Virtualization Principles

Chapter 14: Principles of Virtualization

The Beginnings

  • The idea of virtualization is fairly old.
  • Virtual machines (VMs) were first mentioned in the 1960s.

Goals of Virtualization

  • Mimic the behavior of a system: Providing a platform to run legacy code.
  • Better resource utilization: Allowing users to share resources.
  • Flexibility: Making it easier to deploy/migrate software.
  • Security: Isolation of applications and their environment from the rest of the system.

Typical Uses of Virtualization

  • Data center consolidation: Increasing resource efficiency.
  • Improving availability.
  • Running multiple operating systems (OSs) on one host (without dual-booting).
  • Prototyping new features for OSs: Kernel debugging/testing for hardware: new features of architectures.

Interfaces and Levels of Systems

  • Computer systems provide different interfaces on different levels.
  • Hardware: Instruction set architecture (ISA), a set of machine instructions, usually divided into:
    • Privileged instructions: Can only be executed by the OS.
    • General instructions: Can be executed by any program.
  • Operating System (OS): System calls offered by an OS.
  • Library functions: An API hiding lower levels.

Virtual Machines

  • The virtualization of a physical computer system is called a virtual machine.
  • Two main approaches:
    • Emulation.
    • Native/hosted virtualization.

Emulation

  • Software that completely simulates hardware.
  • Includes CPU registers, memory management, etc.
  • Hardware is represented in data structures.
  • Machine language instructions update the state.
  • Advantage: Runs anywhere; no support from the host OS is needed.
  • Disadvantage: Very slow (ok for old hardware).

Native Virtualization

  • A layer shielding the hardware is implemented.
  • Provides an instruction set of the hardware as an interface.
  • Alternatively, can also provide an instruction set of other hardware.
  • This layer is called a native virtual machine monitor (VMM).
  • VMMs are often called hypervisors.
  • Native: Sits directly on top of the hardware.
  • The interface of a VMM can be used by multiple guest OSs at the same time.

Hosted Virtualization

  • A native VMM needs to implement device drivers for all hardware resources.
  • A hosted VMM runs on top of a host OS using existing functionality of the OS.
  • A hosted VMM needs special privileges to work (cannot be just run as a user application).
  • General instructions usually executed directly.
  • Privileged instructions are more complicated.

Type 1 vs Type 2 Hypervisors

  • Type 1 (Native) Hypervisor: Sits directly on the hardware.
  • Type 2 (Hosted) Hypervisor: Runs on top of an operating system.

Advantages/Disadvantages of VMMs

  • Compared to emulators, VMMs have the following advantage/disadvantage:
    • Advantage: Much faster than emulators.
    • Disadvantage: Some implementation issues, e.g., handling of privileged instructions.

Challenges of Hardware Virtualization

  • Many architectures operate with privileges.
  • x86 architecture has four rings of privilege.
  • Ring 3 is the least privileged, and ring 0 is the most privileged ring.

Privileges

  • Usually, only rings 0 and 3 are used.
    • Ring 0: Also called system (or kernel) mode.
      • Code can access hardware directly.
      • Only low-level trusted parts of OSs run in system mode.
    • Ring 3: Also called user mode.
      • Code has no direct access to hardware.
      • Accessing hardware is delegated to OS.
  • Rings 1 and 2 are rarely used; in principle, device drivers could go there.

Privileges (2)

  • Transitioning between the two modes is expensive.
  • However, it makes the system much more secure.
  • If user mode code oversteps its bounds, an exception is thrown.
    • It crashes the application, but not the system.
  • System mode crashes bring a whole system down.

Privileges (3)

  • Virtualizing this architecture means placing a VMM between the OS and the hardware.
  • The guest OS runs in a non-privileged mode now.
  • Non-privileged instructions can still be directly executed on the underlying hardware.
  • This will also improve the performance.
  • Handling of privileged instructions is complex.

Trap and Emulate

  • All privileged instructions are trapped by the VMM.
  • VMM now emulates these instructions.
  • This is called full virtualization (using binary translation).

Full Virtualization

  • Advantages:
    • The guest OS is decoupled from hardware.
    • It is not even aware of being virtualized, so no modifications are necessary.
  • However, not all (x86) instructions trap properly.
  • There are sensitive instructions affecting how an OS manages the hardware.

Sensitive Instructions

  • A control-sensitive instruction affects the configuration of a machine, e.g., changing memory layout or interrupt table.
  • The effect of a behavior-sensitive instruction is determined by the context, e.g., affects certain registers depending on whether it is run in system or user mode.
  • If all sensitive instructions were privileged, all of them would be trapped properly.

Sensitive Instruction (2)

  • Unfortunately, not all architectures have privileged-only sensitive instructions.
  • E.g., x86 has 17 sensitive non-privileged instructions.
  • Each of these can be run in user mode without trapping.
  • We do not want to emulate all instructions.
  • We could scan the code for problematic instructions and insert code to divert control to the VMM for them.
  • However, this makes it much more difficult to implement virtualization.

Paravirtualization

  • Another solution is to employ paravirtualization.
  • The guest OS is modified, replacing all problematic instructions with calls to the VMM.

Paravirtualization (2)

  • This has implications for compatibility and portability.
  • Compared to full virtualization, guest OS needs to be aware of virtualization and cooperates with the VMM: instead of trapping instructions, guest OS calls VMM directly.
  • However, modifying guest OS is usually easier than implementing full virtualization for problematic instructions.

Hardware-Assisted Virtualization

  • Virtualization has become very popular.
  • Hardware vendors reacted by supporting it.
  • A new execution mode below ring 0 was introduced.
  • VMM runs in this new root mode.

Hardware-Assisted Virtualization (2)

  • Introduces a new execution mode (root mode) below ring 0 for the VMM.
  • Allows privileged and sensitive instructions to automatically trap to the VMM without binary translation or paravirtualization.
  • Enables direct execution of user requests in non-root mode for guest OS.

Other System Components for Virtualization

  • Virtualization of CPUs was discussed.
  • Other system components can also be virtualized.
  • Memory, I/O, and devices.

Memory Virtualization

  • Bears similarity to virtual memory in OSs.
  • With virtual memory, applications have their own address spaces.
  • This space is not directly connected to physical memory.
  • An OS uses page tables to map virtual pages to physical pages.

Virtual Memory

  • Virtual memory in an OS is supported by hardware.
  • There is a memory management unit (MMU) that handles all the memory accesses.
  • Translation lookaside buffer (TLB) supporting MMUs.
  • It caches virtual to physical memory translations.

Memory Virtualization (2)

  • When running multiple VMs on a system, we need virtual MMUs.
  • This adds another layer to a memory lookup.

Virtualizing I/O and Devices

  • When introducing virtual devices, we have to map virtual device requests to physical devices.
  • A common way to do this is to emulate devices.

Summary

  • With virtualization, we can run multiple logical systems on one physical system.
  • There are different strategies for virtualization.
  • However, for all of them, we put some intermediate layer in place.