检索结果-内蒙古大学图书馆

Effective Huge Page Strategies for TLB Miss Reduction in nested virtualization

IEEE TRANSACTIONS ON COMPUTERS 2024年第8期73卷 1983-1996页

作者： Jia, Weiwei Zhang, Jiyuan Shan, Jianchen Ding, Xiaoning Univ Rhode Isl Elect Comp & Biomed Engn Dept Kingston RI 02881 USA Univ Illinois Dept Comp Sci Urbana IL 61801 USA Hofstra Univ Comp Sci Dept Hempstead NY 11549 USA New Jersey Inst Technol Comp Sci Dept Newark NJ 07102 USA

Huge page strategies, such as Linux Transparent Huge Page (THP), have become a prevalent solution to mitigate the performance bottleneck caused by increasingly high memory address translation overhead. However, in cloud environments, virtualization presents a two-fold challenge, exacerbating address translation overhead and undermining the effectiveness of huge page strategies. To effectively reduce address translation overhead, huge page strategies in the host and guest virtual machines (VMs) must work in concert for "proper huge page alignment", i.e., huge pages in guest VMs being backed by host huge pages. This requires a cross-layer coordinating mechanism, which has been designed targeting non-nested virtualization settings. The paper introduces xGemini as an efficient solution targeting nested virtualization settings, where addressing these issues is particularly challenging, given the additional obstacles in creating synergy between host and guest VMs, due to an extra layer of page mappings by guest hypervisors. xGemini addresses these challenges by improving the shadow paging mechanism. Evaluation based on the KVM/Linux prototype implementation and diverse real-world applications shows xGemini greatly reduces TLB misses and enhances application performance in nested virtualization.

关键词： Virtual machine monitors virtualization Computers Hardware Cloud computing Cross layer design System analysis and design TLB nested virtualization huge pages memory management

来源：评论

学校读者我要写书评

暂无评论

Reestablishing Page Placement Mechanisms for nested virtualization

引用

IEEE TRANSACTIONS ON CLOUD COMPUTING 2023年第3期11卷 3239-3250页

作者： Shang, Xiaowei Jia, Weiwei Shan, Jianchen Ding, Xiaoning Borcea, Cristian New Jersey Inst Technol Comp Sci Dept Newark NJ 07102 USA Univ Rhode Isl Elect Comp & Biomed Engn Dept Kingston RI 02881 USA Hofstra Univ Comp Sci Dept Hempstead NY 11549 USA

Page placement mechanisms have long been used to reduce cache conflict misses. They become more important in clouds where the emerging way-based cache partitioning is used for better workload isolation but at a cost of increased cache conflicts. However, page placement mechanisms become ineffective in virtualized environments, such as clouds, because the real locations of memory pages (i.e., their host physical addresses) are hidden from guest OSs. The paper proposes xPlace as a solution to reestablish page placement mechanisms under the nested virtualization configuration. To keep high portability and low overhead, xPlace follows an approach that creates a synergy between the host and guest VMs, such that the page placement mechanism inside each guest VM becomes effective even if its page placement decisions are made based on the guest physical addresses of memory pages. The paper addresses the technical issues for implementing this approach in the nested virtualization setting, particularly how to create the synergy with the obstacle created by guest hypervisors sitting between the host and guest VMs. Evaluation based on the prototype implementation and diverse real world applications shows that xPlace can greatly reduce cache conflicts and improve application performance in the nested environment.

关键词： Cache conflicts nested virtualization multi-core memory management page coloring page placement

来源：评论

学校读者我要写书评

暂无评论

Free the Turtles: Removing nested virtualization for Performance and Confidentiality in the Cloud 16

Free the Turtles: Removing Nested Virtualization for Perform...

