CS-580K/480K Advanced Topics in Cloud Computing. VM Virtualization II

Size: px

Start display at page:

Download "CS-580K/480K Advanced Topics in Cloud Computing. VM Virtualization II"

Emory Marshall
5 years ago
Views:

1 CS-580K/480K Advanced Topics in Cloud Computing VM Virtualization II 1

2 How to Build a Virtual Machine? 2

3 How to Run a Program Compiling Source Program Loading Instruction Instruction Instruction Instruction Data Memory Executing CPU Calculation I/O Devices Mem 3

4 How to Execute a Guest OS Instruction Guest (VM) Instruction Instruction Instruction Data Memory CPU Calculation I/O Devices Mem 4

5 A not Perfect World Privilege instructions Normal instructions Sensitive instructions 5

6 Solution 1--- Software Trap For sensitive but non-priviledge instructions We can modify them Binary Translation Ring 3 User Apps Ring 2 Ring 1 Ring 0 Guest OS Hypervisor (VMM) Host Computer Privilege instructions Sensitive-yet-non-privilege instructions 6

7 Solution 1 Binary Translation For sensitive but non-priviledge instructions We can modify them Binary Translation Source Instructions Stream Source Instruction Interpret Translate Code Emulate Process Target Instruction 7

8 Solution 1 Binary Translation Optimization of Dynamic binary translation Individual instructions or groups of instructions are on the fly translated The translation is cached to allow for reuse in iterations without repeated translation (optimization). VM Dynamic Translation VMM VM Hardware 8

9 Solution 1 Post Binary Translation We need to handle both privilege instructions and sensitive instructions triggered by Guest OS These instructions target hardware resources, which are controlled by host OS Solution Emulation Ring 3 Ring 2 Ring 1 Ring 0 User Apps Guest OS Hypervisor (VMM) Host Computer Sensitive yet nonprivilege instructions Privilege instructions 9

10 Emulation vs. Simulation Emulation is the process of mimicking the outwardly observable behavior to match an existing target (e.g. host OS). The internal state of the emulation mechanism DOES NOT have to accurately reflect the internal state of the target which it is emulating. Simulation, on the other hand, involves modeling the underlying state of the target. The end result of a good simulation is that the simulation model will emulate the target which it is simulating. 10

11 Solution 1 Emulation We can emulate all types of hardware resources using software E.g. QEMU Ring 3 User Apps vcpu vram vdisk vnet Ring 2 Ring 1 Ring 0 Guest OS Hypervisor (VMM) Host Computer Sensitive yet nonprivilege instructions Privilege instructions Binary Translation 11

12 Sources Fabrice Bellard, QEMU: A Fast and Portable Dynamic Translator, USENIX Freenix 2005, Chad D. Kersey, QEMU internals, df 12

13 Full Virtualization -- Advantages Solution 1 is also called full virtualization Guest OS unmodified The emulation layer Isolates VMs from the host OS and from each other Controls individual VM access to system resources, preventing an unstable VM from impacting system performance Total VM portability By emulating a consistent set of system hardware, VMs have the ability to transparently move between hosts with dissimilar hardware without any problems It is possible to run an operating system that was developed for another architecture on your own architecture A VM running on a Dell server can be relocated to a Hewlett-Packard server 13

14 Full Virtualization -- Drawbacks Hardware emulation comes with a performance price Interpretation, Translation, and emulation How to improve?? Application Ring 3 Operating System Ring 0 Traditional x86 Architecture Application Ring 3 Trap overhead Guest OS Ring 1 / 3 Virtual Machine Monitor Full Virtualization Ring 0 BT overhead 14

15 Solution 2 We may consider modify the source code of Operating system E.g., we can replace the privilege and sensitive instructions with new, efficient mechanisms The guest is fully aware of how to process privileged instructions Thus, instruction translation is no longer necessary The guest operating system uses a specialized API to talk to the VMM and, in this way, execute the privileged instructions No trap and emulation anymore 15

16 Para-virtualization Solution 2 is also called Para-virtualization For example, Xen uses Hypercall to talk to VMM (similar to system call) Application Ring 3 Application Ring 3 Guest OS Ring 1 Guest OS Ring 1 New Interface Trap overhead VMM Full Virtualization Ring 0 BT overhead VMM Ring 0 Para Virtualization 16

