Virtualization Overhead Research Articles

Performance evaluation of containers for low-latency packet processing in virtualized network environments

Packet processing in current network scenarios faces complex challenges due to the increasing prevalence of requirements such as low latency, high reliability, and resource sharing. Virtualization is a potential solution to mitigate these challenges by enabling resource sharing and on-demand provisioning; however, ensuring high reliability and ultra-low latency remains a key challenge. Since bare-metal systems are often impractical because of high cost and space usage, and the overhead of virtual machines (VMs) is substantial, we evaluate the utilization of containers as a potential lightweight solution for low-latency packet processing. Herein, we discuss the benefits and drawbacks and encourage container environments in low-latency packet processing when the degree of isolation of customer data is adequate and bare metal systems are unaffordable. Our results demonstrate that containers exhibit similar latency performance with more predictable tail-latency behavior than bare metal packet processing. Moreover, deciding which mainboard architecture to use, especially the cache division, is equally vital as containers are prone to higher latencies on more shared caches between cores especially when other optimizations cannot be used. We show that this has a higher impact on latencies within containers than on bare metal or VMs, resulting in the selection of hardware architectures following optimizations as a critical challenge. Furthermore, the results reveal that the virtualization overhead does not impact tail latencies.

Softwarized and containerized microservices-based network management analysis with MSN

Microservice architecture is a service-oriented paradigm that enables the decomposition of cumbersome monolithic-based software systems. Using microservice design principles, it is possible to develop flexible, scalable, reusable, and loosely coupled software that could be containerized and deployed in a distributed edge/cloud environment. The flexible deployment of microservices in an edge environment increases system performance in terms due to dynamic service function placement and chaining possibly resulting in latency reduction, fault tolerance, scalability, efficient resource utilization, cost reduction, and energy consumption reduction. On the other hand, virtualization and containerization of microservices add processing and communication overheads. Therefore, to evaluate end-to-end microservices-based system performance, we need to have an end-to-end mathematical formulation of the overall microservice-based network system. Incorporating the virtualization overhead, here we provide end-to-end mathematical formulation considering system parameters: latency, throughput, computational resource usage, and energy consumption. We then evaluate the formulation in a testbed environment with the Microservice-based SDN (MSN) framework that decomposes the Software-defined Networking (SDN) controller in microservices with Docker Container. The final result validates the presented mathematical modeling of the system’s dynamic behavior which can be used to design a microservice-based system.

Toward Optimal Virtualization: An Updated Comparative Analysis of Docker and LXD Container Technologies

Traditional hypervisor-assisted virtualization is a leading virtualization technology in data centers, providing cost savings (CapEx and OpEx), high availability, and disaster recovery. However, its inherent overhead may hinder performance and seems not scale or be flexible enough for certain applications, such as microservices, where deploying an application using a virtual machine is a longer and resource-intensive process. Container-based virtualization has received attention, especially with Docker, as an alternative, which also facilitates continuous integration/continuous deployment (CI/CD). Meanwhile, LXD has reactivated the interest in Linux LXC containers, which provides unique operations, including live migration and full OS emulation. A careful analysis of both options is crucial for organizations to decide which best suits their needs. This study revisits key concepts about containers, exposes the advantages and limitations of each container technology, and provides an up-to-date performance comparison between both types of containers (applicational vs. system). Using extensive benchmarks and well-known workload metrics such as CPU scores, disk speed, and network throughput, we assess their performance and quantify their virtualization overhead. Our results show a clear overall trend toward meritorious performance and the maturity of both technologies (Docker and LXD), with low overhead and scalable performance. Notably, LXD shows greater stability with consistent performance variability.

Building Scalable and Flexible Virtual Networks on Programmable Data Plane

Network virtualization allows multiple logical networks to coexist on the same physical infrastructure. However, existing virtualization techniques do not work well for data plane. Software-based virtualization techniques suffer from poor performance due to high virtualization overhead while hardware-based virtualization techniques are not flexible due to limited programmability. In this paper, we present Virtualizing Programmable Data Plane (VirtPDP), an architecture to achieve scalability, flexibility, and isolation simultaneously. Specifically, VirtPDP proposes a parallel pipeline structure by extending programmable data plane to parallelly execute multiple virtual networks on a programmable switch. With VirtPDP, each virtual network runs independently to guarantee performance isolation. Additionally, VirtPDP uses a multi-controller control plane structure to independently manage virtual networks on the programmable switch. We implement the VirtPDP prototype both on BMv2 target and Tofino target. The experimental results show that compared to existing work, VirtPDP not only realizes parallel operation of multiple virtual networks with low performance loss, but also provides better flexibility and scalability. Meanwhile, Tofino-based VirtPDP performs much better than DPDK-based NativeP4 while realizing the coexistence of multiple virtual networks.

