Virtualization Technology Prof. Dan Connors

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 2 2 Virtualization Real vs. Virtual Similar essence, effect ”Formally” different A framework that combines or divides [computing] resources to present a transparent view of one or more environments Hardware/software partitioning (or aggregation) Partial or complete machine simulation Emulation (partial or complete) Time-sharing (in fact, sharing in general) In general, can be M-to-N mapping (M “real” resources, N “virtual” resources) Examples: VM (M-N), Grid Computing (M-1), Multitasking (1-N)

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 3 3 Virtualization: Motivation Areas Server consolidation Application Consolidation Sandboxing Multiple execution environments Virtual hardware Debugging Software migration (Mobility) Appliance (software) Testing/Quality Assurance

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 4 4 Types of Virtualization Process & application virtualization Process executes on CPU with modification of native instructions Created binary instrumentation and translation systems CPU/Machine virtualization Each process feels like it has its own CPU Created by OS preemption and scheduler Memory virtualization Process feels like it has its own address space Created by MMU, configured by OS Storage virtualization (Input/Output) Logical view of disks “connected” to a machine External pool of storage

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 5 5 Application Level Virtualization Java Virtual Machine (JVM) Executes Java byte code (virtual instructions) Provides the implementation for the instruction set interpreter (or JIT compiler) Provides code verification, SEH, garbage collection Hardware access through underlying OS JVM Architecture Stack-based architecture No MMU Virtual hardware: PC, register-set, heap, method (code) areas Rich instruction set – Direct object manipulation, type conversion, exception throws Provides a runtime environment through JRE Other Examples:.NET CLI, Parrot (PERL 6)

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 6 6 CPU Virtualization

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 7 7 Virtual CPUs Each process feels like it has its own CPU But cannot execute privileged instructions (e.g., modify the MMU or the interval timer, halt the processor, access I/O) Created by OS preemption and scheduler Pseudo-machine with interpreted instructions 1966: O-code for BCPL 1973: P-code for Pascal 1995: Java Virtual Machine Run anywhere

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 8 8 Virtual Machines Machine virtualization Partition a physical computer to act like several real machines Migrate an entire OS + applications from one machine to another Early examples 1972: IBM System 370

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 9 9 HARDWARE KERNEL USER LEVEL LIBRARIES APPLICATIONS API Calls System Calls Instructions User Space Kernel Space Machines: Stacked Architecture

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 10 Possible Virtual Abstraction Levels Instruction Set Architecture Emulate the ISA in software –Interprets, translates to host ISA (if required) –Device abstractions implemented in software –Inefficient Optimizations: Caching? Code reorganization? Applications: Debugging, Teaching, multiple OS Hardware Abstraction Layer (HAL) Between “real machine” and “emulator” (maps to real hardware) Handling non-virtualizable architectures (scan, insert code?) Applications: Fast and usable, virtual hardware (in above too), consolidation, migration

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 11 Possible Abstraction Levels Operating System Level Virtualized SysCall Interface (may be same) May or may not provide all the device abstractions Easy to manipulate (create, configure, destroy) Library (user-level API) Level Presents a different subsystem API to application Complex implementation, if kernel API is limited User-level device drivers Application (Programming Language) Level Virtual architecture (ISA, registers, memory, …) Platform-independence (  highly portable) Less control on the system (extremely high-level)

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 12 Machine Virtualization Privileged vs. unprivileged instructions Regular applications use unprivileged instructions Easy to virtualize If regular applications execute privileged instructions, they trap VM catches the trap and emulates the instruction

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 13 Virtual Machine Monitor (VMM) Hypervisor- Program in charge of virtualization Arbitrates access to physical resources Presents a set of virtual device interfaces to each host Guest OS runs until: Privileged instruction traps System interrupts Exceptions (page faults) Explicit call: VMCALL (Intel) or VMMCALL (AMD)

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 14 Approaches Intel x86 arch doesn’t support trapping privileged instructions Two approaches to modifying OS to run on virtual machine: Binary translation (BT) –Scan instruction stream and replace instructions –Replace privileged instructions with something the VM can intercept. (VMWare approach) Paravirtualization –Don’t use non-virtualizable instructions (Xen approach) –Static design approach, paravirtualization support is designed before dynamic adaptation

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 15 Binary Translation and Binary Instrumentation

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 16 Translation Approaches Source instrumentation: –Instrument source programs Binary instrumentation: –Instrument executables directly Advantages for binary instrumentation Language independent Machine-level view Instrument legacy/proprietary software

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 17 When to instrument: Instrument statically Instrument dynamically Advantages for dynamic instrumentation No need to recompile or relink Discover code at runtime Handle dynamically-generated code Attach to running processes Instrumentation Approaches

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners Support for Binary Translation Easy-to-use Instrumentation: Uses dynamic instrumentation –Do not need source code, recompilation, post-linking Programmable Instrumentation: Provides rich APIs to write in C/C++ your own instrumentation tools (called Pintools) Multiplatform: Supports x86, x86-64, Itanium, Xscale Supports Linux, Windows, MacOS Robust: Instruments real-life applications: Database, web browsers, … Instruments multithreaded applications Supports signals Efficient: Applies compiler optimizations on instrumentation code

