Virtualization:
Introduction
Virtualization is a technique, which allows to share single physical instance of an
application or resource among multiple organizations or tenants (customers).
Creating a virtual machine over existing operating system and hardware is
referred as Hardware Virtualization.
Virtual Machines provide an environment that is logically separated from the
underlying hardware.
virtualization technologies provide a virtual environment for not only executing
applications but also for storage, memory, and networking
One of the key features of virtualization is that it allows multiple customers and
companies to share their applications.
The machine on which the virtual machine is created is known as host machine
and virtual machine is referred as a guest machine.
This virtual machine is managed by a software or firmware, which is known as
hypervisor.
The hypervisor is a firmware or low-level program that acts as a Virtual Machine
Manager.
Two types of hypervisor 1) Type 1 hypervisor and 2) Type 2 hypervisor
Type 1 and Type 2 hypervisor
Type1 hypervisor does not have any
host operating system because they
are installed on a bare system.
Type 2 hypervisor is a software
interface that emulates the devices
with which a system normally
interacts.
Characteristics of virtualized environments
In a virtualized environment there are three major components:
● Guest
● Host
● Virtualization layer
Guest represents the system component that interacts with the
virtualization layer rather than with the host.
Host represents the original environment where the guest is
supposed to be managed.
Virtualization layer is responsible for recreating the same or a different
environment where the guest will operate.
Increased security
The ability to govern the execution of a guest program creates new
opportunities for providing a safe, controlled execution environment.
All guest programs operate usually against the virtual machine, translating
them and using them for host program.
A virtual machine manager can govern and filter guest programs' activity
so as to prevent harmful operations from being carried out. Resources
exposed by the host can then be hidden or just protected against the
guest.
For example, applets downloaded from the Internet run in a sandboxed3 version
of the Java Virtual Machine (JVM), which provides them with limited access to the
hosting operating system resources. Both the JVM and the .NET runtime provide
extensive security policies for customizing the execution environment of
applications.
Execution Managed
Features
Sharing – Virtualization makes it possible to create a separate computing
environment in the same host. This common function reduces the amount of
active servers and reduces energy consumption.
Aggregation – The physical resource cannot only be shared between several
guests, but virtualization also enables aggregation. A group of individual hosts can
be linked and represented as a single virtual host. This functionality is
implemented using the Cluster Management Software, which uses and represents
the physical resources of a uniform group of machines.
Features
Emulation – In the virtualization layer, which is essentially a program, guest
programs are executed within an environment. An entirely different environment
can also be emulated with regard to the host, so that guest programs that require
certain features not present in the physical host can be carried out.
Isolation – Virtualization allows providing guests with a completely separate
environment, in which they are executed, whether they are operating systems,
applications, or other entities. The guest program performs its activity by interacting
with an abstraction layer, which provides access to the underlying [Link]
virtual machine is able to filter the guest’s activities and prevent dangerous
operations against the host.
Isolation brings several benefits; for example, it allows multiple guests to run on the
same host without interfering with each other. Second, it provides a separation
between the host and the guest. The virtual machine can filter the activity of the
guest and prevent harmful operations against the host.
Portability –Dependent on a specific type of virtualization, the concept of
portability applies in different ways.
In the case of a hardware virtualization, the guest is packed in a virtual image
which can be moved and executed safely on various virtual machines in many
instances
In the case of programming-level virtualization, as implemented by the JVM or
the .NET runtime, the binary code representing application components (jars or
assemblies) can be run without any recompilation on any implementation of the
corresponding virtual machine.
One version of the application,is able to run on different platforms with no
changes. Finally, portability allows having your own system always with you and
ready to use as long as the required virtual machine manager is available.
Taxonomy of virtualization techniques
Virtualization covers a wide range of emulation techniques that are applied to
different areas of computing. Virtualization is used primarily to emulation in
execution, storage and networking environments.
Based on the type of host they are required these can be divided into
Process-level techniques are implemented in addition to an existing operating
system with full hardware control.
System levels technique are carried out directly on hardware and require no
support from an existing operating system, or require limited support.
Execution virtualization
This involves all the methods to imitate an execution environment that is
separate from the virtualization layer host.