引用

IEEE 16th International Conference on Cloud Computing (IEEE CLOUD)

作者： Ye, Mengmei Ruocco, Angelo Buono, Daniele Bottomley, James Franke, Hubertus IBM Res Armonk NY 10504 USA

ISBN: (纸本)9798350304817

With the growing popularity of containers running in cloud environments, one might believe techniques like virtual machines (VMs) and nested virtualization are no longer essential for cloud computing, but this is not true. First, they are foundational for the Infrastructure as a Service (IaaS) base that most clouds use for their Kubernetes (K8s) offerings - nodes are deployed in VMs instead of on bare-metal machines to improve flexibility and resource utilization. Second, state-of-the-art technology like Kata Containers or KubeVirt deploys VMs inside K8s, to improve container isolation or to offer a cloud-native way to deploy VMs. When such techniques are coupled with VM-based K8s worker node deployments, this requires the use of nested virtualization. However, nested virtualization introduces a larger trusted computing base (TCB) and therefore raises security concerns. In addition, it introduces an important performance overhead and cannot be easily applied to confidential computing, an emerging technology to allow the execution of sensitive workloads in the cloud. In this paper, we propose the secondary-VM (secVM) framework, an alternative to nested virtualization which addresses these challenges by flattening the nested hierarchy, but maintains the resource isolation features of nested virtualization. By removing the emulation layer required for nested virtualization, the secVM framework reduces the TCB, is compatible with any confidential computing techniques, and removes the overhead associated with nested virtualization. Therefore, in reference to the Turtles Project that introduced the concept of nested virtualization in the open-source virtualization technology - Kernel-based Virtual Machine (KVM), we argue it is time to free the "turtles".

关键词： nested virtualization confidential computing Infrastructure as a Service virtual machines Platform as a Service Kubernetes OpenShift

来源：评论

学校读者我要写书评

暂无评论

Flexible service consolidation with nested virtualization and library operating systems

引用

SOFTWARE-PRACTICE & EXPERIENCE 2020年第1期50卷 3-21页

作者： Kourai, Kenichi Sannomiya, Kouta Kyushu Inst Technol Dept Comp Sci & Networks 680-4 Kawazu Iizuka Fukuoka 8208502 Japan

In Infrastructure-as-a-service (IaaS) clouds, users can reduce costs by scale-in or scale-down when running services are underutilized. Since these optimizations of instance deployment require at least one minimum instance even for running an underutilized service, cost reduction is limited. For further optimization, multiple services can be consolidated into one instance. However, services have to be stopped temporarily at the consolidation time, and isolation between services becomes weaker after the consolidation. To solve these problems, this paper proposes FlexCapsule, which enables seamless and secure service consolidation in existing IaaS clouds. FlexCapsule runs each service in a lightweight virtual machine (VM) called an app VM, using a library operating system. An app VM runs inside an instance using a technique called nested virtualization. FlexCapsule can optimize instance deployment with negligible downtime by flexibly migrating app VMs. Due to strong isolation provided by app VMs, it can guarantee security between consolidated services. In addition, FlexCapsule provides multiprocess support using app VMs by emulating process fork and process pools. We have implemented FlexCapsule in Xen using both fully virtualized OSv and paravirtualized MiniOS. Then, we examined the effectiveness of FlexCapsule using several applications. Due to the premature implementation of nested virtualization in Xen, the performance of app VMs largely degraded, but we believe that the performance could be improved using several existing optimizations.

关键词： IaaS clouds library operating system nested virtualization process pool service consolidation virtual private network

来源：评论

学校读者我要写书评

暂无评论

VM Migration for Secure Out-of-band Remote Management with nested virtualization 13

VM Migration for Secure Out-of-band Remote Management with N...

引用

IEEE 13th International Conference on Cloud Computing (CLOUD)

作者： Unoki, Tomoya Kourai, Kenichi Kyushu Inst Technol Kitakyushu Fukuoka Japan

ISBN: (纸本)9781728187808

Infrastructure-as-a-Service clouds provide out-of-band remote management of the systems in virtual machines (VMs). This management method enables users to manage their systems even on several types of failures inside VMs. In this method, users access virtual devices of their VMs, but virtual devices are not sufficiently protected against untrusted cloud operators. For secure out-of-band remote management, previous work securely runs shadow devices outside an untrusted virtualized system using nested virtualization. However, the states of shadow devices are lost during VM migration. In this paper, we propose USShadow for continuing secure out-of-band remote management after VM migration. USShadow enables the migration manager inside the virtualized system to transparently and securely save and restore the states of shadow devices outside it. We have implemented USShadow, which supports Xen and KVM as virtualized systems. Then, we confirmed that USShadow could continue virtual serial console and that the migration overhead was negligible.

关键词： IaaS clouds Information leakage nested virtualization Remote management VM migration

来源：评论

学校读者我要写书评

暂无评论

Optimizing nested virtualization Performance Using Direct Virtual Hardware 20

Optimizing Nested Virtualization Performance Using Direct Vi...