17 Para-virtualization Pros: Improved performance Cons: Modified OS (not practical for some OSes, such as windows) How to address the Cons? 17

18 Hardware-assisted Virtualization Extend X86 architecture by adding a new mode --- root mode Ring 3 User Apps Ring 3 User Apps Ring 2 Ring 2 Ring 1 Ring 1 Guest OS Ring 0 Guest OS Ring 0 Hypervisor (VMM) Root mode Hypervisor (VMM) Host Computer Host Computer 18

19 Hardware-assisted Virtualization Extend X86 architecture by adding a new mode --- root mode The VMM uses processor extensions (such as Intel -VT or AMD-V) to intercept and emulate privileged and sensitive operations in the guest Hardware-assisted virtualization removes many of the problems that make writing a VMM a challenge The VMM runs in a more privileged ring than 0, a virtual -1 ring is created Guest OS runs in ring 0 19

20 Hardware-assisted Virtualization Sensitive and privilege instructions from Guest are transferred (by hardware) to a new set of instructions: VMExits (e.g., Interrupt, HLT, CR access, and I/O instructions) Ring 3 User Apps Ring 2 Ring 1 Ring 0 Root mode Guest OS Hypervisor (VMM) Host Computer New instructions: VMExits 20

21 Hardware-assisted Virtualization Then VMMs will handle the VMExits by processing them directly or calling the emulated virtual hardware Ring 3 User Apps vnet vdisk Ring 2 vcpu Ring 1 Ring 0 Root mode Guest OS Hypervisor (VMM) VMExits vmem Host Computer 21

22 In Summary We have learned three way to virtualize a Guest OS Solution 1 Full-virtualization Solution 2 Para-virtualization Solution 3 Hardware-assisted virtualization 22

23 How Hardware-Assisted works? We need to do context switch Each VM has a context (new data structure to support context swtich, e.g., VMCS) User Apps Guest OS User Apps Guest OS VMCS VMENTRY VMEXIT Hypervisor (VMM) 23

24 How Hardware-Assisted works? During VMENTRY Load VM context from Memory (e.g., VMCS) During VMEXIT Store VM context to Memory Ensure VMs run within their own contexts VMENTRY VMEXIT User Apps Guest OS VMCS1 Hypervisor (VMM) User Apps Guest OS VMCS2 VMENTRY VMEXIT 24

25 VMCS: VM Control Structure Data structure to manage VMX non-root operation and VMX transitions. Specifies guest OS state. Configured by VMM. Controls when VM exits occur. 25

26 VMCS: VM Control Structure The VMCS consists of six logical groups: Guest-state area: Processor state saved into the guest-state area on VM exits and loaded on VM entries. Host-state area: Processor state loaded from the host-state area on VM exits. VM-execution control fields: Fields controlling processor operation in VMX non-root operation. VM-exit control fields: Fields that control VM exits. VM-entry control fields: Fields that control VM entries. VM-exit information fields: Read-only fields to receive information on VM exits describing the cause and the nature of the VM exit. 26

27 More Details Intel 64 and IA-32 Architectures Software Developer s Manual: Volume 3C: System Programming Guide, Part

28 When VMEXIT/VMENTRY Occurs? Events that cause exits to VMM 1. Access to privileged CPU state 2. Interrupt 3. Page-table 4. IO-device VMENTRY VMEXIT User Apps Guest OS VMCS1 Hypervisor (VMM) User Apps Guest OS VMCS2 VMENTRY VMEXIT 28

29 Performance Overhead But, VMEXITS come at a cost CPU cycles to exit to and return from VMM (small) Time spent in event handler (varying) Microarchitectural effects (TLB/Cache misses) (Could be significant due to high frequent context switch) 29

Virtual Machines. Part 2: starting 19 years ago. Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved.

Virtual Machines. Part 2: starting 19 years ago. Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved. Virtual Machines Part 2: starting 19 years ago Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved. Operating Systems In Depth IX 2 Copyright 2018 Thomas W. Doeppner.