EPL 421 Systems Programming Iaa S Infrastructure as

EPL 421: Systems Programming Iaa. S (Infrastructure as a service). By: Ματσεντίδου Ελένη (ematse 01@cs. ucy. ac. cy) Ορφέας Βαν Ρόι (ovan-r 01@cs. ucy. ac. cy) Νεοφύτου Νικόλας (nneofy 01@cs. ucy. ac. cy) https: //www 2. cs. ucy. ac. cy/courses/EPL 421 1

INTRODUCTION https: //www. cs. ucy. ac. cy/courses/EPL 646 2

Infrastructure as a service • Infrastructure as a Service (Iaa. S) is a form of cloud computing • Scalable depending on user’s needs • User pay on demand • No need of buying and maintaining your own hardware • The customer must configure and operate necessary software • Tool Examples: Xen, KVM, Open. Stack, Virtual. Box, Vmware, Hyper-V https: //www. cs. ucy. ac. cy/courses/EPL 646 3

Iaas Vs Paas Vs Saas Iaas Paas Saas Data Application Databases OS OS OS Virtualization Servers Storage Networking Provider supplied Self managed https: //www. cs. ucy. ac. cy/courses/EPL 646 4

Architecture characteristics • Network: Software Defined Networking based on APIs • Storage: – Block storage – File storage – Object storage (more resilient and scalable) • Physical data centers: data centers available to end users over the web • Compute: hypervisors creating virtual machines, often paired with auto scaling and load balancing services https: //www. cs. ucy. ac. cy/courses/EPL 646 5

Bare metal, native or type I hypervisors • Run on the host’s hardware • Some examples: Xen , Oracle VM Server , KVM https: //www. cs. ucy. ac. cy/courses/EPL 646 6

Hosted or type II hypervisors • Run as a software using an operating system • Some examples: VMware Workstation, VMware Player https: //www. cs. ucy. ac. cy/courses/EPL 646 7

Type 1 Vs Type 2 • Type 1 hypervisors are faster, more efficient and more secure than type 2 • Type 2 hypervisors are easier to set up • If type 2 OS host have security flaws or vulnerabilities all VMs above could possibly compromise https: //www. cs. ucy. ac. cy/courses/EPL 646 8

Processor Privilege Levels • • • A processor contains certain instructions that are only available to “privileged programs”, such as the operating system. These instructions include those to manipulate memory mappings, set timers, define interrupt vectors, access restricted memory, or halt the processor. Most OS use only the two Ring Levels: User Space in Ring 3 and Kernel Space in Ring 0 Special Gates exist to switch rings (using interrupts, faults, exceptions) E. g. in x 86 - int n – syscall (gate between ring 3 to ring 0) https: //www. cs. ucy. ac. cy/courses/EPL 646 9

Problem with VMs • On a Host OS, we trust the kernel code to run in privileged mode • But this is a problem in virtualized environments. • We don’t trust the Guest OS’s code to run in Ring 0 since it can mess up with other Guest Hosts or our hypervisor. • Also many devices aren’t virtualizable (only one OS can communicate with them) https: //www. cs. ucy. ac. cy/courses/EPL 646 10

Solutions to the Privileged Instructions problem https: //www. cs. ucy. ac. cy/courses/EPL 646 11

Binary Translation • Scan instruction stream on the fly (when page is loaded) and replace privileged inst. with replacement code that work with the virtual hardware (Vmware approach). • Instead of running the instruction it is replaced by hypervisor code (manual trap) https: //www. cs. ucy. ac. cy/courses/EPL 646 12

Paravirtualization • • Requires support from Guest. OS the Hypervisor provides hooks (hypercalls) to the guests to perform. Paravirtualization replaces nonvirtualizable instructions with hypercalls that communicate directly with the virtualization layer hypervisor. Operations such as privileged-sensitive operations, page faults, memory management and interrupt handling done at hypervisor level. Same concept as Sys. Call but between Guest. OS and Hyper. Visor Syscalls in Guest OS switch from Ring 3 (User Space) to Ring 1. Kernel runs in ring 1, so CPU’s privileged instructions can't run https: //www. cs. ucy. ac. cy/courses/EPL 646 13

Hardware Assisted Virtualization • Intel’s VT-x and AMD’s AMD-V • Run low-level (Ring 0) code in parallel to the host OS • Built in the CPU • Creates a sandbox environment for that code, giving the host control over that sandbox. • New level introduced, the Root Mode where the hypervisor runs. • Guest OS’s privileged instructions trap to the hypervisor via hardware https: //www. cs. ucy. ac. cy/courses/EPL 646 14

TOOL 1: XEN https: //www. cs. ucy. ac. cy/courses/EPL 646 15

Historic background • late 1990 s : Created by Keir Fraser & Ian Pratt as part of the Xenoserver research (Cambridge University) • 2002: Xen hypervisor was open sourced • 2004: Xen 1. 0 was officially released followed shortly after by Xen 2. 0 Xen. Source was founded (for enterprise computing) • 2005: Xen 3. 0 was released • 2007: Citrix Systems, Inc. acquired Xen. Server • 2008: Creation of “Xen Arm” project by Samsung • 2010: Release of Xen 4. 0 • 2011: The first version of Xen Cloud Platform was delivered Linux 3. 0 Xen PV is supported out of the box https: //www. cs. ucy. ac. cy/courses/EPL 646 16