引用

25th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)

作者： Lim, Jin Tack Nieh, Jason Columbia Univ New York NY 10027 USA

ISBN: (纸本)9781450371025

nested virtualization, running virtual machines and hypervisors on top of other virtual machines and hypervisors, is increasingly important because of the need to deploy virtual machines running software stacks on top of virtualized cloud infrastructure. However, performance remains a key impediment to further adoption as application workloads can perform many times worse than native execution. To address this problem, we introduce DVH (Direct Virtual Hardware), a new approach that enables a host hypervisor, the hypervisor that runs directly on the hardware, to directly provide virtual hardware to nested virtual machines without the intervention of multiple levels of hypervisors. We introduce four DVH mechanisms, virtual-passthrough, virtual timers, virtual inter-processor interrupts, and virtual idle. DVH provides virtual hardware for these mechanisms that mimics the underlying hardware and in some cases adds new enhancements that leverage the flexibility of software without the need for matching physical hardware support. We have implemented DVH in the Linux KVM hypervisor. Our experimental results show that DVH can provide near native execution speeds and improve KVM performance by more than an order of magnitude on real application workloads.

关键词： nested virtualization hypervisors I/O virtualization performance

来源：评论

学校读者我要写书评

暂无评论

nested virtualization Without the Nest 19

Nested Virtualization Without the Nest

引用

48th International Conference on Parallel Processing (ICPP)

作者： Bacou, Mathieu Todeschi, Gregoire Tchana, Alain Hagimont, Daniel Univ Toulouse CNRS IRIT Toulouse France Univ Nice Sophia Antipolis CNRS I3S Nice France Atos Integrat Bezons France

ISBN: (纸本)9781450362955

With the increasing popularity of containers, managing them on top of virtual machines becomes a common practice, called nested virtualization. This paper presents BrFusion and Hostlo, two solutions that address each of two networking issues of nested virtualization: network virtualization duplication and virtual machine-bounded pod deployments. The first issue lengthens network packet paths while the second issue leads to resource fragmentation. For instance, in respect with the first issue, we measured a throughput degradation of about 68% and a latency increase of about 31% in comparison with a single networking layer. We prototype BrFusion and Hostlo in Linux KVM/QEMU, Docker and Kubernetes systems. The evaluation results show that BrFusion leads to the same performance as a single-layer virtualization deployment. Concerning Hostlo, the results show that more than 11% of cloud clients see their cloud utilization cost reduced by down to 40%.

关键词： virtualization nested virtualization container network orchestrator

来源：评论

学校读者我要写书评

暂无评论

Using SMT to Accelerate nested virtualization 19

Using SMT to Accelerate Nested Virtualization

引用

46th International Symposium on Computer Architecture (ISCA)

作者： Vilanova, Lluis Amit, Nadav Etsion, Yoav Technion Israel Inst Technol Haifa Israel VMware Res Palo Alto CA USA

ISBN: (纸本)9781450366694

IaaS datacenters offer virtual machines (VMs) to their clients, who in turn sometimes deploy their own virtualized environments, thereby running a VM inside a VM. This is known as nested virtualization. VMs are intrinsically slower than bare-metal execution, as they often trap into their hypervisor to perform tasks like operating virtual I/O devices. Each VM trap requires loading and storing dozens of registers to switch between the VM and hypervisor contexts, thereby incurring costly runtime overheads. nested virtualization further magnifies these overheads, as every VM trap in a traditional virtualized environment triggers at least twice as many traps. We propose to leverage the replicated thread execution resources in simultaneous multithreaded (SMT) cores to alleviate the overheads of VM traps in nested virtualization. Our proposed architecture introduces a simple mechanism to colocate different VMs and hypervisors on separate hardware threads of a core, and replaces the costly context switches of VM traps with simple thread stall and resume events. More concretely, as each thread in an SMT core has its own register set, trapping between VMs and hypervisors does not involve costly context switches, but simply requires the core to fetch instructions from a different hardware thread. Furthermore, our inter-thread communication mechanism allows a hypervisor to directly access and manipulate the registers of its subordinate VMs, given that they both share the same in-core physical register file. A model of our architecture shows up to 2.3x and 2.6x better I/O latency and bandwidth, respectively. We also show a software-only prototype of the system using existing SMT architectures, with up to 1.3x and 1.5x better I/O latency and bandwidth, respectively, and 1.2-2.2x speedups on various real-world applications.

