Virtualization
- 8. Advantages of virtualization • Managed execution and isolation are the most important advantages of virtualization. These two characteristics allow building secure and controllable computing environments. • A virtual execution environment can be configured as a sandbox, preventing any harmful operation to the virtual host. • Allocation of resources and their partitioning among different guests is simplified, being the virtual host controlled by a program. • Fine-tuning of resources, which is very important in a server consolidation scenario and is also a requirement for effective quality of service. • Portability is another advantage of virtualization, especially for execution virtualization techniques.
- 9. • Self-contained since they do not have other dependencies besides the virtual machine manager for their use. • Portability and self-containment also contribute to reducing the costs of maintenance, since the number of hosts is expected to be lower than the number of virtual machine instances.
- 10. Disadvantages of virtualization • Performance degradation • Inefficiency and degraded user experience • Security holes and new threats
- 11. Performance degradation • Since virtualization interposes an abstraction layer between the guest and the host, the guest can experience increased latencies. • For instance, in the case of hardware virtualization, where the intermediate emulates a bare machine on top of which an entire system can be installed. •
- 12. • The causes of performance degradation can be traced back by the following activities: Maintaining the status of virtual processors Support of privileged instructions (trap and simulate privileged instructions) Support of paging within VM Console functions
- 13. Inefficiency and degraded user experience • Virtualization can sometime lead to an inefficient use of the host. • In particular, some of the specific features of the host cannot be exposed by the abstraction layer and then become inaccessible. • In the case of hardware virtualization, this could happen for device drivers: The virtual machine can sometime simply provide a default graphic card that maps only a subset of the features available in the host. • In the case of programming-level virtual machines, some of the features of the underlying operating systems may become inaccessible unless specific libraries are used.
- 14. Security holes and new threats • Virtualization opens the door to a new and unexpected form of phishing. • The capability of emulating a host in a completely transparent manner led the way to malicious programs that are designed to extract sensitive information from the guest.
- 15. • In the case of hardware virtualization, malicious programs can preload themselves before the operating system and act as a thin virtual machine manager toward it. • The operating system is then controlled and can be manipulated to extract sensitive information of interest to third parties. • Eamples of these kinds of malware are BluePill and SubVirt. • BluePill, malware targeting the AMD processor family, moves the execution of the installed OS within a virtual machine. • The original version of SubVirt was developed as a prototype by Microsoft through collaboration with Michigan University. • SubVirt infects the guest OS, and when the virtual machine is rebooted, it gains control of the host.
- 16. Technology examples • A wide range of virtualization technology is available especially for virtualizing computing environments. • Xen: paravirtualization • VMware: full virtualization • Microsoft Hyper-V
- 17. • Para virtualization: • 1.unlike full virtualization ,guest servers are aware of one another. • 2. Hypervisor does not need large amounts of processing power to manage guest os. • 3 .The entire system work as a cohesive unit. • Advantages: • As a guest os can directly communicate with hypervisor • This is efficient virtualization. • Allow users to make use of new or modified device drivers. • Limitations: • Para virtualization requires the guest os to be modified in order to interact with para virtualization interfaces. • It requires significant support and maintaibilty issues in production environment
- 18. Paravirtualization •Paravirtualization is an enhancement of virtualization technology in which a guest OS is recompiled prior to installation inside a virtual machine. •Paravirtualization allows for an interface to the virtual machine that can differ somewhat from that of the underlying hardware. •This capacity minimizes overhead and optimizes system performance by supporting the use of virtual machines that would be underutilized in conventional or full virtualization.
- 19. •The main limitation of paravirtualization is the fact that the guest OS must be tailored specifically to run on top of the virtual machine monitor (VMM), the host program that allows a single computer to support multiple, identical execution environments. • However, paravirtualization eliminates the need for the virtual machine to trap privileged instructions. •Trapping, a means of handling unexpected or unallowable conditions, can be time-consuming and can adversely impact performance in systems that employ full virtualization. •Paravirtualization is an expansion of a technology that has existed for years in the IBM OS known as VM. Xen, an open- source software project, incorporates paravirtualization.
- 20. Xen: paravirtualization • Xen is an open-source initiative implementing a virtualization platform based on paravirtualization. • Initially developed by a group of researchers at the University of Cambridge in the United Kingdom, Xen now has a large open-source community backing it. • Citrix also offers it as a commercial solution, XenSource. • Xen-based technology is used for either desktop virtualization or server virtualization, and recently it has also been used to provide cloud computing solutions by means of Xen Cloud Platform (XCP). • Recently Xen has been advanced to support full virtualization using hardware- assisted virtualization.
- 21. • Xen is the most popular implementation of paravirtualization, which, in contrast with full virtualization,allows high-performance execution of guest operating systems. • This is made possibl eliminating the performance loss while executing instructions that require special management • This is done by modifying portions of the guest operating systems run by Xen with reference to the execution of such instructions. • Therefore it is not a transparent solution for implementing virtuazation. • This is particularly true for x86, which is the most popular architecture on commodity machines and servers.
- 22. Xen architecture and guest OS management.
