VIRTUALIZATION
VM Architecture Types
• Depending on the position of the virtualization layer, there are three
classes of VM architectures, namely the
1. Hypervisor architecture (Full Virtualization)
2. Host-based virtualization
3. Para-virtualization
Hypervisor Architecture
• A hypervisor is a piece of software that allows to create and run
virtual machines (VMs)
• The hypervisor supports hardware-level virtualization on bare metal
devices like CPU, memory, disk and network interfaces.
• It generates and manages virtual computers by isolating the operating
system and resources.
• It supports Full Virtualization of the hardware resources
• It sits directly between the physical hardware and its OS.
• Depending on the functionality, a hypervisor can assume
1. a micro-kernel architecture (Microsoft Hyper-V )
2. a monolithic kernel hypervisor architecture(VMware ESX for server
virtualization)
Micro-kernal Vs Monolithic
Hypervisor
• A micro-kernel hypervisor includes only the basic and unchanging
functions (such as physical memory management and processor
scheduling).
• The device drivers and other changeable components are outside the
hypervisor.
• A monolithic hypervisor implements all the aforementioned
functions, including those of the device drivers.
• The size of the hypervisor code of a micro-kernel hypervisor is smaller
than that of a monolithic hypervisor.
Hypervisor Architecture – Full
virtualization
The Xen Architecture
• Xen is an open source hypervisor program developed by Cambridge University.
• Xen is a microkernel hypervisor, which provides a virtual environment located
between the hardware and the OS.
• The core components of a Xen system are the hypervisor, kernel, and applications.
• Many guest OSes can run on top of the hypervisor, however, not all guest OSes
are created equal, and one in particular controls the others.
• The guest OS, which has control ability, is called Domain 0, and the others are
called Domain U.
• Domain 0 is a privileged guest OS of Xen and it is first loaded when Xen boots
• Domain 0 is designed to access hardware directly and manage devices.
• One of the responsibilities of Domain 0 is to allocate and map hardware resources
for the guest domains (the Domain U domains)
• Vendors providing commercial Xen hypervisors are Citrix XenServer and Oracle
VM
The Xen Architecture
Support for Critical and Non Critical
Instructions
• With full virtualization, noncritical instructions run on the hardware
directly
• critical instructions are discovered and replaced with traps into the
VMM to be emulated by software (binary translation)
• binary translation can incur a large performance overhead.
• Noncritical instructions do not control hardware or threaten the
security of the system, but critical instructions do.
Virtualization in X86
• The x86 architecture offers four levels of privilege known as Ring 0, 1, 2 and 3 to
operating systems and applications to manage access to the computer hardware.
• The operating system needs to have direct access to the memory and hardware
and must execute its privileged instructions in Ring 0.
• The user level applications typically run in Ring 3
• Virtualizing the x86 architecture requires placing a virtualization layer under the
operating system to create and manage the virtual machines
• Some sensitive instructions can’t effectively be virtualized as they have different
semantics when they are not executed in Ring 0.
• The difficulty in trapping and translating these sensitive and privileged instruction
requests at runtime was a challenge that made x86 architecture virtualization look
impossible.
• VMware resolved this challenge in 1998, developing binary translation techniques
that allow the VMM to run in Ring 0 for isolation and performance
X86 Architecture (Software Assisted
Approach)
X86 without virtualization x86 after virtualization
(binary translation approach)
Noncritical instructions run on the hardware directly
Critical instructions are emulated by software
Full virtualization
• Software assisted full virtualization
1. The combination of binary translation and direct execution provides Full
Virtualization
2. The guest OS is fully abstracted (completely decoupled) from the underlying
hardware by the virtualization layer.
3. The guest OS is not aware it is being virtualized and requires no modification.
4. Examples include VMware workstation (32Bit guests), Virtual PC, VirtualBox
(32-bit guests), VMware Server
Full Virtualization
• Hardware-assisted full virtualization
1. Intel Virtualization Technology (VT-x) and AMD’s AMD-V (2006) support
privileged instructions with a new CPU execution mode feature that allows
the VMM to run in a new root mode below ring 0.
2. Privileged and sensitive calls are set to automatically trap to the hypervisor,
removing the need for binary translation or paravirtualization.
3. Hardware-assisted virtualization incurs high overhead switches between
processor modes
4. Processors with these hardware assist features include Intel VT and AMD-V,
VMware ESXi /ESX, KVM, Hyper-V, Xen
Hardware Support for Virtualization in
the Intel x86 Processor(H/W assisted)
• VT-x adds a privileged mode (VMX Root Mode) and some instructions to processors.