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 19 Pin (VM) Software Architecture of Binary Translation JIT Compiler Emulation Unit Virtual Machine (VM) Code Cache Instrumentation APIs Application Operating System Hardware Pin Pintool Address space

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 20 BT: Instrumentation Approaches JIT Mode Pin creates a modified copy of the application on-the-fly Original code never executes  More flexible, more common approach Probe Mode Pin modifies the original application instructions Inserts jumps to instrumentation code (trampolines)  Lower overhead (less flexible) approach

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 21 JIT-Mode Instrumentation Original code Code cache Pin fetches trace starting block 1 and start instrumentation 7’ 2’ 1’ Pin Exits point back to Pin

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 22 JIT-Mode Instrumentation Original code Code cache Pin transfers control into code cache (block 1) ’ 2’ 1’ Pin

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 23 JIT-Mode Instrumentation Original code Code cache 7’ 2’ 1’ Pin Pin fetches and instrument a new trace 6’ 5’ 3’ trace linking

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 24 Original Code A BC D FE A’ C’ F’ D’ Code Cache Hot Path, Found with Hardware E D B A C Original Code F JIT Code Model

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 25 Transformation cost: Start-up (initialization) overhead A black line represents a service request from the virtual machine. Space between adjacent black lines indicates time being spent in already compiled code paths. time Significant demands on the run-time system Light-weight application

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 26 Persistence ABCDC Original dynamic instruction stream A 1) A’B’C’D’C’A’JIT 2) A’B’C’D’C’A’JIT 1) A’B’C’D’C’A’JIT 2) A’B’C’D’C’A’ Traditional JIT Persistent JIT

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 27 Instrumentation Approaches JIT Mode Pin creates a modified copy of the application on-the-fly Original code never executes  More flexible, more common approach Probe Mode Pin modifies the original application instructions Inserts jumps to instrumentation code (trampolines)  Lower overhead (less flexible) approach

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 28 A Sample Probe A probe is a jump instruction that overwrites original instruction(s) in the application –Instrumentation invoked with probes –Pin copies/translates original bytes so probed functions can be called Entry point overwritten with probe: 0x400113d4:jmp 0x x400113d9:push %ebx Copy of entry point with original bytes: 0x : push %ebp 0x : mov %esp,%ebp 0x : push %edi 0x : push %esi 0x : jmp 0x400113d9 Original function entry point: 0x400113d4: push %ebp 0x400113d5: mov %esp,%ebp 0x400113d7: push %edi 0x400113d8: push %esi 0x400113d9: push %ebx

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 29 Popular VM Platforms Xen Runs under an OS and provides virtual containers for running other operating systems. Runs a subset of x86. Routes all hardware accesses to the host OS. Altris Software Virtualization Services Windows registry & directory tweaking Allows multiple instances of applications to be installed Microsoft Virtual Server Parallels VMWare

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 30 Overall Picture ISAHALOSLibraryPL Performance***** ***** Flexibility********* Development & Implementation ******** Degree of Isolation ********* *** (More stars are better)

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 31 Instruction Set Architecture Level Virtualization Technologies Emulation: Translates guest ISA to native ISA Emulates hardware specific IN/OUT instructions to mimic a device Translation Cache: Optimizes emulation by making use of similar recent instructions Code rearrangement Speculative scheduling (alias hardware) Issues Efficient Exception handling Self-modifying code

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 32 ISA Level Virtualization: Examples Bochs: Open source x86 emulator Emulates whole PC environment –x86 processor and most of the hardware (VGA, disk, keyboard, mouse, …) –Custom BIOS, emulation of power-up, reboot –Host ISAs: x86, PowerPC, Alpha, Sun, and MIPS Crusoe (Transmeta) “Code morphing engine” – dynamic x86 emulator on VLIW processor 16 MB “translation cache” Shadow registers: Enables easy exception handling QEMU: Full Implementation –Multiple target ISAs: x86, ARM, PowerPC, Sparc –Supports self-modifying code –Full-software and simulated (using mmap()) MMU User-space only: Useful for Cross-compilation and cross-debugging

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 33 HAL Virtualization Techniques Standalone vs. Hosted Drivers Host and VMM worlds I/O Protection Rings Multilevel privilege domains Handling “silent” fails Scan code and insert/replace artificial traps Cache results to optimize

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 34 VMware Architecture

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 35 Paravirtualization Traditional architectures do not scale Interrupt handling Memory management World switching Virtualized architecture interface Much simpler architectural interface Virtual I/O and CPU instructions, registers, … Portability is lost

Copyright © 2006, Intel Corporation. All rights reserved. Prices and availability subject to change without notice. *Other brands and names are the property of their respective owners 36 Examples Denali Simpler customized OS with no VM for network applications Xen Simpler port to commercial OS Exposes some “real” hardware, e.g. clock, physical memory address