- 23. • Figure describes the architecture of Xen and its mapping onto a classic x86 privilege model. • A Xen-based system is managed by the Xen hypervisor, which runs in the highest privileged mode and controls the access of guest operating system to the underlying hardware. • Guest operating systems are executed within domains, which represent virtual machine instances. • Moreover, specific control software, which has privileged access to the host and controls all the other guest operating systems, is executed in a special domain called Domain 0. • This is the first one that is loaded once the virtual machine manager has completely booted, and it hosts a HyperText Transfer Protocol (HTTP) server that serves requests for virtual machine creation, configuration, and termination.
- 24. • All the other domains running guest operating systems—generally referred to as Domain U—in Ring 1, while the user applications are run in Ring 3. • This allows Xen to maintain the ABI unchanged, thus allowing an easy switch to Xen-virtualized solutions from an application point of view. • Because of the structure of the x86 instruction set, some instructions allow code executing in Ring 3 to jump into Ring 0 (kernel mode). • Such operation is performed at the hardware level and therefore within a virtualized environment will result in a trap or silent fault, thus preventing the normal operations of the guest operating system, since this is now running in Ring 1. • With the use of hypercalls, the Xen hypervisor is able to catch the execution of all the sensitive instructions, manage them, and return the control to the guest operating system by means of a supplied handler. • Paravirtualization needs the operating system codebase to be modified, and hence not all operating systems can be used as guests in a Xen-based
- 25. Full virtualization: 1.Guest operating systems are unaware of each other 2.Provide support for unmodified guest operating system. 3.Hypervisor directly interact with the hardware such as CPU,disks. 4.Hyperwiser allow to run multiple os simultaneously on host computer. 5.Each guest server run on its own operating system Few implementations: Oracle's Virtaulbox , VMware server, Microsoft Virtual PC Advantages: 1.This type of virtualization provide best isolation and security for Virtual machine. 2.Truly isolated multiple guest os can run simultaneously on same hardware. 3.It's only option that requires no hardware assist or os assist to virtualize sensitive and privileged instructions. imitations: 1.full virtualization is usually bit slower ,because of all emulation. 2.hyoerwiser contain the device driver and it might be difficult for new device drivers to be nstaller by users.
- 26. VMware: full virtualization VMware’s technology is based on the concept of full virtualization, where the underlying hardware is replicated and made available to the guest operating system, which runs unaware of such abstraction layers and does not need to be modified. VMware implements full virtualization either in the desktop environment, by means of Type II hypervisors, or in the server environment, by means of Type I hypervisors. In both cases, full virtualization is made possible by means of direct execution (for nonsensitive instructions) and binary translation (for sensitive instructions), thus allowing the virtualization of architecture such as x86. Besides these two core solutions, VMware provides additional tools and software that simplify the use of virtualization technology either in a desktop environment, or in a server environment.
- 27. A full virtualization reference model.
- 28. Virtualization solutions • VMware is a pioneer in virtualization technology and offers a collection of virtualization solutions covering the entire range of the market, from desktop computing to enterprise computing and infrastructure virtualization. End-user (desktop) virtualization • VMware supports virtualization of operating system environments and single applications on end user computers. • The first option is the most popular and allows installing a different operating systems and applications in a completely isolated environment from the hosting operating system. • Specific VMware software—VMware Workstation, for Windows operating systems, and • Vmware Fusion, for Mac OS X environments—is installed in the host operating system to create virtual machines and manage their execution.
- 30. VMware GSX server architecture.
- 31. VMware ESXi server architecture.
- 32. VMware Cloud Solution stack.
- 33. Microsoft Hyper-V • Hyper-V is an infrastructure virtualization solution developed by Microsoft for server virtualization. • As the name recalls, it uses a hypervisor-based approach to hardware virtualization, which leverages several techniques to support a variety of guest operating systems. • Hyper-V is currently shipped as a component of Windows Server 2008 R2 that installs the hypervisor as a role within the server.
- 35. Hypervisor •The hypervisor is the component that directly manages the underlying hardware (processors and memory). It is logically defined by the following components: • Hypercalls interface. This is the entry point for all the partitions for the execution of sensitive instructions. This interface is used by drivers in the partitioned operating system to contact the hypervisor using the standard Windows calling convention. • Memory service routines (MSRs). These are the set of functionalities that control the memory and its access from partitions. By leveraging hardware-assisted virtualization, the hypervisor uses the Input/Output Memory Management Unit (I/O MMU or IOMMU) to fast-track access to devices from partitions by translating virtual memory addresses. • Advanced programmable interrupt controller (APIC). This component represents the interrupt controller, which manages the signals coming from the underlying hardware when some event occurs (timer expired, I/O ready, exceptions and traps).
- 36. • Scheduler. This component schedules the virtual processors to run on available physical processors. The scheduling is controlled by policies that are set by the parent partition. • Address manager. This component is used to manage the virtual network addresses that arealloca ted to each guest operating system. • Partition manager. This component is in charge of performing partition creation, finalization,destruction, enumeration, and configurations. Its services are available through the hypercalls interface API previously discussed.