Time delay in a mechatronic Power-HIL system: Analysis and model-based compensation

The Power-Hardware-in-the-Loop (PHIL) methodology enables testbed solutions that support the development of complex mechatronic components. In PHIL testing, a unit under test (UUT) is coupled with a virtual representation of its surroundings. As an example, a real railway pantograph current collector UUT can be tested in real-time interaction with a virtual overhead catenary. However, due to the closed-loop feedback interconnection and the exchange of power between real and virtual systems, such a PHIL control structure is highly sensitive to time delays in the signal paths which limits its performance, accuracy, and stability. In this work, methods to evaluate and compensate for the effect of time delays in a typical PHIL structure are proposed. A model-based PHIL control system is introduced to demonstrate the effect of time-delay compensation techniques, including utilising specific reduced-order models to achieve efficient time-delay compensation. The performance of the control system is demonstrated and validated via simulations and experiments on a scaled PHIL test setup, which is related to railway pantograph testing. In addition, criteria to analyse system stability are formulated and demonstrated with respect to uncompensated time delays and unknown UUT contact stiffness.

Enabling containerized Central Unit live migration in 5G radio access network: An experimental study

5G mobile networks have gained considerable attention and traction by offering numerous benefits such as high data rates, low latency, reliability, and application specific connectivity. To effectively achieve these milestones mobile network functions must be virtualized using Virtual Machine (VM) and/or Containers. The latter has gained momentum in recent years due to its reduced resource usage and virtualization overhead, improving efficiency and flexibility while sharing compute and network resources. While containerization offers numerous benefits, it still faces specific challenges, one of them being the ability to provide robustness and resiliency of the containerized network functions under challenging network conditions, e.g., varying load conditions and application types. The currently available open-source container platform(s) do not achieve a full-fledged containerized mobile network protocol stack as they fail to support successful live migration of containers that execute specific 5G software functionalities.The contribution of this study is to present a proof-of-concept implementation that completes the live migration of a containerized 5G Central Unit (CU) module between two servers without causing permanent service disruption to the mobile user. The authors’ implementation makes use of an open-source migration software (CRIU) that has been modified to support the protocol (SCTP) used by the CU to exchange signaling messages with other 5G modules. The authors’ implementation is experimentally tested in a federated testbed environment by applying four container migration techniques, namely Cold, Pre-Copy, Post-Copy, and Hybrid-Copy migration. A performance comparison reveals that the end-user service recovery time due to the CU live migration can be reduced by up to 36% when applying the hybrid migration technique compared to the conventional cold migration technique. Additionally, experimental results reveal that compared to state-of-the-art VM migration the container-based migration approach reduces both migration time and service downtime by 96.7% and 75.2%, respectively.

Virtualization Maturity in Creating System VM: An Updated Performance Evaluation

Virtualization technologies are indispensable in operating data centers and supporting cloud infrastructures, providing cost reduction (CapEx and OpEx), high availability, and disaster recovery. Hypervisor-assisted virtualization is one of the leading virtualization technologies, with the hypervisor being the software layer responsible for presenting the virtualized view of the hardware to system-level VMs. However, the virtualization overhead it introduces has implications into the computing infrastructure performance. This paper revisits key concepts about virtualization, technologies and techniques, types of VMs and hypervisors, and provides an up-to-date comparison between native and VM environments using workload metrics such as CPU and memory scores, disk speed, and network throughput to determine virtualization overhead. Our results show a clear overall trend toward meritorious performance and the maturity of the technologies used to create system-level VMs.

