VM-Aware Adaptive Storage Cache Prefetching

Virtualization is used for various purposes such as cloud computing and a virtualized environment has been one of the most important platforms. In many virtualized environments, access to its persistent storage device, e.g. hard disk drive (HDD) or solid-state drive (SSD), is performed via two caches, which are page caches of guest and host operating systems. Both caches are usually managed based on the least recently used (LRU) algorithm. Previous work demonstrated that accesses to the host operating system page cache have a negative temporal locality of reference in these cases. Namely, an accessed block will probably not be accessed again in the near future. This locality severely decreases the hit ratio of a host operating system page cache. For addressing this issue, a method for improving the locality of reference in the accesses in the host operating system page cache by fixing data stored in the guest operating system page cache was proposed. However, the method assumed that the hot spot, which is the data area aggressively accessed, was given. Because of this limitation, the method can rarely be used. In this paper, we propose a method for improving the hit ratio of a host operating system page cache by enhancing the locality of reference at the cache. First, we explain the negative temporal locality of reference in virtualized environments. Second, we propose a method for enhancing the locality of reference in the host operating system page cache for improving its hit ratio without an assumption that its hotspot is given. This method observes file accesses in the system using an operating system kernel function and automatically detects the hotspot. This then stores the area in the guest operating system page cache. As a result, the locality of reference in the host operating system cache increases. Lastly, we evaluate this proposed method, then show that this method outperforms the normal method and can provide comparable performance with an existing method even if the hot spot is not given.

Virtual Forensics is a new trend in the area of computer forensics. Virtualization technology paved the way for the growth of virtual forensics. VMware virtual environment provides a completely virtualized set of hardware to the guest operating system. The features of Virtual Machine make it an interesting platform to commit cyber crimes. The combination of innovative criminal techniques and advanced technologies makes the traditional techniques out-dated for detecting such crimes. This paper discusses how live acquisition can be performed to acquire virtual machine related files from the host operating system. The paper also describes how to analyze these acquired files to obtain raw data stored in various grains. The study is supported by methods that assist forensic examiners by providing valuable information from the raw data which is retrieved from various grains pointed by grain table entries.

Consolidating multiple virtual machines into a single server has been widely adopted in cloud computing to improve system utilization. However, the sharing of physical CPUs among virtual machines in consolidated systems poses a new challenge in providing an illusion of continuous CPU execution to the guest operating systems (OS). Due to the time-sharing of physical CPUs, the execution of a guest OS is periodically interrupted, while the guest OS may not be aware of the discontinuity of virtual time against the real time. The virtual time discontinuity problem causes the delayed processing of critical OS operations, such as interrupt handling and lock processing. Although there have been several prior studies to mitigate the problem, they address only a subset of symptoms, require the modification of guest OSes, or change the processor architecture. This paper proposes a novel way to comprehensively reduce the inefficiency of guest OS execution in consolidated systems. It migrates the short-lived critical OS tasks to dedicated micro-sliced cores, minimizing the delays caused by time sharing. The hypervisor identifies the critical OS tasks without any OS intervention, and schedules the critical code sections onto the dynamically partitioned cores at runtime. The dedicated micro-sliced cores employ a short sub-millisecond quantum to minimize the response latencies for consolidated virtual machines. By readily servicing the critical tasks, the proposed scheme can minimize the adverse artifact of virtual machine consolidation without any modification of guest OSes.

Scheduling policy in host operating system (OS) will have effect on the performance of Kernel-based Virtual Machine (KVM). This paper proposed an optimized scheduler policy to improve the performance of KVM. Firstly, a special process queue for virtual machine (VM) is added in the host OS, which is scheduled prior to normal process. Same time slices is given to each VM to make their load balanced. Secondly, the VM process queue is periodic sorted based on the remaining time slices of VM and a special state is added to identify I/O-intensive VM, which make sure that I/O-intensive VM is processed specially to receive a prior schedule opportunity. In the end, an experiment in KVM environment is designed and executed to show the effectiveness of this optimized scheduling policy.

Virtual Infrastructure-as-a-Service (IaaS) clouds are emerging for secondary cloud service providers to manage their own IaaS clouds on top of existing IaaS clouds. In virtual IaaS clouds, guest virtual machines (VMs) run inside cloud VMs provided by existing IaaS clouds. Unlike traditional IaaS clouds, they can be migrated between cloud VMs co-located at the same host. However, the performance of such VM migration is low due to slow virtual networks and doubled system loads. To optimize VM migration between co-located cloud VMs, we propose zero-copy migration for virtual IaaS clouds. Zero-copy migration just relocates the memory image of a guest VM without any copy. To enable live migration with negligible downtime, it first makes the memory of a guest VM share with the destination cloud VM and thereafter completes memory relocation. We have implemented a system called VMBeam for enabling zero-copy migration in Xen. According to our experimental results, zero-copy migration could achieve high migration performance and low system loads.

