Paravirtualization

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

/* Understanding CPU Overhead in Virtualization */
 
/*
 * A pure CPU workload like matrix multiplication has virtually
 * no virtualization overhead because it rarely executes
 * privileged operations.
 */
void matrix_multiply(float *A, float *B, float *C, int n) {
    /* This code runs at full speed in any virtualization mode */
    for (int i = 0; i < n; i++) {
        for (int j = 0; j < n; j++) {
            float sum = 0.0f;
            for (int k = 0; k < n; k++) {
                sum += A[i * n + k] * B[k * n + j];
            }
            C[i * n + j] = sum;
        }
    }
    /* No system calls, no I/O, no privileged instructions */
    /* Native, PV, and HVM all execute this identically */
}
 
/*
 * Contrast with code that triggers virtualization overhead:
 */
void privileged_heavy_workload(void) {
    for (int i = 0; i < 1000000; i++) {
        /* Each of these causes overhead in full virtualization */
        
        /* 1. Timer read - may trap to hypervisor */
        struct timespec ts;
        clock_gettime(CLOCK_MONOTONIC, &ts);  // May need emulation
        
        /* 2. Page table operation - triggers MMU handling */
        void *p = mmap(NULL, 4096, PROT_READ|PROT_WRITE, 
                       MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
        munmap(p, 4096);
        
        /* 3. System call - crosses privilege boundary */
        getpid();  // Minimal syscall
    }
}
 
/*
 * Measurement: Cycles per operation under different virtualization
 * 
 * Operation          Native    Xen PV    Xen HVM    KVM
 * ─────────────────────────────────────────────────────────
 * getpid()              80       150        250      200
 * mmap+munmap         1500      2200       3500     2800
 * clock_gettime()       40        60        200       80
 * context switch      2000      3000       5000     3500
 * 
 * Note: Xen PV uses vDSO/shared_info for time, avoiding hypercall
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

/* Memory Virtualization Performance Analysis */
 
/*
 * Workloads that stress memory virtualization:
 * - fork(): Copies page tables, triggers many PT operations
 * - mmap(): Creates new mappings, modifies page tables
 * - Context switching: TLB flushes, page table switches
 */
 
/* Benchmark: Page table intensive operations */
void benchmark_page_table_ops(void) {
    struct timespec start, end;
    const int iterations = 10000;
    
    clock_gettime(CLOCK_MONOTONIC, &start);
    
    for (int i = 0; i < iterations; i++) {
        /* Each mmap creates new PTEs */
        void *p = mmap(NULL, 4 * 1024 * 1024,  /* 4MB */
                       PROT_READ | PROT_WRITE,
                       MAP_PRIVATE | MAP_ANONYMOUS,
                       -1, 0);
        if (p == MAP_FAILED) continue;
        
        /* Touch pages to fault them in */
        volatile char *ptr = p;
        for (size_t j = 0; j < 4 * 1024 * 1024; j += 4096) {
            ptr[j] = 1;  /* Causes page fault, PTE allocation */
        }
        
        /* Unmap releases PTEs */
        munmap(p, 4 * 1024 * 1024);
    }
    
    clock_gettime(CLOCK_MONOTONIC, &end);
    
    double elapsed = (end.tv_sec - start.tv_sec) + 
                     (end.tv_nsec - start.tv_nsec) / 1e9;
    printf("Page table ops: %.2f ops/sec
", iterations / elapsed);
}
 
/*
 * Benchmark: fork() stress test
 * 
 * fork() is the classic killer for shadow page tables because
 * the entire page table tree must be copied and shadowed.
 */
void benchmark_fork(void) {
    const int iterations = 1000;
    struct timespec start, end;
    
    clock_gettime(CLOCK_MONOTONIC, &start);
    
    for (int i = 0; i < iterations; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            /* Child: exit immediately */
            _exit(0);
        } else if (pid > 0) {
            /* Parent: wait for child */
            waitpid(pid, NULL, 0);
        }
    }
    
    clock_gettime(CLOCK_MONOTONIC, &end);
    
    double elapsed = (end.tv_sec - start.tv_sec) + 
                     (end.tv_nsec - start.tv_nsec) / 1e9;
    printf("fork() rate: %.2f forks/sec
", iterations / elapsed);
    