关键词： virtualization nested virtualization computer architecture

来源：评论

学校读者我要写书评

暂无评论

Secure and Efficient In-Hypervisor Memory Introspection Using nested virtualization 12

Secure and Efficient In-Hypervisor Memory Introspection Usin...

引用

12th IEEE International Symposium on Service-Oriented System Engineering (SOSE) / 9th International Workshop on Joint Cloud Computing (JCC)

作者： Tang, Weiwen Mi, Zeyu Shanghai Jiao Tong Univ Inst Parallel & Distributed Syst IPADS Shanghai Peoples R China

ISBN: (纸本)9781538652060

In JointCloud computing, the hypervisor used by each cloud plays a key role in providing services and protection for guest virtual machines (VMs). Unfortunately, the commodity hypervisor usually has a considerable attack surface and its memory is especially prone to be tampered with by an attacker who resides in one VM and then threatens the security of other co-located VMs. To mitigate such threat, previous solutions proposed an out-of-the-box design which leverages the nested virtualization to introduce a higher privileged software layer (a nested hypervisor) below the hypervisor. It also installs a security monitor into a trusted VM which is protected by the nested hypervisor and isolated from the untrusted hypervisor. The monitor is responsible for dynamically validating the behaviors of the untrusted hypervisor. Although monitoring from outside of the hypervisor can help ensure security, the large number of context switches caused by the nested virtualization incurs unacceptable overheads and makes this approach unsuitable for the cloud environment. In this paper, we introduce In-Hypervisor Memory Introspection (IHMI), an in-the-box way to monitor the hypervisor based on the nested virtualization. Our system puts the monitor into the untrusted hypervisor for efficiency while guaranteeing the same level of memory security as monitoring the hypervisor from a separated secure VM. By leveraging hardware virtualization features of current processors, IHMI isolates the monitor from the hypervisor via the nested page table and implements an efficient switch between them. Further, IHMI configures a uni-directional mapping for the monitor which allows the monitor to access the hypervisor's memory at native speed while forbidding the hypervisor from accessing the monitor's memory. Our IHMI system is currently still in an early stage and we report our design as well as preliminary evaluation results in this paper.

关键词： hypervisor introspection memory protection nested virtualization

来源：评论

学校读者我要写书评

暂无评论

Designing Locality and NUMA Aware MPI Runtime for nested virtualization based HPC Cloud with SR-IOV Enabled InfiniBand 17

Designing Locality and NUMA Aware MPI Runtime for Nested Vir...

引用

13th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE)

作者： Zhang, Jie Lu, Xiaoyi Panda, Dhabaleswar K. (Dk) Ohio State Univ Dept Comp Sci & Engn Columbus OH 43210 USA

ISBN: (纸本)9781450349482

Hypervisor-based virtualization solutions reveal good security and isolation, while container-based solutions make applications and workloads more portable and distributed in an effective, standardized and repeatable way. Therefore, nested virtualization based computing environments (e.g., container over virtual machine), which inherit the capabilities from both solutions, are becoming more and more attractive in clouds (e.g., running Docker over Amazon EC2 VMs). Recent studies have shown that running applications in either VMs or containers still has significant overhead, especially for I/O intensive workloads. This motivates us to investigate whether the nested virtualization based solution can be adopted to build high-performance computing (HPC) clouds for running MPI applications efficiently and where the bottlenecks lie. To eliminate performance bottlenecks, we propose a high-performance two-layer locality and NUMA aware MPI library, which is able to dynamically detect co-resident containers inside one VM as well as detect co-resident VM inside one host at MPI run-time. Thus the MPI processes across different containers and VMs can communicate to each other by shared memory or Cross Memory Attach (CMA) channels instead of network channel if they are co-resident. We further propose an enhanced NUMA aware hybrid design to utilize InfiniBand loopback based channel to optimize large message transfer across containers when they are running on different sockets. Performance evaluations show that compared with the performance of the state-of-art (1Layer) design, our proposed enhance-hybrid design can bring up to 184%, 81% and 12% benefit on point-to-point, collective operations, and end applications. Compared with the default performance, our enhanced-hybrid design delivers up to 184%, 85% and 16% performance improvement.

关键词： nested virtualization Container Hypervisor Cloud Computing MPI SR-IOV IVShmem CMA

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：