Performance characterization and profiling of chained CPU-bound Virtual Network Functions

The increased demand for high-quality Internet connectivity resulting from the growing number of connected devices and advanced services has put significant strain on telecommunication networks. In response, cutting-edge technologies such as Network Function Virtualization (NFV) and Software Defined Networking (SDN) have been introduced to transform network infrastructure. These innovative solutions offer dynamic, efficient, and easily manageable networks that surpass traditional approaches. To fully realize the benefits of NFV and maintain the performance level of specialized equipment, it is critical to assess the behavior of Virtual Network Functions (VNFs) and the impact of virtualization overhead. This paper delves into understanding how various factors such as resource allocation, consumption, and traffic load impact the performance of VNFs. We aim to provide a detailed analysis of these factors and develop analytical functions to accurately describe their impact. By testing VNFs on different testbeds, we identify the key parameters and trends, and develop models to generalize VNF behavior. Our results highlight the negative impact of resource saturation on performance and identify the CPU as the main bottleneck. We also propose a VNF profiling procedure as a solution to model the observed trends and test more complex VNFs deployment scenarios to evaluate the impact of interconnection, co-location, and NFV infrastructure on performance.

Accelerating Address Translation for Virtualization by Leveraging Hardware Mode

The overhead of memory virtualization remains nontrivial. The traditional shadow paging (TSP) resorts to a shadow page table (SPT) to achieve the native page walk speed, but page table updates require hypervisor interventions. Alternatively, nested paging enables low-overhead page table updates, but utilizes the hardware MMU to perform a long-latency two-dimensional page walk. This paper proposes new memory virtualization solutions based on hardware (machine) mode—the highest CPU privilege level in some architectures like Sunway and RISC-V. A programming interface, running in hardware mode, enables software-implementation of hardware support functions. We first propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Software-based Nested Paging (SNP)</i> , which extends the software MMU to perform a two-dimensional page walk in hardware mode. Second, we present <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Swift Shadow Paging (SSP)</i> , which accomplishes page table synchronization by intercepting TLB flushing in hardware mode. Finally we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Accelerated Shadow Paging (ASP)</i> combining SSP and SNP. ASP handles the last-level SPT page faults by walking two-dimensional page tables in hardware mode, which eliminates most hypervisor interventions. This paper systematically compares multiple memory virtualization models by analyzing their designs and evaluating their performance both on a real system and a simulator. The experiments show that the virtualization overhead of ASP is less than 4.5% for all workloads.

Research and Design of Docker Technology Based Authority Management System.

With the development of mobile Internet technology and the continuous popularization of the network, various kinds of network software come out constantly and people are becoming more and more dependent on them, while role authority management is of great importance for the security of software, the control of management process, and the usability of users. In terms of system implementation, virtual machine technology is often faced with problems such as high virtualization overhead, poor scalability, and long deployment time in spite of its good isolation effect. Container technology represented by Docker can well solve these problems and make it possible to quickly build, deploy, operate, and maintain as well as expand services. Based on Docker technology, this research compares and chooses from various authority control models and finally decides to take the role authority management model as the infrastructure. It designs the role authority control model based on cloud computing and Docker technology in combination with the Task Controller Function, the Project Controller Function, and the User Controller Function and realizes this model by adopting the MongoDB database combined with HTML/CSS/Javascript syntax and the Boor Strap framework. After the test, it is found that the Docker technology based role authority management system has satisfactory test performance consistent with expected outputs as well as strong robustness, which can meet the requirements of different objects and subjects.

Predictive Auto-Scaling of Multi-Tier Applications Using Performance Varying Cloud Resources

The performance of the same type of cloud resources, such as virtual machines (VMs), varies over time mainly due to hardware heterogeneity, resource contention among co-located VMs, and virtualization overhead. The performance variation can be significant, introducing challenges to learn workload-specific resource provisioning policies to automatically scale the cloud-hosted applications to maintain the desired response time. Moreover, auto-scaling multi-tier applications using minimal resources is even more challenging because bottlenecks may occur on multiple tiers concurrently. In this paper, we address the problem of using performance varying VMs for gracefully auto-scaling a multi-tier application using minimal resources to handle dynamically increasing workloads and satisfy the response time requirements. The proposed system uses a supervised learning method to identify the appropriate resources provisioning for multi-tier applications based on the prediction of the application response time and the request arrival rate. The supervised learning method learns a state transition configuration map which encodes a resource allocation states invariant to the underlying VMs performance variations. This configuration map helps to use performance varying resources in predictive autoscaling method. Our experimental evaluation using a real-world multi-tier web application hosted on a public cloud shows an improved application performance with minimal resources compared to conventional predictive auto-scaling methods.