Cloud computing model along with virtualization enables scalable infrastructures and provides on demand access to computing resources. Virtualization technology facilitates multiple virtual servers to run on a physical server to enhance the utilization of the server. Hypervisor as a virtualization layer provides an infrastructural support to multiple virtual machines above it by virtualizing hardware resources such as CPU, Memory, Disk and NIC. Hypervisors give near native performance by negating virtualization overhead. ESXi is one of the hypervisors which gives near native performance using full virtualization technique. It is encouraging to study how different Operating Systems (OSs) perform in a virtualized environment in the Private Cloud with ESXi hypervisor. Guest Operating Systems do come in para-virtualized and hardware virtualized flavors. It is innovative idea to compare them from performance perspective to give an idea about their performance variations in different tests. This paper conducts different performance tests with low, medium, high workloads and results are gathered using SIGAR API (System Information Gatherer and Reporter) and explains the behavior of each operating system and gives the reasoning of results with the help of different virtualization techniques. In the experiment, CloudStack (open source cloud computing software) is used to create a private cloud, in which management server is installed on Ubuntu 12.04 - 64 bit operating system. ESXi hypervisor is installed on bare metal as a host in the cluster. The different guest operating systems are installed on ESXi hypervisor and their performances have been evaluated in detail by using SIGAR Framework.

On virtualization platforms, peak memory demand caused by hotspot applications often triggers page swapping in guest OS, causing performance degradation inside and outside of this virtual machine (VM). Even though host holds sufficient memory pages, guest OS is unable to utilize free pages in host directly due to the semantic gap between virtual machine monitor (VMM) and guest operating system (OS). Our work aims at utilizing the free memory scattered in multiple hosts in a virtualization environment to improve the performance of guest swapping in a transparent and implicit way. Based on the insightful analysis of behavioral characteristics of guest swapping, we design and implement a distributed and scalable framework HybridSwap. It dynamically constructs virtual swap pools using various policies, and builds up a synthetic swapping mechanism in a peer-to-peer way, which can adaptively choose different virtual swap pools.We implement the prototype of HybridSwap and evaluate it with some benchmarks in different scenarios. The evaluation results demonstrate that our solution has the ability to promote the guest swapping efficiency indeed and shows a double performance promotion in some cases. Even in the worst case, the system overhead brought by HybridSwap is acceptable.

In traditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

In Recent years embedded world has been undergoing a shift from traditional single-core processors to processors with multiple cores. However, this shift poses a challenge of adapting legacy uniprocessor-oriented real-time operating system (RTOS) to exploit the capability of multi-core processor. In addition, some embedded systems are inevitably going towards the direction of integrating real-time with off-the-shelf time-sharing system, as the combination of the two has the potential to provide not only timely and deterministic response but also a large application base. Virtualization technology, which ensures strong isolation between virtual machines, is therefore a promising solution to above mentioned issues. However, there remains a concern regarding the responsiveness of the RTOS running on top of a virtual machine. In this paper we propose an embedded real-time virtualization architecture based on Kernel-Based Virtual Machine (KVM), in which VxWorks and Linux are combined together. We then analyze and evaluate how KVM influences the interrupt-response times of VxWorks as a guest operating system. By applying several real-time performance tuning methods on the host Linux, we will show that sub-millisecond interrupt response latency can be achieved on the guest VxWorks.

Cloud datacenters are largely adopting virtual machines (VMs) to provide elastic computing services. As many cloud applications are communication-intensive, such as distributed data processing and web services, satisfactory network performance is critical to guarantee the service quality. In virtualized environments, a major problem is that the end hosts are separated by a virtualization layer and subject to the intervention of the hypervisor’s scheduling. Since the scheduling delays due to CPU sharing are commonly from tens of milliseconds to over one hundred milliseconds, when they are added to packet processing, network performance can be seriously degraded. To tackle this problem, prior works focus dominantly on modifying the hypervisor scheduler to hide the virtualization reality by reducing the delays as much as possible. However, this type of approaches brings many other problems, such as increased VM context switches and more complicated CPU resource allocation. This thesis tries to look at the problem from a different but simpler angle: we let the guest operating system (OS) accept the reality that each virtual CPU (vCPU) can be suspended and resumed at any time, and then think about how to refactor the network I/O subsystem to automatically tolerate such scheduling delays.
\nIn general, network I/O processing in the kernel includes two layers: protocol layer and interrupt layer. Our study shows that both layers are very sensitive to VM scheduling delays, and therefore must be redesigned accordingly. First, in the protocol layer, we propose a paravirtualized approach to help TCP counteract the distortion of congestion control caused by the hypervisor scheduler. Second, in the interrupt layer, for SMP-VMs that have multiple vCPUs, we propose a method to dynamically migrate interrupts from a preempted vCPU to a running one whenever it is possible, so that the delays will not be propagated to the protocol layer. Experiments with our prototypes in Xen/Linux show that our approaches can significantly improve the network throughput and responsiveness.

