Virtualization:

1
Virtualization Not Just For Servers
Hollis Blanchard PowerPC kernel hacker
2
Topics

• Definitions
• Benefits
• Tradeoffs
• Embedded Virtualization Use Cases
• Embedded Issues with Virtualization
• Conclusion

3
Virtualization from 10,000 feet

• Securely share hardware between multiple guest
  software stacks
• Minimize changes to guest software
• A host kernel manages the hardware resources
• Could multiplex hardware could just provide
  isolation
• KVM Linux as host kernel
• Isolation is a requirement
• Fault containment, security
• Host kernel must be more privileged than guests

app
app
app
app
app
app
guest
guest
kernel
host
processor
processor
4
Virtualization Flavors

• Full virtualization no guest kernel
  modifications at all
• Privileged operations in the guest are either
  handled by hardware or emulated by software
• Performance could benefit from guest co-operation
• Paravirtualization remove all privileged
  operations from guest kernel
• Including MMU and interrupt control
• Probably requires extensive source code
  modifications
• Balance good performance, minimize guest
  modifications
• Use full virtualization for most operations, but
  modify guest in performance-critical areas

5
Virtualization Benefits
6
Benefits of Server Virtualization

• Workload consolidation
• Increase server utilization
• Reduce capital, hardware management, power,
  space, heat costs
• Legacy OS support
• Especially with large slow-moving 3rd-party
  software products
• Instant provisioning
• Easily create new virtual machines
• Easily reallocate resources (memory, processor,
  IO) between running virtual machines
• Migration
• Predicted hardware downtime
• Workload balancing

7
Benefits of Embedded Virtualization

• Workload consolidation
• Flexible resource provisioning
• License barrier
• Legacy software support
• Especially important with dozens or hundreds of
  embedded operating systems, commercial and
  home-brew
• Improve reliability
• Improve security

8
Virtualization Tradeoffs
9
Virtualization Tradeoffs

• There is a performance tradeoff
• Applications that used to own the whole processor
  must now share it
• Hypervisor adds some runtime overhead too
• Full virtualization without hardware support
  means software emulation
• Increase in management complexity
• Old scenario two software stacks two hardware
  systems
• New scenario two software stacks one hardware
  system one host kernel
• More abstraction, more software layers, more
  complexity...
• More bugs
• Increases size of Trusted Computing Base
• Increases impact of (unpredicted) hardware failure

10
Embedded Virtualization Use Cases
11
Workload Consolidation

• Consolidate legacy systems

legacy SW
legacy SW
legacy SW
legacy SW
legacy SW
host kernel
legacy HW
legacy HW
new HW
12
Legacy Software

• Run legacy software on new core/chip/board with
  full virtualization

legacy SW
new SW
legacy SW
host kernel
legacy HW
new HW
13
Legacy Software

• Consolidate legacy software

RT app
RT app
visualization app
visualization app
proprietary kernel
Linux
proprietary kernel
Linux/KVM
core
core
core
core
14
Multicore Enablement

• Legacy uniprocessor applications

app
app
app
legacy app
legacy app
legacy kernel
multicore kernel
legacy app
legacy kernel
host kernel
core
core
core
core
core
15
(No Transcript)
16
Improved Reliability

• Hot standby without additional hardware

app
backup app
app
HW
HW
HW
backup app
app
host kernel
HW
17
Secure Monitoring

• Protect monitoring software

monitor
app
network
app
network
kernel
kernel
host kernel
HW
HW
18
Embedded Virtualization Issues
19
Memory/flash footprint

• Is Linux too big to be a host kernel?
• Weren't you going to run Linux anyways?
• Do you need multiple copies of Linux?
• Different kernel versions
• Greater performance and functional isolation than
  plain Linux tasks
• Extremely tight footprint requirements? See TRANGO

20
Security

• Host kernel must be certified
• Increases size of Trusted Computing Base
• Extreme security requirements? See Green Hills
  Software's Padded Cell

21
Direct IO Access

• Guest can directly access physical IO without
  host involvement
• Native speed
• IOMMU provides isolation and physical address
  translation (DMA)?
• Translation could be done with guest
  modifications
• Issues
• IOMMU required for DMA isolation
• Limited by number of physical IO devices
• Guests must have device drivers
• What about legacy guests on new hardware?
• Breaks migration
• IRQ delivery and routing

22
Emulated IO

• Host software emulates guest IO accesses
• Issues
• Must write software to (perfectly?) emulate
  hardware
• Dramatic increase in IO latency
• Host OS must have physical device drivers
• Device driver availability, licensing concerns

23
Virtual IO

• No hardware at all, just inter-guest data
  transfer
• New guest device drivers co-operate with host
• Issues
• Requires guest modification (at least new device
  drivers)?
• Host OS still needs physical IO drivers

24
Real-time support

• RTOS Linux model
• Requires RT support in host kernel
• Scheduling
• Dedicated cores?
• Time-sharing adds context switch latency
• Interrupt handler latency
• Direct IO access?

Linux task
RTOS task
RTOS
Linux/KVM
core
core
device
25
Hardware Virtualization Support

• Efficient virtualization requires hardware
  support
• Goal minimize performance overhead and
  modifications to guests
• Architecture support
• High-end x86 (Intel VT, AMD SVM)?
• High-end PowerPC (PowerPC 970)?
• Embedded PowerPC virtualization architecture
  announced
• ARM TrustZone

26
Conclusion

• There is overlap between server and embedded
  virtualization scenarios, but also scenarios and
  issues unique to embedded systems.
• Deploying virtualization is an engineering
  tradeoff, but virtualization offers some
  compelling advantages for embedded applications.