Module 3

Cloud Resource Virtualization

Cloud Resource Virtualization
• There are many physical realizations of the fundamental abstractions
necessary to describe the operation of a computing systems.
• Interpreters. VM (Virtual Machine): The Windows environment running on your Mac.
It’s like a "computer within a computer" that lets you use Windows-specific programs and files.
• Memory. Server: The Mac computer hosting the Windows VM.
• Communications [Link] Mac is the physical machine providing resources (CPU, memory, storage) to the Windows VM
through the VMM (Virtual Machine Monitor) like Parallels or VMware.

• Virtualization is a basic tenet of cloud computing, it simplifies the

management of physical resources for the three abstractions.
• The state of a virtual machine (VM) running under a virtual machine
monitor (VMM) can de saved and migrated to another server to Advantages
balance the load.
• Virtualization allows users to operate in environments they are
familiar with, rather than forcing them to idiosyncratic ones.
Virtualization Working

• Virtualization simulates the interface to a physical object by any one

of four means:

Multiplexing. Create multiple virtual objects from one instance of a

physical object.

Aggregation. Create one virtual object from multiple physical objects.

Emulation. Construct a virtual object form a different type of

physical object. Running Windows on a Mac

Multiplexing and Virtual memory with paging multiplexes real memory

emulation. and disk, and a Virtual address emulates a real address
• Virtualization abstracts the underlying resources and simplifies their
use, isolates users from one another, and supports replication, which,
in turn, increases the elasticity of the system.
• Virtualization is a critical aspect of cloud computing, equally
important to the providers and consumers of cloud services, and
plays an important role in: Applications: PRI S
• System security, Performance and reliability, Performance isolation,
The development and management of services offered by a provider..
• There are side effects of virtualization, notably the performanceSlowing down of
the systems
penalty and the hardware costs. Disadvantages
 Layering and virtualization

application programming interface (API),

application binary interface (ABI),
instruction set architecture (ISA).
API (Application Programming Interface):
A bridge between the application and the
hardware/software system.
Lets programs use library functions or make system
calls.
ABI (Application Binary Interface):
A bridge between the compiled program and the
operating system/hardware.
Ensures compatibility between programs and the
system they run on.
ISA (Instruction Set Architecture):

Defines the set of instructions a processor can

execute.
Layering and interfaces between layers in a computer system.
• An application uses library functions (A1), makes system calls (A2),
and executes machine instructions (A3).
• (API) defines the set of instructions the hardware was designed to
execute and gives the application access to the ISA. It includes HLL
library calls, which often invoke system calls.
• The ABI is the projection of the computer system seen by the process,
and the API is the projection of the system from the perspective of
the HLL program.
• High-level language (HLL) code
can be translated for a specific
architecture and operating
system.
• HLL code can also be compiled
into portable code and then the
portable code translated for
systems with different ISAs.
• The code that is
shared/distributed is the object
code in the first case and the
portable code in the second
case.
Virtual machine monitors
• A virtual machine monitor (VMM), also called a hypervisor, is the
software that securely partitions the resources of a computer system
into one or more virtual machines. Definition
• A guest operating system is an operating system that runs under the
control of a VMM rather than directly on the hardware.
• VMMs allow several operating systems to run concurrently on a single
hardware platform; at the same time, VMMs enforce isolation among
these systems, thus enhancing security.
• The events occurring in one VM do not affect any other VM running
under the same VMM
• At the same time, the VMM enables:
✓Multiple services to share the same platform.
✓The movement of a server from one platform to another, the so-
called live migration.
✓System modification while maintaining backward compatibility
with the original system.
• A VMM virtualizes the CPU and memory.
•Page Duplication Optimization (VMware): VMware avoids storing
multiple copies of identical memory pages across VMs by using copy-on-
write policies, allowing VMs to share memory pages unless they are
modified. This conserves memory and enhances performance.
•Total Isolation (Xen): Xen, on the other hand, prioritizes security and
isolation by not allowing any memory sharing between VMs, which
increases memory usage but ensures complete isolation.
•Ballooning Process (VMware ESX): VMware ESX uses a ballooning
process to reclaim memory from VMs when necessary. The VMM inflates
a balloon process inside the guest OS, which forces it to swap out pages,
freeing up memory for the VMM to use elsewhere. Once memory is
reclaimed, the balloon deflates, releasing the allocated memory back to
the VMM.
Virtual machines
• A virtual machine (VM) is an isolated environment that appears to be
a whole computer but actually only has access to a portion of the
computer resources.
• Each VM appears to be running on the bare hardware, giving the
appearance of multiple instances of the same computer, though all
are supported by a single physical system.
 • A taxonomy of process and system VMs
for the same and for different ISAs.
• Traditional, hybrid, and hosted are three
classes of VM for systems with the same
ISA.

