A Brief Overview of Virtualization

大纲 What is Virtualization 虚拟化技术分类 Process VMs System VMs VMM implementation issues Security research
...... ....... .......

A Brief Overview of Virtualization

陈志杰
chenzhijie@icst.pku.edu.cn

蜜网项目组

April 14, 2008

. . . . . .

陈志杰 chenzhijie@icst.pku.edu.cn 蜜网项目组

...... ....... .......

大纲

1 What is Virtualization

2 虚拟化技术分类

3 Process VMs

4 System VMs

5 VMM implementation issues

6 Security research

. . . . . .


...... ....... .......
Defination

What is Virtualization ?

To virtualize means to take something of one form and make
it appear to be another form.[1]
To make a computer appear to be multiple computers or a
different computer entirely.
To making many computers appear to be a single computer.
(Server Aggregation/Grid Computing)
我们这里讨论的虚拟化指的是前者。
不过目前的趋势是合二为一，即将一些分离的计算资源抽象成统
一的资源库，然后再由 Virtual Machine Infrastructure 统一
调度，分配给多个虚拟的机器。

. . . . . .


...... ....... .......
Defination

虚拟化转化的是”form”，这里的form指的就是不同的接口（Inter-
face），所以，我们要先从Interface谈起。

. . . . . .


...... ....... .......
Abstraction

抽象(Abstraction)

在计算机结构日益复杂的今天，我们之所以能够有条不紊地继续发展
计算机理论和结构，正是由于存在不同层次的抽象，每层 Abstraction
都会定义一定的接口(Interface)，以隐藏具体实现以降低复杂性。
两个名词：
Architecture : A formal specification of an interface in
the system.
Implementation : The actual embodiment of an architec-
ture.

. . . . . .


...... ....... .......
Abstraction

计算机系统的三层 Interface [2]

ISA Instruction
Set Architec-
ture.
ABI Application
Binary Inter-
face.
API Application
Programming
Interface.

Figure: Computer system architecture
. . . . . .


...... ....... .......
Abstraction

Interface vs. Virtualization

Abstraction优点：统一的编程（软件、硬件）格式。
缺点：移植性
Virtualization : 从一种Abstraction转化到另外一种Abstrac-
tion。
Component Virtualization
System Virtualization
可以依照虚拟机技术所虚拟的层次(ISA、ABI或API)来对虚拟机分
类.

. . . . . .


...... ....... .......
Abstraction

Three Levels of Interface

ISA Instruction Set Architecture.
The ISA marks the division be-
tween hardware and software,
and consists of interfaces 3
and 4. Interface 4 represents
the user ISA and includes those
aspects visible to an applica-
tion program. Interface 3, the
system ISA, is a superset of the
Figure: Computer system user ISA and includes those as-
architecture
pects visible only to operating
system software responsible for
managing hardware resources.

. . . . . .


...... ....... .......
Abstraction


ABI Application Binary Interface.
The ABI gives a program access
to the hardware resources and
services available in a sys-
tem through the user ISA (in-
terface 4) and the system call
interface (interface 2). The
ABI does not include system in-
structions; rather, all appli-
Figure: Computer system cation programs interact with
architecture
the hardware resources indi-
rectly by invoking the operat-
ing system’s services via the
system call interface.
. . . . . .


...... ....... .......
Abstraction


API Application Programming Inter-
face.
The API gives a program access
to the hardware resources and
services available in a sys-
tem through the user ISA (in-
terface 4) supplemented with
high-level language (HLL) li-
brary calls (interface 1). Any
Figure: Computer system system calls are usually per-
architecture
formed through libraries. Us-
ing an API enables application
software to be ported easily,
through recompilation, to other
systems that support the same
. . . . . .

陈志杰 chenzhijie@icst.pku.edu.cn API. 蜜网项目组

...... ....... .......

What is a Virtual Machine

The meaning of “machine”:
From the process’s perspective :
A logical memory address space.
User-level instructions and registers.
I/O (only visible through the operating system calls).
Thus the ABI defines the machine as seen by a process.
Similarly, the API specifies the machine characteristics
as seen by an application’s HLL program.

. . . . . .