Multi-Tenant Intrusion Detection Framework as a Service for SaaS

Information technology (IT) service providers are nowadays moving toward cloud computing. Software-as-a-service (SaaS) refers to cloud service-oriented web applications. As a result of computation outsourcing, a customer (tenant) can subscribe to a self-service SaaS and use it on a pay-per-use basis. To reduce resource costs, a single instance of SaaS serves multiple tenants (multi-tenancy). However, outsourcing and multi-tenancy bring about new security issues. Indeed, tenants lose control over the source code, databases and infrastructure and cannot deploy their own intrusion detection system (IDS). In this context, the provider must not only integrate their preferred IDS into a public cloud, but also protect the tenants according to their individual security requirements. We put forth a multi-tenant intrusion detection framework as a service for SaaS (MTIDaaS) to allow the provider to undertake such integration. Our MTIDaaS has been integrated and tested in a real public cloud environment. It provides security-as-a-service (SecaaS) for both provider and tenant with high levels of portability, flexibility and cost-effectiveness. The experimental results demonstrate that our MTIDaaS offers easy integration of IDS with little virtualization overhead and insignificant impact on HTTP response time.

Remote attestation and integrity measurements with Intel SGX for virtual machines

With response to the emerging virtualization trend, we focus on a Virtual Machine (VM) remote attestation process assuming that it is running in an uncontrolled and untrusted cloud infrastructure.We present a solution that is able to establish a chain of trust in a cloud environment. Our solution is based on a set of CPU instructions and it does not need any additional components to track host modifications. Our solution enables integrity verification of a filesystem. Additionally, it ensures trust level assessment for remote VMs during their startup or while triggered manually at any point in time afterwards.We identify security properties for our solution and show how it meets them. The security analysis shows that with necessary countermeasures, the proposed model can ensure the required level of security. Additionally, We evaluate the performance impact of the prototype and virtualization overhead for a real-life scenario. Here, we assume that small configuration files, binaries, and executables are most critical. The results show that important filesystem components can be verified with a minimum impact on a startup time. This way, the whole proposal allows for making VM a part of a trusted compute resource pool.

A lightweight virtualization model to enable edge computing in deeply embedded systems

AbstractEdge computing paradigm enables moving Internet of Things (IoT) applications from the Cloud to the edge of the network. Modern software engineering approaches are adhering to microservices to enable the deployment of such applications on edge devices. Microservices consist of the disaggregation of an application into smaller pieces that operate independently. Recent works have explored microservices packaged into containers and advocate that containers result in a reduced footprint and avoid the unwanted overhead caused by traditional virtualization. However, containers cannot be used in many deeply embedded systems (DES) due to an underlying operating system's (OSs) requirement. DES are edge devices with minimal resources regarding storage, memory, and processing power. Thus, they cannot afford large and sophisticated OSs. This article presents the Hellfire hypervisor, a lightweight virtualization implementation that enables separation and improves security in IoT applications on DES. Our proposal simplifies the traditional hypervisor approach and reaches devices where the existing techniques fail. The results show that the proposed model has a small footprint of 23 KB while keeping a low average virtualization overhead of 0.62% for multiple virtual machines execution.

Virtualization Overhead of Multithreading in X86 State-of-the-Art &amp; Remaining Challenges

Despite great advancements in hardware-assisted virtualization of the x86 architecture, certain workloads still suffer significant overhead. This article dissects said overhead in the context of multi-threading. We describe the state-of-the-art, pinpoint challenges, and suggest improvements, aiming to provide a valuable reference to developers and users of virtualization systems alike. We study the virtualization overhead of the PARSEC and SPLASH2X multithreaded benchmarks in a variety of scenarios using a state-of-the-art system. Through controlled experiments, source code analysis and literature review, we quantify the virtualization overhead multithreading still induces and link it to its root causes, after which we suggest possible mitigation strategies. Multithreading still induces high virtualization overhead, mainly caused by synchronization, spinning at user level and NUMA management. The overhead is diverse in nature and embodiment as it is a function of many system and workload properties. System-level solutions are feasible, but often imply difficult trade-offs. Systematic workload optimization is a promising alternative.