• A process VM is a virtual platform created for an individual process and destroyed once
the process terminates.
• A system VM supports an operating system together with many user processes. When
the VM runs under the control of a normal OS and provides a platform-independent
host for a single application, we have an application virtual machine (e.g., Java Virtual
Machine [JVM]).
Traditional VMs. The VMM supports multiple VMs and runs A hybrid VM.
directly on the hardware. The VMM shares the hardware with a host
operating system and supports multiple virtual
machines.

A hosted VM. The VMM runs under a host operating system.

• Traditional. VM also called a “bare metal” VMM. A thin software layer
that runs directly on the host machine hardware; its main advantage
is performance Examples: VMWare ESX, ESXi Servers, Xen, OS370, and
Denali.
• Hybrid. The VMM shares the hardware with the existing OS. Example:
VMWare Workstation.
• Hosted. The VM runs on top of an existing OS. The main advantage of
this approach is that the VM is easier to build and install. Another
advantage of this solution is that the VMM could use several
components of the host OS, such as the scheduler, the pager, and the
I/O drivers, rather than providing its own.
Performance and security isolation
*competing* for resources from CPU

• Performance isolation is a critical condition for quality-of-service

(QoS) guarantees in shared computing environments.
• Indeed, if the run-time behavior of an application is affected by other
applications running concurrently and, thus, is competing for CPU
cycles, cache, main memory, and disk and network access, it is rather
difficult to predict the completion time.
• Techniques to Achieve Performance Isolation are Linux/RK (Resource
Kernel), Qlinux, SILK.
 *sharing*
• Traditional operating systems multiplex multiple processes or
threads, whereas a virtualization supported by a VMM
multiplexes full operating systems. Obviously, there is a
performance penalty because an OS is considerably more
heavyweight than a process.
Traditional operating systems share resources between multiple processes, while
virtualization shares resources between entire operating systems.

Virtualization has a performance cost because managing an OS is heavier than

managing individual processes.
 security isolation:
(traditional)
• Operating systems use process abstraction not only for resource
sharing but also to support isolation. Unfortunately, this is not
sufficient from a security perspective. Once a process is compromised,
it is rather easy for an attacker to penetrate the entire system.

• On the other hand, the software running on a virtual machine has

the constraints of its own dedicated hardware; it can only access
virtual devices emulated by the software.
• This layer of software has the potential to provide a level of isolation
nearly equivalent to the isolation presented by two different physical
systems. Thus, the virtualization can be used to improve security in a
cloud computing environment.
Virtual machines (VMs) add a strong layer of isolation:
-Each VM operates like it has its own hardware.
-Software on one VM cannot directly access another VM or the physical machine.
Full virtualization and paravirtualization
free-os unchanged but h/w support needed
• Full virtualization – a guest OS can run unchanged under the VMM as
if it was running directly on the hardware platform.
• Requires a virtualizable architecture.
• Examples: Vmware.
• Paravirtualization - a guest operating system is modified to use only
instructions that can be virtualized. Reasons for paravirtualization:
• Some aspects of the hardware cannot be virtualized.
• Improved performance.
• Present a simpler interface.
• Examples: Xen, Denaly
(a)Full virtualization requires the
hardware abstraction layer of the
guest OS to have some knowledge
about the hardware.
(b)Paravirtualization avoids this
requirement and allows full
compatibility at the application binary
interface (ABI).
Hardware support for virtualization

Virtualization Challenges on x86 Architecture

• Context: In the early 2000s, it became clear that software-based
virtualization solutions for x86 architecture faced performance and
security challenges.
• Need for Hardware Support: To overcome these limitations, Intel and
AMD started developing hardware virtualization support (Intel VT-x
and AMD-V) to improve virtualization efficiency and simplify Virtual
Machine Monitors (VMMs).
Challenge Name What it means The challenge

Ring Deprivileging The CPU has "rings" or privilege levels (0 to 3), Moving the guest OS to a different ring
not giving with Ring 0 being the most powerful. Normally, the causes it to lose certain privileges, which can
ring 0 to operating system (OS) runs at Ring 0, while break its operations, as it’s not designed to
guest OS applications run at Ring 3. In a virtualized run outside of Ring 0.
environment, we want the hypervisor (VMM) to be
at Ring 0 and the guest OS at a less privileged level
(e.g., Ring 1 or 3).

Ring Aliasing When we force the guest OS to run in a different If the OS thinks it’s running at Ring 0 (the
Guest OS is sad ring, the OS can’t track its own privilege level most privileged level) but actually isn’t, it can
correctly, which may cause it to behave incorrectly. make mistakes in managing resources, which
the hypervisor then has to catch and correct.

