1. Network Interface Virtualizaion: Challenges and Solutions Ryan Shea and Jiangchuan Liu, Simon Fraser University IEEE Network 2012 2016.04.06 Park Sewon

2. 2 CONTENTS 1.Introduction 2.Virtualization 3.Why is the NIC more problematic to Virtualize? 4.Software-Based Virtual Interfaces 5.Hardware-Assisted Virtual Interfaces 6.Summary

3. 3 2.Virtualization Hypervisor-based computer virtualization Physical machine Virtual machine host VM 1 Open Solaris VM 1 Open Solaris Hypervisor Physical hardware devices VM 2 Debian Linux VM 2 Debian Linux VM 3 Free BSD VM 3 Free BSD Virtual devices

4. 4 2.Virtualization Paravirtualizations(PBMs); VM/370(IBM) - XEN(OSP) -no special hardware -privileged system calls -modified VM’s OS Hardware Virtual Machines(HVMs); VT-X, AMD-V -special hardware -intercepting privileged calls -unmodified VM’s OS

5. 5 3.Why is the NIC more problematic to Virtualize? Memory  TLB  When a request is made from within the VM.  The ability to control the priority of the request  Known the data length NIC  Need to many Layers  Initiated by other hosts in the network  Show up at anytime  Any priority  The physical network interface sends an interrupt

6. 6 KVM process VM process Virtual machine host Kernel Process 3.Why is the NIC more problematic to Virtualize? Linux Kernel Process Network Layer Network Layer Physical NIC Layer Physical NIC Layer Physical NIC Physical NIC Physical NIC Physical NIC Physical NIC driver Physical NIC driver Bridge Network TAP device Network TAP device Virtual NIC Virtual NIC VirtIO driver VirtIO driver Network Layer Network Layer Bare-metal KVM IRQ

7. 7 4.Software-Based Virtual Interfaces Emulated -Require specific hardware. -The hypervisor is scheduled to run. -Only used if absolutely necessary. Paravirtualized (VirtIO) - Receiving and sending multiple packets at once. - Use of the processor’s last level cache (LLC). - Unnecessary hardware features.

8. 8 4.Software-Based Virtual Interfaces HypervisorKVM 0.15.1 CPUIntel Core 2 Q9500 quad core processor 2.83 GHz RAM4 Gbytes of 1333 Mhz DDR-3 SDRAM HDD320 Gbyte 7200 RPM hard drive, 16 Mbytes cache NIC1000Mb/s Broadcom Ethernel adapter (PCI-E bus) OSDebian Squeeze BenchmarkIperf Etc.VT-X Environment

9. 9 4.Software-Based Virtual Interfaces Bare-metalKVM VirtIOKVM rtl8139 Cycles11.5 M/s51.8 M/s96.6 M/s LLC references0.48 M/s2.3 M/s3.6 M/s Context switches189/s452/s IRQs600/s2600/s5000/s Bare-metalKVM VirtIOKVM rtl8139 Cycles4.1 M/s33.4 M/s74.2 M/s LLC references0.13 M/s1.3 M/s2.7 M/s Context switches19/s307/s432/s IRQs180/s1700/s3500/s Ipref receiving 10 Mb/s TCP traffic Ipref sending 10 Mb/s TCP traffic

10. 10 5.Hardware-Assisted Virtual Interfaces  a physical NIC has a single interrupt, which in a multicore system is mapped to a single core Virtual Machine Device Queues (VMDQ) - Multiple interrupts. - Destined based on either its MAC address or VLAN tag. - DMA into host’s memory. - host’s memory space into the VM space using hypervisor. Single Root I/O Virtualization (SR-IOV) -send an interrupt to the proper core -DMA into VM’s memory space.

11. 11 Physical NIC VMDQ 5.Hardware-Assisted Virtual Interfaces VM1 Virtual machine VM1 process VM2 process Physical NIC VMDQ KVM process Network Layer Virtual NIC driver Virtual NIC Software switch Physical NIC driver Layer2 Classifier VM1 Virtual machine VM1 process VM2 process KVM process Network Layer Virtual NIC driver Virtual NIC Layer2 Classifier VM1 IRQ VM2 IRQ VM1 IRQ VM2 IRQ VM2 packets VM1 packets VM1 packets VM2 packets VMDQ SR-IOV Physical NIC driver

12. 12 5.Hardware-Assisted Virtual Interfaces Bare-metalKVM SR-IOVKVM VirtIO Cycles11.5 M/s31.1M/s51.8M/s LLC references0.48 M/s2.1M/s2.3M/s Context switches189/s476/s452/s IRQs600/s1200/s2600/s Bare-metalKVM SR-IOVKVM VirtIO Cycles4.1 M/s18.8M/s33.4M/s LLC references0.13 M/s0.72M/s1.3M/s Context switches19/s239/s307/s IRQs180/s390/s1700/s Ipref receiving 10 Mb/s TCP traffic Ipref sending 10 Mb/s TCP traffic

13. 13 6.Summary There remain many challenges to face. Issues in terms of network delay and bandwidth stability. The hypervisor must still handle IRQs generated by the SR-IOV enabled NIC. Security A DoS attack on a VM can consume almost 10 times more resources than on a bare metal machine.