...... ....... .......

What is a Virtual Machine

From the operating system’s perspective :
the underlying hardware’s characteristics alone define the
machine
So it is the ISA that provides the interface between the
system and machine.
So there are process VMs and system VMs.

. . . . . .


...... ....... .......

Process VMs and System VMs

A process VM is a virtual platform that executes an in-
dividual process. This type of VM exists solely to support
the process; it is created when the process is created and
terminates when the process terminates. The virtualizing
software that implements a process VM is often termed the
runtime, short for “runtime software.”
A system VM provides a complete, persistent system en-
vironment that supports an operating system along with its
many user processes. It provides the guest operating system
with access to virtual hardware resources, including net-
working, I/O, and perhaps a graphical user interface along
with a processor and memory. The virtualizing software in
a system VM is typically referred to as the virtual machine
monitor (VMM).
. . . . . .


...... ....... .......

Process Virtual Machines

Multiprogrammed systems :The most common process VM.
Emulators and dynamic binary translators More challeng-
ing problem for process-level VMs is that of supporting
program binaries compiled to an instruction set different
from the one the host executes. eg: Intel IA32-EL which
allows Intel IA-32 application binaries to run on Itanium
hardware.
Same-ISA binary optimizers Dynamo system.
High-level-language VMs The Sun Microsystems Java VM
architecture and the Microsoft Common Language Infrastruc-
ture.
注:HLL environment 仅指需要runtime的语言。

. . . . . .


...... ....... .......
System VM history

System VM History

可以追溯到20世纪70年代IBM大型机。在经过一个低谷之后，又在以
VMware为代表的运行在小型或者微型计算机上的新一代虚拟机的带领
下重新崛起。

. . . . . .


...... ....... .......
Classic System VMs

Classic System VMs

The classic approach places the VMM on bare hardware and
the VMs fit on top.
The VMM runs in the most highly privileged mode, while
all guest systems run with reduced privileges so that the
VMM can intercept and emulate all guest operating system
actions that would normally access or manipulate critical
hardware resources.

. . . . . .


...... ....... .......
Hosted VM

Hosted VMs
An alternative system VM implementation builds virtualiz-
ing software on top of an existing host operating system,
resulting in a hosted VM.
Advantage:
A user installs it just like a typical application program.
Virtualizing software can rely on the host operating system
to provide device drivers and other lower-level services
rather than on the VMM.Virtualizing software can rely on the
host operating system to provide device drivers and other
lower-level services rather than on the VMM.
Example:
VMware GSX server
VMware GSX Server将一台实体的电脑变成许多的虚拟服务器，这
些虚拟服务器其实是由单一的硬件所架构成的，系统资源依据每
一台虚拟机器的需求，分配到所有的虚拟机器。
. . . . . .


...... ....... .......
Whole System VM

Whole System VMs

The VM software executes as an application program sup-
ported by the host operating system and uses no system ISA
operations.
An example of this type of VM is the Virtual PC (and VMware
Workstation?).

. . . . . .


...... ....... .......
Multiprocessor virtualization

Multiprocessor virtualization

Here, an important objective is to partition the large sys-
tem into multiple smaller multiprocessor systems by dis-
tributing the underlying hardware resources of the large
system.
物理上或者是时间上划分成多个独立的。

. . . . . .


...... ....... .......
Codesigned VM

Codesigned VMs

Codesigned VMs implement new, proprietary ISAs targeted at
improving performance, power efficiency, or both.
Perhaps the best-known example of a codesigned VM is the
Transmeta Crusoe.11 In this processor, the underlying hard-
ware uses a very-long instruction word architecture, and
the guest ISA is the Intel IA-32. The Transmeta design-
ers focused on the power-saving advantages of simpler VLIW
hardware.

. . . . . .


...... ....... .......
Codesigned VM

Partial Summary

Figure: The Vitual Machine Category
. . . . . .


...... ....... .......
CPU virtualization

CPU Virtualization

ĎĎĎĎĎDirect execution
Executing the virtual machine on the real machine, while
letting the VMM retain ultimate control of the CPU.
A CPU architecture is virtualizable only if it supports the
basic VMM technique of direct execution.
Requires running the virtual machine’s privileged (operating-
system kernel) and unprivileged code in the CPU’s unpriv-
ileged mode, while the VMM runs in privileged mode.Thus,
when the virtual machine attempts to perform a privileged
operation, the CPU traps into the VMM.