All these techniques are focused on supporting program execution, whether it
be the operating system, a binary program's specification compiled against
the model or application of an abstract machine model.
Execution virtualization can be implemented directly on top of the hardware by
the operating system, an application, or libraries dynamically or statically
linked to an application image.
1. Machine reference model
2. Hardware-level virtualization
3. Programming language-level virtualization
4. Application-level virtualization
1. Machine reference model
If execution environment is virtualized at levels
A reference framework needs to be developed that defines the interfaces within
the abstract level
This level of abstraction masks the details of the implementations.
virtualization techniques replace one of the layers and intercept the calls that are
directed toward it.
At the bottom layer, the model for the hardware is expressed in terms of the
Instruction Set Architecture (ISA)
ISA is the interface between hardware and software
The application binary interface (ABI) separates the operating system layer from
the applications and libraries, which are managed by the OS.
The highest level of abstraction is represented by the application programming
interface (API), which interfaces applications to libraries and/or the underlying
operating system
For any operation to be performed in the application level API, ABI and ISA are
responsible for making it happen.
The high-level abstraction is converted into machine-level instructions to perform
the actual operations supported by the processor.
Instruction Set Architecture (ISA)
The instruction set provides the processor with instructions to tell it what to do.
The set of instructions consists of addressing modes, instructions, native data
types, registries, memory architecture, interruption and exception handling, and
external I / O.
An instruction set can be incorporated in the processor's hardware or emulated by
an interpreter using software.
Application Binary Interface (ABI)
A Binary Code ABI defines how to invoke the functions, how parameters are
passed between caller and callee, how return values are given to callers, how
libraries are deployed and how programs are loaded into a memory.
ABI is the rules of how unrelated code works in conjunction.
An ABI could specify on the UNIX system how signals are executed, how a
process invokes systems calls, what endianness is used and stacks are
developed.
An ABI is a set of rules that are implemented in a particular architecture by the
operating system.
Security Rings and Privileged Mode
For Managing and Accessing shared resources this layered approach provides ways to
implement a minimal security model.
For that, the instruction set exposed by the hardware has been divided into different security
classes
Privileged and Unprivileged
Nonprivileged instructions are those instructions that can be used without interfering with other
tasks because they do not access shared resources. for example, all the floating, fixed-point,
and arithmetic instructions.
Privileged instructions are those that are executed under specific restrictions
For instance, behavior-sensitive instructions are those that operate on the I/O, whereas
control-sensitive instructions alter the state of the CPU registers.
Some types of architecture feature more than one class of privileged instructions
For instance, a possible implementation features a hierarchy of privileges in the
form of ring-based security: Ring 0, Ring 1, Ring 2, and Ring 3;
Ring 0 is in the most privileged level and Ring 3 in the least privileged level.
Ring 0 is used by the kernel of the OS, rings 1 and 2 are used by the OS-level
services,
Ring 3 is used by the user.
Ring 0 for supervisor mode and Ring 3 for user mode
Ring 0 (most privileged) and 3 (least privileged) : The kernel Ring 0 is accessible,
which is a core component of most operating systems and can access everything,
Code running in kernel mode is said to operate. Ring 3, the least privileged ring, is
available for user processes in user [Link] ring does not have direct access to
the CPU or memory and must thus pass instructions to ring 0
Rings 1 and 2: Special privileges exist for rings 1 and 2 that do not exist in ring 3
(user mode). Ring 1 is used to interact with your computer-connected hardware
and control [Link] 2 is used for instructions that interact with system storage, load
or save files. These types of permissions are referred to as input and output
because data is moved in or from a working memory (RAM).
Supervisor mode denotes an execution mode in which all the instructions
(privileged and non privileged) can be executed without any restriction.
This mode, also called master mode or kernel mode, is generally used by the
operating system (or the hypervisor) to perform sensitive operations on hardware
level resources.
In user mode, there are restrictions to control the machine-level resources.
If code running in user mode invokes the privileged instructions, hardware
interrupts occur and trap the potentially harmful execution of the instruction
Hardware-level virtualization
Hardware-level virtualization is a virtualization technique that provides an abstract
execution environment in terms of computer hardware on top of which a guest
operating system can be run.