Infrastructure-as-a-Service (IaaS) clouds have become more popular enabling users to run applications under virtual machines. This paper investigates the energy-aware virtual machine (VM) allocation problems in IaaS clouds along characteristics: multiple resources, and fixed interval times and non-preemption of virtual machines. Many previous works proposed to use a minimum number of physical machines, however, this is not necessarily a good solution to minimize total energy consumption in the VM placement with multiple resources, fixed interval times and non-preemption. We observed that minimizing total energy consumption of physical machines is equivalent to minimize the sum of total completion time of all physical machines. Based on the observation, we propose EMinRET algorithm. The EMinRET algorithm swaps an allocating VM with a suitable overlapped VM, which is of the same VM type and is allocated on the same physical machine, to minimize total completion time of all physical machines. The EMinRET uses resource utilization during executing time period of a physical machine as the evaluation metric, and will then choose a host that minimizes the metric to allocate a new VM. In addition, this work studies some heuristics for sorting the list of virtual machines (e.g., sorting by the earliest starting time, or the longest duration time first, etc.) to allocate VM. Using the realistic log-trace in the Feitelson's Parallel Workloads Archive, our simulation results show that the EMinRET algorithm could reduce from 25% to 45% energy consumption compared with power-aware best-fit decreasing (PABFD) [1]) and vector binpacking norm-based greedy algorithms (VBP-Norm-L1/L2 [2]). Moreover, the EMinRET heuristic has also less total energy consumption than our previous heuristics (e.g. MinDFT and EPOBF) in the simulations (using same virtual machines sorting method).

Virtualization platforms allow multiple operating systems to run on the same hardware. One of their central goal is to provide strong isolation between guest operating systems, unfortunately, they are often vulnerable to practical side-channel attacks. Cache attacks are a common class of side-channel attacks that use the cache as a side channel. We formalize an idealized model of virtualization that features the cache and the Translation Look aside Buffer (TLB), and that provides an abstract treatment of cache-based side-channels. We then use the model for reasoning about cache-based attacks and countermeasures, and for proving that isolation between guest operating systems can be enforced by flushing the cache upon context switch. In addition, we show that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform. The models and proofs have been machine-checked in the Coqproof assistant.

In Infrastructure-as-a-Service (IaaS) clouds, stepping-stone attacks via hosted virtual machines (VMs) are critical for the credibility. This type of attack uses compromised VMs as stepping stones for attacking the outside hosts. For self-protection, IaaS clouds should perform active responses against stepping-stone attacks. However, it is difficult to stop only outgoing attacks at edge firewalls, which can only use packet headers. In this paper, we propose a new self-protection mechanism against stepping-stone attacks, which is called xFilter. xFilter is a packet filter running in the virtual machine monitor (VMM) underlying VMs and achieves pinpoint active responses by using VM introspection. VM introspection enables xFilter to directly obtain information on packet senders inside VMs. On attack detection, xFilter automatically generates filtering rules based on packet senders. To make packet filtering with VM introspection efficient, we introduced several optimization techniques. Our experiments showed that the performance degradation due to xFilter was usually less than 16%.

TEE: A virtual DRTM based execution environment for secure cloud-end computing

Since a virtual machine independently uses its own caching policy, redundant disk operations exacerbate the I/O virtualization overhead when virtual machines access large amounts of data on shared storage. This paper presents XHive, an efficient cooperative caching system that is implemented at the virtualization layer, for consolidated environments. Our proposed scheme globally manages buffer caches of consolidated virtual machines in order to accommodate a shared working set in machine memory. A singlet, which is a block cached solely by a virtual machine, is preferentially given more chances to be cached in machine memory by XHive, when it is evicted by a guest operating system. For efficient use of limited memory, singlets are cached in memory that is collaboratively donated from idle memory of virtual machines. Our evaluation shows that XHive significantly reduces disk I/O operations for shared working sets, thereby achieving high read performance and scalability. Improved scalability enables a high degree of workload consolidation with respect to virtual machines that have shared working sets.