Virtualization Technology

Virtualization: rejuvenation
1960’s: first track of virtualization
Time and resource sharing on expensive mainframes
IBM VM/370
Late 1970’s and early 1980’s: became unpopular
Cheap hardware and multiprocessing OS
Late 1990’s: became popular again
Wide variety of OS and hardware configurations
VMWare
Since 2000: hot and important
Cloud computing

IBM VM/370
Robert Jay Creasy (1939-2005)
Project leader of the first full virtualization hypervisor: IBM CP-40, a core component in the VM system
The first VM system: VM/370

IBM VM/370
System/370
Control Program (CP)
Conversational Monitor System (CMS)
Mainstream OS (MVS, DOS/VSE etc.)
Specialized VM subsystem (RSCS, RACF, GCS)
Another copy of VM
Hardware
Hypervisor
Virtual machines

IBM VM/370
Technology: trap-and-emulate
Kernel
Application
CP

Virtualization on x86 architecture
Challenges
Correctness: not all privileged instructions produce traps!
Example: popf
Performance:
System calls: traps in both enter and exit (10X)
I/O performance: high CPU overhead
Virtual memory: no software-controlled TLB

Virtualization on x86 architecture
Solutions:
Dynamic binary translation & shadow page table
Hardware extension
Para-virtualization (Xen)

Dynamic binary translation
Idea: intercept privileged instructions by changing the binary
Cannot patch the guest kernel directly (would be visible to guests)
Solution: make a copy, change it, and execute it from there
Use a cache to improve the performance

Dynamic binary translation
Pros:
Make x86 virtualizable
Can reduce traps
Cons:
Overhead
Hard to improve system calls, I/O operations
Hard to handle complex code

Shadow page table

Shadow page table
Guest page table
Shadow page table

Shadow page table
Pros:
Transparent to guest VMs
Good performance when working set fit into shadow page table
Cons:
Big overhead of keeping two page tables consistent
Introducing more issues: hidden fault, double paging …

Hardware support
First generation - processor
Second generation - memory
Third generation – I/O device

First generation: Intel VT-x & AMD SVM
Eliminating the need of binary translation
Host mode
Guest mode
VMRUN
VMEXIT

Second generation: Intel EPT & AMD NPT
Eliminating the need to shadow page table

Third generation: Intel VT-d & AMD IOMMU
I/O device assignment
VM owns real device
DMA remapping
Support address translation for DMA
Interrupt remapping
Routing device interrupt

Para-virtualization
Full vs. para virtualization

Xen and the art of virtualization
SOSP’03
Very high impact

Overview of the Xen approach
Support for unmodified application binaries (but not OS)
Keep Application Binary Interface (ABI)
Modify guest OS to be aware of virtualization
Get around issues of x86 architecture
Better performance
Keep hypervisor as small as possible
Device driver is in Dom0

Xen architecture

Virtualization on x86 architecture
Challenges
Correctness: not all privileged instructions produce traps!
Example: popf
Performance:
System calls: traps in both enter and exit (10X)
I/O performance: high CPU overhead
Virtual memory: no software-controlled TLB

CPU virtualization
Protection
Xen in ring0, guest kernel in ring1
Privileged instructions are replaced with hypercalls
Exception and system calls
Guest OS registers handles validated by Xen
Allowing direct system call from app into guest OS
Page fault: redirected by Xen

CPU virtualization (cont.)
Interrupts:
Lighweight event system
Time:
Interfaces for both real and virtual time

Memory virtualization
Xen exists in a 64MB section at the top of every address space
Guest sees real physical address
Guest kernels are responsible for allocating and managing the hardware page tables.
After registering the page table to Xen, all subsequent updates must be validated.

I/O virtualization
Shared-memory, asynchronous buffer descriptor rings

Porting effort

Evaluation

Evaluation

Evaluation