Enhancing Performance and Energy Efficiency for Hybrid Workloads in Virtualized Cloud Environment

Virtualization has attained mainstream status in enterprise IT industry. Despite its widespread adoption, it is known that virtualization also introduces non-trivial overhead when tasks are executed on a virtual machine (VM). In particular, a combined effect from device virtualization overhead and CPU scheduling latency can cause performance degradation when computation intensive tasks and I/O intensive tasks are co-located on a VM. Such an interference also causes extra energy consumption. In this paper, we present Hylics, a novel solution that enables efficient data traverse paths for both I/O and computation intensive workloads. This is achieved with the provision of in-memory file system and network service at the hypervisor level. Several important design issues are pinpointed and addressed during our prototype implementation, including efficient intermediate data sharing, network service offloading, and QoS-aware memory usage management. Based on our real-world deployment on KVM, we show that Hylics can significantly improve computation and I/O performance for hybrid workloads. Moreover, this design also alleviates the existing virtualization overhead and naturally optimizes the overall energy efficiency.

Database Application Supporting the Training Process Using a Simulator

The article presents a short description of the developed application based on a relational database and the results of the application functionality test. The application allows you to analyse the parameters of the process of simulating the use of a virtual overhead crane performed on a simulator, e.g. in terms of errors. The tested application works with the simulator of an overhead crane controlled from a cabin modelled using virtual reality. The tests were carried out with the participation of training instructors and occupational health and safety employees.

Energy-efficient auto-scaling of virtualized network function instances based on resource execution pattern

To scale virtualized network functions (VNF), information about computing resource utilization plays an important role. With the usage of both virtualized and physical resources, introduced new challenges that need to be solved by virtual network functions manager (VNFM), which are responsible for managing the lifecycle of VNFs. These challenges demand an auto-scaling mechanism that relies on proper factors. The proposed system considers the execution time, thresholds of a VNF, and weight factor reflecting virtualization overhead as the practical factors. An auto-scaling application, along with the monitoring application, is developed. These two applications communicate with each other via application programming interfaces (API) to generate the auto-scaling configurations of resources. In the light of mentioned factors, mechanism, and later provided results, the proposed system proves to be useful in solving the challenges related to energy and allocation of resources for both virtual and physical infrastructures.

A Model-Based Approach Towards Real-Time Analytics in NFV Infrastructures

Network Functions Virtualization (NFV) has recently gained much popularity in the research scene for the flexibility and programmability that it will bring with the software implementation of network functions on commercial off-the-shelf (COTS) hardware. To substantiate its roll out, a number of issues (e.g., COTS’ inherent performance and energy efficiency, virtualization overhead, etc.) must be addressed, in a scalable and sustainable manner. Numerous works in the scientific literature manifest the strong correlation of network key performance indicators (KPIs) with the burstiness of the traffic. This paper proposes a novel model-based analytics approach for profiling virtualized network function (VNF) workloads, towards real-time estimation of network KPIs (specifically, power and latency), based on an MX/G/1/SET queueing model that captures both the workload burstiness and system setup times (caused by interrupt coalescing and power management actions). Experimental results show good estimation accuracies for both VNF workload profiling and network KPI estimation, with respect to the input traffic and actual measurements, respectively. This demonstrates that the proposed approach can be a powerful tool for scalable and sustainable network/service management and orchestration.

Separation of Virtual Machine I/O in Cloud Systems

Virtualization is widely used in modern computer systems ranging from personal computers to cloud servers as it provides various heterogeneous platforms at low cost. However, due to its nested software structure in host and guest machines that are difficult to harmonize, it is challenging to manage resources efficiently in virtualized systems. In this article, we anatomize the overhead of virtualization associated with file system journaling and discover the excessively frequent commits that take place in virtualized systems. This is because the host triggers commit on every write request from all guest machines. This also generates unnecessary write traffic to storage. To remedy these problems, we propose the VM-separated commit, and implement it on QEMU-KVM and Ext4. Specifically, we devise a data structure that manages modified file blocks from each guest as a separate list and split the running transaction list into two sub-transactions based on this data structure upon a commit request from a guest. Measurement studies with Filebench and IOzone benchmarks show that the proposed policy improves the I/O throughput by 19.5% on average and up to 64.2% over existing systems. It also reduces the variability in performance.