Address Space The hypervisor needs some memory space to store The hypervisor has to "compress" or take
Compression important data structures that control the CPU’s over part of the guest OS’s memory space,
i want my space behavior. However, the guest OS also expects to which the guest OS doesn’t expect,
use all available memory. potentially causing conflicts.
Non-Faulting Access to Some CPU instructions only work if they’re When these instructions fail without giving an
Privileged State executed by software running at Ring 0. If the guest error, the guest OS doesn’t realize there’s a
trying to peek in
OS tries to use one of these privileged instructions problem, which can lead to unexpected
while running in a lower ring, the instruction simply behavior.
fails without warning.

Access to Hidden State Certain parts of the CPU’s internal state are hidden, When switching between different virtual
hide the ring meaning the hypervisor can’t directly see or modify machines (VMs), the hypervisor needs to save
them and restore the entire CPU state. Without
access to these hidden parts, it can’t fully
restore each VM’s state, which can lead to
inconsistencies.

Frequent Access to The guest OS frequently accesses certain privileged Since the hypervisor needs to protect these
Privileged Resources resources (like a register that tracks task priorities). resources, it has to intercept every access
trying to peek in attempt by the guest OS, which can cause a
slowdown because each access is delayed.
 (switching bw VMM and VM)
Intel VT-x Technology: Making Virtualization Faster and More Efficient
• Two Key Modes in VT-x :
VMX Root Mode: This is where the Virtual Machine Monitor (VMM),
or hypervisor, runs. It has full control of the hardware, similar to how
the operating system (OS) usually does on a non-virtualized system.
VMX Non-Root Mode: This is where the virtual machines (VMs) run.
Here, each VM thinks it’s in control of the hardware, but really, the
VMM is overseeing everything in VMX Root Mode.
reality
The Virtual Machine Control Structure (VMCS)

The VMCS is a special data structure that VT-x uses to control the
switching between VMs and the VMM. Think of it as a “control panel” for
the hypervisor that stores information about each VM’s settings and state.
The VMCS has two main parts:
[Link]-State Area: Holds the CPU state (like registers) of the VM that is
currently running.
[Link]-State Area: Holds the CPU state of the VMM.
Switching Between VMs and the VMM: VM Entry and VM Exit
• Whenever the system switches from the VMM to a VM, or back from
a VM to the VMM, it goes through these processes:
• VM Entry: When the VMM decides to give control to a VM, it:
• Loads the processor state from the guest-state area in the VMCS.
• Transfers control to the VM.
• VM Exit: When control needs to return to the VMM (e.g., when a VM
tries to do something it isn’t allowed to):
• The processor state of the VM is saved in the guest-state area.
• The processor state of the VMM is loaded from the host-state area.
• Control is transferred back to the VMM.
Each VM Exit operation records the reason for the exit in the VMCS, so
the VMM knows why it was triggered.
In conclusion:
With VT-x, Intel made it easier to create virtual machines by adding
hardware support for:
• Efficient switching between the VMM and VMs.
• Managing interrupts and privileged actions in a secure, controlled
way.
• Expanding support for I/O and network devices with VT-d and VT-c.
Case study: Xen, a VMM based on paravirtualization
• Xen is a VMM or hypervisor developed by the Computing Laboratory
at the University of Cambridge, United Kingdom, in 2003.
• Xen is an example of Paravirtualization.
Why Xen Chose Paravirtualization:
➢The x86 architecture has performance issues with full virtualization
because it was not originally designed to run multiple VMs.
➢To solve this, Xen makes the guest OS aware of its virtualized
environment and requires it to cooperate by performing tasks that are
normally handled by the VMM in a fully virtualized system.
Xen's Domain Concept and virtual CPUs
Xen uses the concept of domains to refer to virtualized environments.
The two main types of domains in Xen are:
• Dom0 (Domain 0): This is a privileged domain. It is the first domain
created when Xen starts and is responsible for managing Xen's control
functions.
• DomU (Domain U): These are unprivileged domains that run guest
operating systems (such as Linux, FreeBSD, etc.).
Xen for the x86 architecture.
The management OS dedicated to
the execution of Xen control
functions and privileged instructions
resides in Dom0; guest operating
systems and applications reside in
DomU.
Virtual Memory Management in Xen
• The Challenge with TLB on x86 Architecture:
• The Translation Lookaside Buffer (TLB) is a hardware cache that helps
speed up memory accesses by storing recently used page table
entries.
• On x86 processors, switching between different address spaces (i.e.,
between different VMs) is a problem because the hardware does not
provide an efficient way to manage the TLB for different address
spaces. This results in a full TLB flush whenever the VMM switches
from one address space (VM) to another, causing performance hits.
• Xen has solutions to overcome above challenges.
 Dom0 components
• XenStore – a Dom0 process.
naming • Supports a system-wide registry and naming service.
ceremony • Implemented as a hierarchical key-value storage.
• Communicates with guest VMs via shared memory using Dom0
privileges.
• Toolstack - responsible for creating, destroying, and
managing the resources and privileges of VMs.
birth
• To create a new VM, a user provides a configuration file describing
memory and CPU allocations and device configurations.
Xen abstractions for networking and I/O
Diagram (a): Xen Split I/O Model
Driver Domain (Dom0):
• This is a privileged domain that has direct access to the physical
hardware (in this case, a NIC). It contains the back-end driver, which is
responsible for handling I/O requests on behalf of the guest domains.
Guest Domain (DomU):
• This is an unprivileged virtual machine that cannot directly access
hardware. It includes a front-end driver, which interacts with the
back-end driver in Dom0 to perform I/O operations.
• When a guest domain needs to send data to or receive data from a
network, the front-end driver passes the request through the I/O
channel to the back-end driver in the driver domain. The back-end
driver then interacts with the physical NIC to execute the request.
Once the operation is complete, Dom0 sends a notification back to
the guest domain through the event channel.
Diagram (b): Ring Buffer Structure for I/O Operations
In the Xen model, the ring buffer consists of two queues
• Request Queue: his is where the guest domain (DomU) puts its I/O requests.
• Response Queue: This queue holds responses to completed I/O requests.
The flow in the ring buffer is as follows:
• The guest domain (DomU) adds a new request to the request queue using the
producer request pointer.
• Xen processes these requests, moving them to the NIC or other I/O devices as
required.
• Once the operation completes, Xen places a response in the response queue.
• The guest OS can then retrieve the response using the consumer response
pointer.
• The ring buffer structure ensures a continuous flow of I/O requests and
responses without blocking, as each side can add requests or consume responses
independently as long as the buffer is not full
Optimization of network virtualization in Xen 2.0

