Virtualization:

1
Virtualization Not Just For Servers
Hollis Blanchard PowerPC kernel hacker
2
Topics

• Definitions
• Benefits
• Tradeoffs
• Embedded Virtualization Use Cases
• Embedded Issues with Virtualization
• Conclusion

3
Virtualization from 10,000 feet

• Securely share hardware between multiple guest
  software stacks
• Minimize changes to guest software
• A host kernel manages the hardware resources
• Could multiplex hardware could just provide
  isolation
• KVM Linux as host kernel
• Isolation is a requirement
• Fault containment, security
• Host kernel must be more privileged than guests

app
app
app
app
app
app
guest
guest
kernel
host
processor
processor
4
Virtualization Flavors

• Full virtualization no guest kernel
  modifications at all
• Privileged operations in the guest are either
  handled by hardware or emulated by software
• Performance could benefit from guest co-operation
• Paravirtualization remove all privileged
  operations from guest kernel
• Including MMU and interrupt control
• Probably requires extensive source code
  modifications
• Balance good performance, minimize guest
  modifications
• Use full virtualization for most operations, but
  modify guest in performance-critical areas

5
Virtualization Benefits
6
Benefits of Server Virtualization

• Workload consolidation
• Increase server utilization
• Reduce capital, hardware management, power,
  space, heat costs
• Legacy OS support
• Especially with large slow-moving 3rd-party
  software products
• Instant provisioning
• Easily create new virtual machines
• Easily reallocate resources (memory, processor,
  IO) between running virtual machines
• Migration
• Predicted hardware downtime
• Workload balancing

7
Benefits of Embedded Virtualization

• Workload consolidation
• Flexible resource provisioning
• License barrier
• Legacy software support
• Especially important with dozens or hundreds of
  embedded operating systems, commercial and
  home-brew
• Improve reliability
• Improve security

8
Virtualization Tradeoffs
9
Virtualization Tradeoffs

• There is a performance tradeoff
• Applications that used to own the whole processor
  must now share it
• Hypervisor adds some runtime overhead too
• Full virtualization without hardware support
  means software emulation
• Increase in management complexity
• Old scenario two software stacks two hardware
  systems
• New scenario two software stacks one hardware
  system one host kernel
• More abstraction, more software layers, more
  complexity...
• More bugs
• Increases size of Trusted Computing Base
• Increases impact of (unpredicted) hardware failure

10
Embedded Virtualization Use Cases
11
Workload Consolidation

• Consolidate legacy systems

legacy SW
legacy SW
legacy SW
legacy SW
legacy SW
host kernel
legacy HW
legacy HW
new HW
12
Legacy Software

• Run legacy software on new core/chip/board with
  full virtualization

legacy SW
new SW
legacy SW
host kernel
legacy HW
new HW
13
Legacy Software

• Consolidate legacy software

RT app
RT app
visualization app
visualization app
proprietary kernel
Linux
proprietary kernel
Linux/KVM
core
core
core
core
14
Multicore Enablement

• Legacy uniprocessor applications

app
app
app
legacy app
legacy app
legacy kernel
multicore kernel
legacy app
legacy kernel
host kernel
core
core
core
core
core
15
Multicore Enablement

• Flexible resource management

data plane
data plane
control plane
host kernel
core
core
core
core
16
Improved Reliability

• Hot standby without additional hardware

app
backup app
app
HW
HW
HW
backup app
app
host kernel
HW
17
Secure Monitoring

• Protect monitoring software

monitor
app
network
app
network
kernel
kernel
host kernel
HW
HW
18
Embedded Virtualization Issues
19
Memory/flash footprint

• Is Linux too big to be a host kernel?
• Weren't you going to run Linux anyways?
• Do you need multiple copies of Linux?
• Different kernel versions
• Greater performance and functional isolation than
  plain Linux tasks
• Extremely tight footprint requirements? See TRANGO

20
Security

• Host kernel must be certified
• Increases size of Trusted Computing Base
• Extreme security requirements? See Green Hills
  Software's Padded Cell

21
Direct IO Access

• Guest can directly access physical IO without
  host involvement
• Native speed
• IOMMU provides isolation and physical address
  translation (DMA)?
• Translation could be done with guest
  modifications
• Issues
• IOMMU required for DMA isolation
• Limited by number of physical IO devices
• Guests must have device drivers
• What about legacy guests on new hardware?
• Breaks migration
• IRQ delivery and routing

22
Emulated IO

• Host software emulates guest IO accesses
• Issues
• Must write software to (perfectly?) emulate
  hardware
• Dramatic increase in IO latency
• Host OS must have physical device drivers
• Device driver availability, licensing concerns

23
Virtual IO

• No hardware at all, just inter-guest data
  transfer
• New guest device drivers co-operate with host
• Issues
• Requires guest modification (at least new device
  drivers)?
• Host OS still needs physical IO drivers

24
Real-time support

• RTOS Linux model
• Requires RT support in host kernel
• Scheduling
• Dedicated cores?
• Time-sharing adds context switch latency
• Interrupt handler latency
• Direct IO access?

Linux task
RTOS task
RTOS
Linux/KVM
core
core
device
25
Hardware Virtualization Support

• Efficient virtualization requires hardware
  support
• Goal minimize performance overhead and
  modifications to guests
• Architecture support
• High-end x86 (Intel VT, AMD SVM)?
• High-end PowerPC (PowerPC 970)?
• Embedded PowerPC virtualization architecture
  announced
• ARM TrustZone

26
Conclusion

• There is overlap between server and embedded
  virtualization scenarios, but also scenarios and
  issues unique to embedded systems.
• Deploying virtualization is an engineering
  tradeoff, but virtualization offers some
  compelling advantages for embedded applications.