• VMM and guest OS run in different modes and all sensitive instructions of the guest OS
and its applications are trapped in the VMM.
X86 Architecture
(The hardware assist approach)
Comparison
X86 without virtualization
x86 after virtualization
(binary translation approach) x86 virtualization
(hardware assist approach)
Host-Based Virtualization
• This VM architecture has a virtualization layer on top of the host OS.
• This host OS is responsible for managing the hardware.
• The guest OSes are installed and run on top of the virtualization layer.
• The user can install this VM architecture without modifying the host
OS.
• Compared to the hypervisor architecture, the performance of the
host-based architecture is low.
• When an application requests hardware access, it involves four layers
of mapping which downgrades performance significantly.
• When the ISA of a guest OS is different from the ISA of the underlying
hardware, binary translation must be adopted.
Host-Based Virtualization
Para-virtualization
(OS Assisted Virtualization)
• Para-virtualization involves modifying the OS kernel to replace non-
virtualizable instructions with hypercalls
• Hypercalls can communicate directly with the virtualization layer hypervisor
• The guest source codes are modified and require extensions to make API
calls to the hypervisor
• Unlike the full virtualization architecture which intercepts and emulates
privileged and sensitive instructions at runtime, para-virtualization handles
these instructions at compile time.
• Para-virtualization is faster in operation as compared to full virtualization
but less portable and compatible.
• Products which supports para-virtualization include Xen, IBM LPAR, Oracle
VM for SPARC (LDOM) and Oracle VM for X86 (OVM)
Paravirtualization( with compiler
support)
Memory Virtualization
• Memory virtualization involves sharing the physical system memory and
dynamically allocating it to virtual machines.
• Memory virtualization for virtual machines is similar to the virtual memory
support provided by modern operating systems.
• All modern CPUs include a memory management unit (MMU) and a
translation lookaside buffer (TLB) to optimize virtual memory
performance.
• Memory virtualization requires to virtualize the MMU to support the guest
OS.
Memory Virtualization
(VMM and Two-level memory mapping at TLB)
• The guest OS controls the mapping of virtual addresses to the guest memory physical addresses
• The guest OS cannot have direct access to the actual machine memory.
• The Virtual machine monitor(VMM) is responsible for mapping guest physical memory to the actual
machine memory
• The VMM uses shadow page tables (to accommodate more than one OS) to accelerate the mappings.
• Shadow page tables perform virtual-memory-to-machine-memory address translation.
• The TLB maps the virtual memory directly to the machine memory to avoid the two levels of translation
on every access
Memory virtualization in Intel (Hardware assisted)
• EPT TLB: shadow page table of the EPT(Extended Page
Table) MMU
I/O Virtualization
• I/O virtualization involves managing the routing of I/O requests between
virtual devices and the shared physical hardware
• All the functions of a device such as device enumeration, identification,
interrupts, and DMA, are replicated in software.
• This software is located in the VMM and acts as a virtual device.
• The I/O access requests of the guest OS are trapped in the VMM which
interacts with the I/O devices.
• Three ways to implement I/O virtualization:
1. Full device emulation
2. Para-virtualization
3. Direct I/O
Device Emulation
• The hypervisor virtualizes the physical hardware and presents each virtual machine with a
standardized set of virtual devices
• These virtual devices effectively emulate well-known hardware and translate the virtual machine
requests to the system hardware.
• All virtual machines are configured to run on the same virtual hardware regardless of the actual
physical hardware in the system.
The Para-virtualization Method
• The para-virtualization method of I/O virtualization is typically used in Xen.
• It is also known as the split driver model consisting of a frontend driver and a
backend driver.
• The frontend driver is running in Domain U and the backend driver is running in
Domain 0.
• They interact with each other via a block of shared memory.
• The frontend driver manages the I/O requests of the guest OSes and the backend
driver is responsible for managing the real I/O devices and multiplexing the I/O
data of different VMs.
• Para-I/O-virtualization achieves better device performance than full device
emulation, but it comes with a higher CPU overhead.
Direct I/O virtualization
• Direct I/O virtualization lets the VM access devices directly.
• It is also known as Device Pass-Through
• The I/O MMU (memory management unit) virtualizes I/O the same
way an MMU virtualizes memory.
• It maps device memory addresses to real physical addresses
• Both the device and the guest OS are made unaware of any address
translation
• Each device is limited to use by one VM
• Introduces strong coupling between Guest and hardware
• This method eliminates all emulation and back-end overhead