In this model, the guest is represented by the operating system, the host by the
physical computer hardware, the virtual machine by its emulation, and the virtual
machine manager by the hypervisor
2. Hardware Level Virtualization (system virtualization)
Hardware-level virtualization is a virtualization technique that provides an abstract
execution environment in terms of computer hardware on top of which a guest
operating system can be run.
the guest is represented by the operating system, the host by the physical
computer hardware, the virtual machine by its emulation, and the virtual machine
manager by the hypervisor.
The hypervisor is generally a program or a combination of software and hardware
that allows the abstraction of the underlying physical hardware.
There are two major types of hypervisor: Type I and Type II
virtual machine manager is internally organized as three main modules,
dispatcher, allocator, and interpreter, coordinate their activity in order to
emulate the underlying hardware.
The dispatcher reroutes the instructions issued by the virtual machine instance to
one of the two other modules.
The allocator is responsible for deciding the system resources to be provided to
the VM: whenever a virtual machine tries to execute an instruction that results in
changing the machine resources associated with that VM, the allocator is invoked
by the dispatcher.
The interpreter module consists of interpreter routines. These are executed
whenever a virtual machine executes a privileged instruction: a trap is triggered
and the corresponding routine is executed.
Theorem 1. An effective VMM can be built on any conventional
third-generation computer if the sensitive set of instructions is a subset of the
privileged instructions for that computer.
Theorem 2. A conventional third-generation computer is recursively
Virtualizable if:
• It is Virtualizable and • A VMM without any timing dependencies can be
constructed for it.
Theorem 3. A hybrid VMM may be constructed for any third generation
machine in which the set of user sensitive instructions are a subset of the set
of privileged instructions.
Hardware virtualization techniques
❏ Hardware-assisted virtualization.
❏ Full virtualization.
❏ Paravirtualization.
❏ Partial virtualization.
Hardware-assisted virtualization.
Hardware-assisted virtualization, the first virtual machine operating
system was introduced on the IBM System/370.
Virtualization allowed a single server to replace multiple underutilized
dedicated servers.
Full virtualization.
Full virtualization refers to the ability to run a program,most likely an
operating system,directly on top of a virtual machine and without any
modification,as though it were run on the raw hardware.
Virtual machine manager are required to provide a complete emulation of
the entire underlying hardware.
A successful and efficient implementation of full virtualization is obtained
with a combination of hardware and software,not allowing potentially
harmful instructions to be executed directly on the host
Paravirtualization
Paravirtualization is another approach to server visualization
paravirtualization is a thin layer that does not imitate a complete hardware
environment;
it makes sure that all guest systems share their system resources and work
around each other well.
Paravirtualisation attempts to correct all problems related to virtualization by
allowing the guest operating systems to directly access the subordinate hardware
and thus to improve communication between the Guest OS and the hypervisor.
Partial virtualization
Partial virtualization is a virtualization technique that has been employed to
implement a virtual machine environment: one providing a "partial simulation
of the underlying hardware."
Partial virtualization is much easier than full virtualization.
It has frequently provided useful, strong virtual machines that support major
applications.
Operating system-level virtualization
Operating system level virtualization (OS virtualization) is a server
virtualization technology that includes altering the operating system to allow
different applications to be run simultaneously on one computer at one time
by different users.
The virtual operating system processes each user request individually. An
advantage of operating system level virtualization is that the availability of
applications will have a minimal impact even during system upgrades and
security patches.
Programming Language-level virtualization
Programming language-level virtualization is mostly used to achieve ease of
deployment of applications, managed execution, and portability across different
platforms and operating systems.
programming-level virtual machines, also called process virtual machines
The main advantage of programming-level virtual machines, is the ability to provide a
uniform execution environment across different platforms.
Eliminates the need to create different versions of the code for various operating
systems.
Restricts direct access to memory, providing a layer of abstraction for better
management.
Application Level Virtualization
Application-level virtualization is a technique enabling the execution of applications
in runtime environments lacking native support for required features.
Applications run without being installed in the expected runtime environment.
Suitable for scenarios with missing libraries in the host operating system.
One of the most popular solutions implementing application virtualization is Wine,
which is a software application allowing Unix-like operating systems to execute
programs written for the Microsoft Windows platform.