Components • Xen Project Hypervisor (type 1) • Guest Domains/Virtual Machines (guest types: PV, HVM, PVH) • Control Domain (Dom 0) with the following functions: – – System Services Native Device Drivers Virtual Device Drivers (backends). Toolstack https: //www. cs. ucy. ac. cy/courses/EPL 421 17

https: //www. cs. ucy. ac. cy/courses/EPL 646 18

Key features • Small footprint and interface (robust and secure) • Supports a number of different Operating Systems • Driver Isolation (device driver runs inside of a VM instead of kernel) • Paravirtualization which was first introduced by Xen and allows the hypervisor to run on hardware that doesn't support virtualization extensions. https: //www. cs. ucy. ac. cy/courses/EPL 646 19

Installation instructions • • Install cent. OS or Red. Hat Enable the right Xen repository Install Xen package (via package manager) Boot into the modified Linux kernel (Xen) https: //www. cs. ucy. ac. cy/courses/EPL 646 20

TOOL 2: KVM https: //www. cs. ucy. ac. cy/courses/EPL 646 21

Historic background • Avi Kivity started the development of KVM in 2006 at Qumranet • Sold to Red Hat in 2008. • KVM was first designed for x 86, but now it is ported to S/390, Power. PC, IA-64 and ARM. https: //www. cs. ucy. ac. cy/courses/EPL 646 22

General information • • • Kernel-based Virtual Machine (KVM) Open source software Loadable Kernel Module Included in Mainline Kernels since Linux 2. 6. 20 Type 1 Hypervisor (Bare-Mental) https: //www. cs. ucy. ac. cy/courses/EPL 646 23

https: //www. cs. ucy. ac. cy/courses/EPL 646 24

KVM as a Hypervisor • Some debate it isn’t a strictly type 1 hypervisor since: – the host OS remains fully functional – Every VM seen as a regular linux process, scheduled like any other, with dedicated virtual hardware attached to it https: //www. cs. ucy. ac. cy/courses/EPL 646 25

TOOL 3: OPENSTACK https: //www. cs. ucy. ac. cy/courses/EPL 646 26

Open. Stack • A Large Collection of Interconnected Applications that can also work Standalone, in which they work altogether to provide a fully operational cloud environment • All its components are free and Open-Source but due to its massive documentation and complexity, it is usually installed with the help of certified Open. Stack Partners like Red. Hat (with a fee). • At its heart is the Compute Node which manages and runs Virtual Machine Instances

Open. Stack’s Compute Node Architecture Cinder – For block Storage Access Uses the i. SCSI protocol that sits on top of TCP to give Compute nodes a shared network storage. Glance – For storing and retrieving Virtual Machine image Instances Scheduler – For orchestrating the Compute nodes, assigns Virtual Machine Requests to the Compute Nodes API – Rest API to communicate with the Compute – nova-compute is responsible for building a disk image, launching it via the underlying virtualization driver, responding to calls to check its state, attaching persistent storage, and terminating it. Keystone – Authentication Service for the API clients, all Open. Stack services register themselves here

PRACTICAL ANALYSIS https: //www. cs. ucy. ac. cy/courses/EPL 646 29

Our Architecture Model • • Nested Hardware Virtualization Arch-Linux deployed on both guest hypervisors XEN & KVM can be managed via the same tools libvirt framework Virt-install, virsh Minimal differences in configurations for running VMs ( --hvm flag in XEN) Nova-Compute service runs on each guest hypervisor.

Creating a VM virt-install • --name arch_on_xen • --memory 1024 • --vcpus 2 • --disk size=3 • --cdrom /tmp/arch. iso • --network=bridge: vmbr 0 • --hvm • --extra-args="console=tty. S 0, 115200" https: //www. cs. ucy. ac. cy/courses/EPL 646 31

Connecting to VM • virsh list –all • virsh console VM_name https: //www. cs. ucy. ac. cy/courses/EPL 646 32

Average performance https: //www. cs. ucy. ac. cy/courses/EPL 646 33

Average performance https: //www. cs. ucy. ac. cy/courses/EPL 646 34

Conclusion • Some articles argued that we expect better performance with PV and others the opposite. Our measurements indicated HVM as the fastest option. • Nested Virtualization might fiddle with our findings • KVM offered the best Virtualization Speed https: //www. cs. ucy. ac. cy/courses/EPL 646 35

Bibliography https: //www. ibm. com/cloud/learn/iaas https: //www. linux-kvm. org/page/FAQ https: //www. redhat. com/en/topics/virtualization/what-is-KVM https: //searchservervirtualization. techtarget. com/feature/Whatsthe-difference-between-Type-1 -and-Type-2 -hypervisors • http: //www-archive. xenproject. org/community/xenhistory. html • http: //www-archive. xenproject. org/products/xenhyp. html • • https: //www. cs. ucy. ac. cy/courses/EPL 646 36