualized 1.6 two computers connected over Ethernet 1.4 1.2 using para-virtualization and direct 1 0.8 connect. The results show that while 0.6 network latency for para-virtualization 0.4 0.2 at small message sizes is substantially 0 slower than native, it rapidly improves Payload Size (bytes) to around 70% of native for many message sizes. Assuming that messaging is a fairly small portion of the total runtime of a standard application, this tells us that the performance implications for networking are notable but not devastating. Unfortunately I do not currently have similar numbers for disk access costs. Speedup 15 / 16
Closing Comments Virtualization is old. IBM was doing it back in the 70 s. They continue to use virtualization. Virtualization is being rapidly adopted by industry. Server virtualization is widely used by corporations today. This space is changing rapidly. Terminology and techniques are changing. Be prepared to update your thinking in this space. 16 / 16