    /*
     * Typical results (relative to native):
     *   Native:     100% (baseline)
     *   Shadow PT:   40-60% (extremely expensive)
     *   Paravirt:    70-85% (better but still overhead)
     *   EPT/NPT:     85-95% (hardware acceleration)
     */
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

/* virtio Ring Buffer - The Key to I/O Performance */
 
/* 
 * virtio achieves high performance through:
 * 1. Batching - multiple requests in single notification
 * 2. Zero-copy - shared memory, no data copying
 * 3. Asynchronous - non-blocking request submission
 * 4. Lock-free - producer/consumer without locks
 */
 
struct vring_desc {
    __le64 addr;      /* Guest physical address of buffer */
    __le32 len;       /* Length of buffer */
    __le16 flags;     /* VRING_DESC_F_* flags */
    __le16 next;      /* Next descriptor if chained */
};
 
struct vring_avail {
    __le16 flags;
    __le16 idx;       /* Where driver will add next entry */
    __le16 ring[];    /* Descriptor indices available for device */
};
 
struct vring_used {
    __le16 flags;
    __le16 idx;       /* Where device will add next entry */
    struct vring_used_elem ring[];  /* Completed descriptors */
};
 
/* Submitting a network packet - minimal overhead */
int virtio_net_xmit(struct virtqueue *vq, struct sk_buff *skb) {
    struct vring_desc *desc;
    unsigned int head;
    
    /* Get next available descriptor */
    head = vq->free_head;
    desc = &vq->vring.desc[head];
    
    /* Point descriptor at packet data (zero-copy) */
    desc->addr = virt_to_phys(skb->data);
    desc->len = skb->len;
    desc->flags = 0;
    
    /* Add to available ring */
    vq->vring.avail->ring[vq->vring.avail->idx % vq->num] = head;
    wmb();  /* Ensure descriptor visible before index update */
    vq->vring.avail->idx++;
    
    /* Notification: Single kick for potentially many packets */
    if (vq->needs_notify)
        virtio_notify(vq);  /* Single hypercall/MMIO write */
    
    return 0;
}
 
/*
 * Performance analysis: Emulated vs virtio
 * 
 * Emulated e1000 packet send:
 *   1. Write to TDT register → VM exit
 *   2. Read descriptor from guest memory → EPT walk
 *   3. Read packet data from guest memory → EPT walk  
 *   4. Process packet (actual work)
 *   5. Write to status register → VM exit
 *   6. Inject interrupt → complex APIC emulation
 *   Total: ~5-10 VM exits per packet
 * 
 * virtio-net packet send:
 *   1. Write descriptor + update index (shared memory, no exit)
 *   2. Single notification (one VM exit or no exit if batched)
 *   3. Process packet (actual work)
 *   4. Update used ring (shared memory, no exit)
 *   5. Single event channel notification
 *   Total: 0-2 VM exits per packet, can batch thousands
 */
 
/* Batched transmission example */
void virtio_net_xmit_batch(struct sk_buff *skbs[], int count) {
    /* Submit all packets without notification */
    for (int i = 0; i < count; i++) {
        virtio_net_xmit_one_no_notify(skbs[i]);
    }
    
    /* Single notification for entire batch */
    virtio_notify(vq);
    
    /* Result: Even at 10Gbps, notification rate stays manageable */
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

#!/bin/bash
# Rigorous Virtualization Benchmarking Setup
 
# === System Preparation ===
 
# 1. Disable CPU frequency scaling
for cpu in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do
    echo "performance" | sudo tee $cpu
done
 
# 2. Disable turbo boost for consistency
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo
 
# 3. Set CPU affinity for VM
virsh vcpupin testvm 0 4    # Pin vCPU 0 to physical CPU 4
virsh vcpupin testvm 1 5    # Pin vCPU 1 to physical CPU 5
 
