Optimizing guest swapping using elastic and transparent memory provisioning on virtualization platform

Virtualization platforms allow multiple operating systems to run on the same hardware. One of their central goal is to provide strong isolation between guest operating systems, unfortunately, they are often vulnerable to practical side-channel attacks. Cache attacks are a common class of side-channel attacks that use the cache as a side channel. We formalize an idealized model of virtualization that features the cache and the Translation Look aside Buffer (TLB), and that provides an abstract treatment of cache-based side-channels. We then use the model for reasoning about cache-based attacks and countermeasures, and for proving that isolation between guest operating systems can be enforced by flushing the cache upon context switch. In addition, we show that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform. The models and proofs have been machine-checked in the Coqproof assistant.

VMM (virtual machine monitor) introspection makes it possible to design dynamic protection system of virtualized guest OS. TDE (trusted domain enforcement) is an extension of TE (type enforcement) for dynamic access control and sandbox. VMM provides a strong isolation which can enhance TDE of guest domain. In this paper we propose an enhancement of trusted domain enforcement of guest domain using VMM interruption mechanism. Trusted domain enforcement of guest OS is improved by interruption and strong isolation provided by VMM. VMM based TDE is achieved by two steps. A non-write protected input for guest domain is detected, notification is sent to VMM. Then, VMM isolates the domain from other domains. Proposed system needs notification channel passing VMM and guest OS modification. We discuss the way to create the notification channel by a newly added VMM interruption. Also, the modification of guest OS is presented. We implement input validation routine by kernel patch and LSM (Linux security module) and compare CPU utilization. Proposed system enables dynamic sandboxing of virtualized OS with strong isolation by VMM interruption mechanism.

In these days, the performance gain of hardware promotes the use of Virtual Machine Monitors (VMMs) even in embedded systems. By using VMMs, we can overcome many of the issues in embedded systems. Therefore, we implemented a VMM for the ARM architecture that is the most widely used CPU for embedded systems. Since the VMM executes in privileged mode and its guest OS executes in non-privileged mode, the VMM can catch the execution of sensitive instructions as exceptions and emulate them appropriately. The guest OS can execute in non-privileged mode thanks to the virtual banked registers and the virtual processor mode provided by the VMM. Domains are used to for the access control between the guest OS and the VMM. The VMM was implemented for the ARM926EJ-S processor, and can successfully boot the Linux on it.

In cloud computing, it is often assumed that cloud vendors are trusted; the guest Operating System (OS) and the Virtual Machine Monitor (VMM, also called Hypervisor) are secure. However, these assumptions are not always true in practice and existing approaches cannot protect the data privacy of applications when none of these parties are trusted. We investigate how to cope with a strong threat model which is that the cloud vendors, the guest OS, or the VMM, or both of them are malicious or untrusted, and can launch attacks against privacy of trusted user applications. This model is relevant because applications may be small enough to be formally verified, while the guest OS and VMM are too complex to be formally verified. Specifically, we present the design and analysis of an architectural solution which integrates a set of components on-chip to protect the memory of trusted applications from potential software and hardware based attacks from untrusted cloud providers, compromised guest OS, or malicious VMM. Full-system performance evaluation results show that the design only incurs 9 percent overhead on average, which is a small performance price that is paid for the substantial security gain.

Consolidating multiple virtual machines into a single server has been widely adopted in cloud computing to improve system utilization. However, the sharing of physical CPUs among virtual machines in consolidated systems poses a new challenge in providing an illusion of continuous CPU execution to the guest operating systems (OS). Due to the time-sharing of physical CPUs, the execution of a guest OS is periodically interrupted, while the guest OS may not be aware of the discontinuity of virtual time against the real time. The virtual time discontinuity problem causes the delayed processing of critical OS operations, such as interrupt handling and lock processing. Although there have been several prior studies to mitigate the problem, they address only a subset of symptoms, require the modification of guest OSes, or change the processor architecture. This paper proposes a novel way to comprehensively reduce the inefficiency of guest OS execution in consolidated systems. It migrates the short-lived critical OS tasks to dedicated micro-sliced cores, minimizing the delays caused by time sharing. The hypervisor identifies the critical OS tasks without any OS intervention, and schedules the critical code sections onto the dynamically partitioned cores at runtime. The dedicated micro-sliced cores employ a short sub-millisecond quantum to minimize the response latencies for consolidated virtual machines. By readily servicing the critical tasks, the proposed scheme can minimize the adverse artifact of virtual machine consolidation without any modification of guest OSes.