Other types of virtualization
● Storage virtualization
● Network Virtualization
● Desktop virtualization
● Storage virtualization
Storage virtualization refers to the method of physical storage abstraction.
The primary way of classifying storage virtualization is whether in-band or
out-of-band.
In-band (often called symmetric) between the host and the storage device permits
caching.
Virtualizing out-of-band (often called asymmetrical) uses host-based drivers that
first check at the metadata (indicating the location of the file) and then enable the
host to access the file directly from the stored location.
General benefits of storage virtualization
• Migration – Data can quickly be transferred through storage locations without
interrupting the live access of most technologies to the virtual partition.
• Utilization – The usage of storage devices can be managed for addressing over
and over using in the same way as server virtualization.
• Management – Most hosts may use storage to centrally manage a physical
device.:
Disadvantages
• Lack of Standards and Interoperability– Storage virtualization is a term, not a
standard. This also means the vendors don't interoperate easily.
• Metadata – The storage metadata and management are essential to a
functioning reliable system as there is a correlation between logical and physical
location.
• Backout – Mapping the backout of virtualized infrastructure from the network
from digital to physical locations is often less than trivial.
Network virtualization
This integrates hardware, software and network infrastructure with network
functionalities into a single virtual network administrative entity.
Virtualization of networks requires platform virtualization, often coupled with
virtualization of resources.
Network virtualization is defined as either outside or merged into a virtual unit or
internal, which gives the software containers a network like functionality on a
single system.
Desktop virtualization
Desktop virtualization provides the same outcome of hardware virtualization but
serves a different purpose.
Desktop virtualization addresses the problem of making the same desktop
environment accessible from everywhere.
Although the term desktop virtualization strictly refers to the ability to remotely
access a desktop environment, generally the desktop environment is stored in a
remote server or a data center that provides a high-availability infrastructure and
ensures the accessibility and persistence of the data.
Pros and Cons of virtualization
.
Most companies are keen to upgrade their solutions on virtual machines with the
rise of virtualization growing. Nonetheless, it is important to consider the
advantages and disadvantages of virtualization before any improvements are
made. The benefits and drawbacks of both physical and virtual systems, each of
which has time and location.
Virtual technology has obvious advantages, however there are a few drawbacks.
To order to decide how it best matches the company requirements we have
summarized the pros and cons of virtualization
Advantages of virtualization
Managed Execution and Isolation:
● Ensures secure and controllable computing environments.
● Allows the creation of virtual execution environments configured as sandboxes, preventing harmful
operations from crossing virtual host borders.
● Simplifies resource allocation and partitioning among different guests.
Resource Fine-Tuning:
● Enables fine-tuning of resources within virtual hosts, crucial for server consolidation and
effective quality of service.
Advantages of virtualization
Portability:
Virtual machine instances represented by files, easily transportable across physical systems.
Facilitates migration techniques in server consolidation scenarios.
Cost Reduction and Maintenance:
Reduces maintenance costs due to fewer hosts compared to virtual machine instances.
Limited opportunity for guest programs to damage underlying hardware in a virtual environment.
Fewer virtual machine managers expected compared to the number of managed instances.
Efficient Resource Utilization:
Allows multiple systems to coexist and share host resources securely.
Opportunities for energy consumption savings and reduced environmental impact.
Disadvantages of virtualization
Performance degradation:
Performance degradation is a significant concern in virtualization due to the abstraction
layer between guest and host, leading to increased latencies.
A major source of performance degradation is represented by the fact that the virtual
machine manager is executed and scheduled together with other applications, thus
sharing with them the resources of the host.
Disadvantages of virtualization
Inefficiency and degraded user experience
Virtualization can sometime lead to an inefficient use of the host. In particular,
some of the specific features of the host cannot be exposed by the abstraction
layer and then become inaccessible. In the case of hardware virtualization, this
could happen for device drivers: The virtual machine can sometime simply provide
a default graphic card that maps only a subset of the features available in the host.
Security holes and new threats
Virtualization opens the door to a new and unexpected form of phishing. The
capability of emulating a host in a completely transparent manner led the way to
malicious programs that are designed to extract sensitive information from the
guest.