# 4. Set NUMA memory policy
virsh numatune testvm --nodeset 0 --mode strict
 
# 5. Drop caches before I/O tests
echo 3 | sudo tee /proc/sys/vm/drop_caches
 
# === Running Benchmarks ===
 
# Run with statistical rigor
run_benchmark() {
    local name=$1
    local cmd=$2
    local iterations=10
    
    echo "Running $name ($iterations iterations)..."
    
    for i in $(seq 1 $iterations); do
        # Warm-up run (discarded)
        $cmd > /dev/null 2>&1
    done
    
    # Measured runs
    for i in $(seq 1 $iterations); do
        $cmd 2>&1 | tee -a results_$name.txt
    done
    
    # Calculate statistics
    awk '{ sum += $1; sumsq += $1^2; n++ } 
         END { 
             mean = sum/n; 
             std = sqrt(sumsq/n - mean^2);
             printf "Mean: %.2f, StdDev: %.2f, CV: %.2f%%
", 
                    mean, std, (std/mean)*100
         }' results_$name.txt
}
 
# CPU benchmark
run_benchmark "cpu" "sysbench cpu --cpu-max-prime=20000 run"
 
# Memory bandwidth
run_benchmark "memory" "sysbench memory --memory-total-size=10G run"
 
# Disk I/O
run_benchmark "disk" "fio --name=randrw --rw=randrw --bs=4k                           --size=1G --numjobs=4 --runtime=30                           --ioengine=libaio --direct=1"
 
# Network
run_benchmark "network" "iperf3 -c server -t 30"
 
# === Comparison Analysis ===
 
# Compare native vs virtualized
compare_results() {
    native=$1
    virtual=$2
    
    native_mean=$(awk '{sum+=$1;n++} END {print sum/n}' $native)
    virtual_mean=$(awk '{sum+=$1;n++} END {print sum/n}' $virtual)
    
    overhead=$(echo "scale=2; (1 - $virtual_mean/$native_mean) * 100" | bc)
    echo "Overhead: $overhead%"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

<!-- Optimal KVM/libvirt Configuration for Performance -->
<domain type='kvm'>
    <name>optimized-vm</name>
    <memory unit='GiB'>16</memory>
    <vcpu placement='static'>8</vcpu>
    
    <!-- CPU: Pass through host features for best performance -->
    <cpu mode='host-passthrough'>
        <topology sockets='1' cores='8' threads='1'/>
    </cpu>
    
    <!-- Memory: Enable huge pages, NUMA awareness -->
    <memoryBacking>
        <hugepages>
            <page size='2' unit='MiB'/>
        </hugepages>
    </memoryBacking>
    
    <numatune>
        <memory mode='strict' nodeset='0'/>
    </numatune>
    
    <!-- Hardware features for optimal virtualization -->
    <features>
        <acpi/>
        <apic/>
        <pae/>
        <!-- Paravirtualized features via hyperv extensions -->
        <hyperv>
            <relaxed state='on'/>
            <vapic state='on'/>
            <spinlocks state='on' retries='8191'/>
        </hyperv>
    </features>
    
    <!-- Paravirtualized clock - critical for time accuracy -->
    <clock offset='utc'>
        <timer name='kvmclock' present='yes'/>
        <timer name='hpet' present='no'/>
        <timer name='pit' tickpolicy='delay'/>
    </clock>
    
    <!-- Block I/O: virtio with optimal settings -->
    <disk type='file' device='disk'>
        <driver name='qemu' type='qcow2' cache='none' io='native'/>
        <source file='/var/lib/libvirt/images/vm.qcow2'/>
        <target dev='vda' bus='virtio'/>
    </disk>
    
    <!-- Network: virtio with multiqueue -->
    <interface type='network'>
        <source network='default'/>
        <model type='virtio'/>
        <driver name='vhost' queues='8'/>
    </interface>
    
    <!-- Random number generator - avoid blocking -->
    <rng model='virtio'>
        <backend model='random'>/dev/urandom</backend>
    </rng>
    
</domain>
 
<!--
Performance expectations with this configuration:
- CPU: 99%+ of native
- Memory: 95%+ of native  
- Network: 85-95% of native (with vhost)
- Disk: 90-98% of native (depends on storage backend)
-->