There are several advantages to use virtual machine monitors (VMMs) for better security, reliability, and/or availability of systems. As embedded systems become more complex and open systems, there are more reasons to employ VMMs on embedded systems. Although there are more temptations to use VMMs, there are only a small number of VMMs available for embedded systems, and more of them are commercial proprietary software. Therefore, we decided to develop our own VMM on the ARM processor. We call it SIVARM: a simple VMM for the ARM architecture, because it is based on a simple trap and emulation model to virtualize the ARM processor. Since the VMM executes in privileged mode and its guest OS executes in non-privileged mode, the VMM can catch the execution of sensitive instructions as exceptions and emulate them appropriately. The guest OS can execute in non-privileged mode thanks to the virtual banked registers and the virtual processor mode provided by the VMM. The VMM was implemented for the ARM 1136JF-S processor, and can successfully boot Linux on it.

Virtualization allows creating isolated computing environments, often called virtual machines (VM), which execute on a shared underlying physical hardware infrastructure. From a application designer’s perspective, it is critical to understand performance characteristics of such virtualized platforms. This is a challenging task mainly due to: a) There are multiple types of virtualization platforms such as Virtual Machine Monitor (VMM) based and operating system (OS) based. b) Most existing studies are focussed on evaluating narrow low-level subsystems of such platforms.Three main forms of virtualization platforms – bare metal VMM, hosted VMM and OS based – are examined to understand their performance characteristics, such as CPU and memory usage, cross VM interference, from different dimensions. These characteristics are examined at macro level from applications perspective by subjecting these platforms to different types of load mix. One of our findings shows that the impact of VM co-location on different performance indicators is strongly dependent on platform and workload types.

Recently, virtual machines (VMs) with a large amount of memory are widely used. It is often not easy to migrate such a large-memory VM because VM migration requires one large destination host. To address this issue, split migration divides the memory of a VM into small pieces and transfers them to multiple destination hosts. The migrated VM exchanges its memory data between the hosts using remote paging. To prevent information leakage from the memory data in an untrusted environment, memory encryption can be used. However, encryption overhead largely affects the performance of the hosts and the VM. This paper proposes SEmigrate for optimizing the memory encryption in split migration and remote paging. SEmigrate avoids decrypting memory data at most of the destination hosts to reduce the overhead and completely prevent information leakage. Also, it selectively encrypts only the memory data containing sensitive information by analyzing the memory of the guest operating system in a VM. SEmigrate could reduce the CPU utilization during encrypted split migration by 6–20% point and improve the performance of the migrated VM with encrypted remote paging to 1.9\(\times \).

In traditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

Storage cache prefetching is an effective technique for reducing the access latency in hierarchical storage systems when the access pattern is predictable based on access locality.In Infrastructure-as-a-Service (IaaS) clouds, however, storage virtualization significantly rearranges data placement, thereby reducing the spatial locality observed in the host operating system (OS). Moreover, IaaS clouds consolidate applications with various workloads that may change over time.Therefore, the access pattern changes both spatially and temporally.This paper proposes an adaptive storage cache prefetching scheme that uses structural and statistical information inside virtual machines (VMs). Observation of the application's file usage and internal file-layout information in the guest OS allows the host OS to capture spatial and temporal locality during storage access.In addition, application-level performance statistics allow the host OS to tune the prefetch speed adaptively to prevent performance degradation due to excessive prefetching.We implemented a prototype cache prefetching system that cooperates with Linux and PostgreSQL in a VM.Experiments using the TPCx-V benchmark showed that VM-awareness improved the performance by 17.1% compared with traditional prefetching.Our system achieved 3.15 times better performance than an existing non-prefetching caching system.

Virtual machine monitors (VMMs) are a popular platform for Internet hosting centers and cloud-based compute services. By multiplexing hardware resources among virtual machines (VMs) running commodity operating systems, VMMs decrease both the capital outlay and management overhead of hosting centers. Appropriate placement and migration policies can take advantage of statistical multiplexing to effectively utilize available processors. However, main memory is not amenable to such multiplexing and is often the primary bottleneck in achieving higher degrees of consolidation.Previous efforts have shown that content-based page sharing provides modest decreases in the memory footprint of VMs running similar operating systems and applications. Our studies show that significant additional gains can be had by leveraging both sub-page level sharing (through page patching) and in-core memory compression. We build Difference Engine, an extension to the Xen virtual machine monitor, to support each of these--in addition to standard copy-on-write full page sharing--and demonstrate substantial savings not only between VMs running similar applications and operating systems (up to 90%), but even across VMs running disparate workloads (up to 65%). In head-to-head memory-savings comparisons, Difference Engine outperforms VMware ESX server by a factor of 1.5 for homogeneous workloads and by a factor of 1.6-2.5 for heterogeneous workloads. In all cases, the performance overhead of Difference Engine is less than 7%.