Xen network architecture. (a) The original architecture. (b) The optimized
architecture.
Configuration (a): Traditional Network Virtualization in Xen
Driver Domain (Dom0):
• The driver domain (Dom0) handles all network traffic for guest
domains (unprivileged VMs) and communicates directly with the
physical network interface controller (NIC).
Guest Domain:
• The guest domain (DomU) has a virtual interface that connects to the
back-end interface in the driver domain via an I/O channel.
In this configuration, the driver domain (Dom0) handles all packet
processing, which includes the functions of bridging, routing, and
communicating with the NIC. This adds significant overhead because
Dom0 performs a high volume of processing for each packet, leading to
CPU load and reduced network performance for the guest VM.
Configuration (b): Optimized Network Virtualization with Offloading
• Driver Domain (Dom0):
• The driver domain (Dom0) now includes an offload driver.
• The offload driver is designed to offload some of the packet
processing tasks from Dom0 to the guest domain (DomU). This can
reduce the amount of work Dom0 has to perform for each packet,
thereby lowering CPU utilization and improving performance.
• The NIC driver and bridge still exist in Dom0, but with the offload
driver, some tasks that would normally be handled by Dom0 can now
be managed in the guest domain.
• Guest Domain:
• The guest domain now has a High-Level Virtual Interface instead of
the standard virtual interface.
• This high-level interface is optimized to allow the guest VM to handle
some networking tasks that would traditionally be managed by
Dom0. This can include offloading certain operations like checksum
calculations, segmentation, or even packet routing to the guest
domain.
• By enabling the guest VM to perform these tasks, Dom0’s workload is
reduced, which helps decrease the communication overhead and
improve network throughput.
A performance comparison of virtual machines
• Compare the performance of Xen and OpenVZwith, a standard
operating system, a plain vanilla Linux.
• The questions examined are:
• How the performance scales up with the load?
• What is the impact of a mix of applications?
• What are the implications of the load assignment on individual servers?
• The main conclusions:
• The virtualization overhead of Xen is considerably higher than that of OpenVZ
and that this is due primarily to L2-cache misses.
• The performance degradation when the workload increases is also noticeable
for Xen.
• Hosting multiple tiers of the same application on the same server is not an
optimal solution.
The setup for the performance comparison of a
native Linux system with the OpenVZ and Xen
systems. The applications are a Web server and
a MySQL database server.
(a) In the first experiment, the Web and the DB
share a single system.
(b) In the second experiment, the Web and the
DB run on two different systems.
(c) In the third experiment, the Web and the
DB run on two different systems and each
has four instances.