. . . . . .


...... ....... .......
CPU virtualization

遇到的问题一

对于x86架构：”Certain privileged-mode instructions do not
trap, and can return different results based upon the
mode.”
如：An instruction that disables interrupts
Letting a guest operating system disable interrupts would
not be safe since the VMM could not regain control of the
CPU.Instead, the VMM would trap the operation to disable
interrupts and then record that interrupts were disabled
for that virtual machine.
具体来说，如 POPF 指令。

. . . . . .


...... ....... .......
CPU virtualization

遇到的问题之二

Unprivileged instructions let the CPU access privileged
state.
这样由于是虚拟的缘故（GuestOS运行在用户态），会得到“错
误”的当前运行级的信息。
Software running in the virtual machine can read the code
segment register to determine the processor’s current
privilege level. But the x86 doesn’t trap the instruc-
tion, so with direct execution, the software would see the
wrong privilege level in the code segment register.

. . . . . .


...... ....... .......
CPU virtualization

解决方案

Paravirtualization
With paravirtualization, the VMM builder defines the vir-
tual machine interface by replacing nonvirtualizable por-
tions of the original instruction set with easily virtual-
ized and more efficient equivalents.
缺点： Operating systems must be ported to run in a virtual
machine.
Direct execution + Fast binary translation (Vmware、QEMU)
对 User Mode 的程序 direct execution , 对 kernel mode 的代
码“打补丁”.
Intel Vanderpool technology and AMD Pacifica technology.

. . . . . .


...... ....... .......
Memory virtualization

Memory Virtualization

主要技术：
Maintain a shadow of the virtual machine’s memory-management
data structure.
When the operating system running in a virtual machine
establishes a mapping in its page table, the VMM detects
the changes and establishes a mapping in the corresponding
shadow page table entry that points to the actual page
location in the hardware memory.

. . . . . .


...... ....... .......
Memory virtualization

问题和解决方案

cache 的交换和内存空间回收的选择问题。
VMware ESX solution:: a balloon process running inside the
GuestOS can communicate with the VMM.
多个虚拟机之间存在重复的内存数据区。
VMware solution: Content-based page sharing

. . . . . .


...... ....... .......
I/O virtualization

I/O virtualization

古老的IBM大型机的做法：A channel-based architecture.(不懂)
VMware Workstation 的做法：Hosted architecture(Using the
device drivers of a host operating system (HostOS))
ESX Server solution: A highly optimized I/O subsystem for
network and storage devices.(实际上是使用的Linux Kernel的
I/O部分)

. . . . . .


...... ....... .......

Security research

Livewire: a system that uses a VMM for advanced intrusion
detection on the software in the virtual machines.
ReVirt: uses the VMM layer to analyze the damage hackers
might have caused during the break-in.
Argos: Dynamic Dataflow Analyze.
etc.

. . . . . .


...... ....... .......

Virtualization in the future

开头提到的 Virtual Center.
Migrating software as data.
Security.

. . . . . .


...... ....... .......

参考文献
[1] M. Tim Jones
Virtual Linux –An overview of virtualization methods, architectures, and
implementations [EB/OL].
IBM DeveloperWorks.
http://www.ibm.com/developerworks/library/l-linuxvirt/ .

[2] James E.Smith and Ravi Nair
The Architecture of Virtual Machines [J]
Computer, May 2005 IEEE.

[3] Mendel Rosenblum and Tal Garfinkel
Virtual Machine Monitors: Current Technology and Future Trends [J].
Computer, May 2005 IEEE.

[4] Fabrice Bellard
QEMU, a Fast and Portable Dynamic Translator.
2005 USENIX Annual Technical Conference.

. . . . . .


...... ....... .......

谢谢大家！

. . . . . .


A Brief Overview of Virtualization

More Related Content

Similar to A Brief Overview of Virtualization

Recently uploaded

A Brief Overview of Virtualization