Cloud computing model along with virtualization enables scalable infrastructures and provides on demand access to computing resources. Virtualization technology facilitates multiple virtual servers to run on a physical server to enhance the utilization of the server. Hypervisor as a virtualization layer provides an infrastructural support to multiple virtual machines above it by virtualizing hardware resources such as CPU, Memory, Disk and NIC. Hypervisors give near native performance by negating virtualization overhead. ESXi is one of the hypervisors which gives near native performance using full virtualization technique. It is encouraging to study how different Operating Systems (OSs) perform in a virtualized environment in the Private Cloud with ESXi hypervisor. Guest Operating Systems do come in para-virtualized and hardware virtualized flavors. It is innovative idea to compare them from performance perspective to give an idea about their performance variations in different tests. This paper conducts different performance tests with low, medium, high workloads and results are gathered using SIGAR API (System Information Gatherer and Reporter) and explains the behavior of each operating system and gives the reasoning of results with the help of different virtualization techniques. In the experiment, CloudStack (open source cloud computing software) is used to create a private cloud, in which management server is installed on Ubuntu 12.04 - 64 bit operating system. ESXi hypervisor is installed on bare metal as a host in the cluster. The different guest operating systems are installed on ESXi hypervisor and their performances have been evaluated in detail by using SIGAR Framework.

Virtual Forensics is a new trend in the area of computer forensics. Virtualization technology paved the way for the growth of virtual forensics. VMware virtual environment provides a completely virtualized set of hardware to the guest operating system. The features of Virtual Machine make it an interesting platform to commit cyber crimes. The combination of innovative criminal techniques and advanced technologies makes the traditional techniques out-dated for detecting such crimes. This paper discusses how live acquisition can be performed to acquire virtual machine related files from the host operating system. The paper also describes how to analyze these acquired files to obtain raw data stored in various grains. The study is supported by methods that assist forensic examiners by providing valuable information from the raw data which is retrieved from various grains pointed by grain table entries.

In Recent years embedded world has been undergoing a shift from traditional single-core processors to processors with multiple cores. However, this shift poses a challenge of adapting legacy uniprocessor-oriented real-time operating system (RTOS) to exploit the capability of multi-core processor. In addition, some embedded systems are inevitably going towards the direction of integrating real-time with off-the-shelf time-sharing system, as the combination of the two has the potential to provide not only timely and deterministic response but also a large application base. Virtualization technology, which ensures strong isolation between virtual machines, is therefore a promising solution to above mentioned issues. However, there remains a concern regarding the responsiveness of the RTOS running on top of a virtual machine. In this paper we propose an embedded real-time virtualization architecture based on Kernel-Based Virtual Machine (KVM), in which VxWorks and Linux are combined together. We then analyze and evaluate how KVM influences the interrupt-response times of VxWorks as a guest operating system. By applying several real-time performance tuning methods on the host Linux, we will show that sub-millisecond interrupt response latency can be achieved on the guest VxWorks.

Cloud datacenters are largely adopting virtual machines (VMs) to provide elastic computing services. As many cloud applications are communication-intensive, such as distributed data processing and web services, satisfactory network performance is critical to guarantee the service quality. In virtualized environments, a major problem is that the end hosts are separated by a virtualization layer and subject to the intervention of the hypervisor’s scheduling. Since the scheduling delays due to CPU sharing are commonly from tens of milliseconds to over one hundred milliseconds, when they are added to packet processing, network performance can be seriously degraded. To tackle this problem, prior works focus dominantly on modifying the hypervisor scheduler to hide the virtualization reality by reducing the delays as much as possible. However, this type of approaches brings many other problems, such as increased VM context switches and more complicated CPU resource allocation. This thesis tries to look at the problem from a different but simpler angle: we let the guest operating system (OS) accept the reality that each virtual CPU (vCPU) can be suspended and resumed at any time, and then think about how to refactor the network I/O subsystem to automatically tolerate such scheduling delays.
\nIn general, network I/O processing in the kernel includes two layers: protocol layer and interrupt layer. Our study shows that both layers are very sensitive to VM scheduling delays, and therefore must be redesigned accordingly. First, in the protocol layer, we propose a paravirtualized approach to help TCP counteract the distortion of congestion control caused by the hypervisor scheduler. Second, in the interrupt layer, for SMP-VMs that have multiple vCPUs, we propose a method to dynamically migrate interrupts from a preempted vCPU to a running one whenever it is possible, so that the delays will not be propagated to the protocol layer. Experiments with our prototypes in Xen/Linux show that our approaches can significantly improve the network throughput and responsiveness.