Showing posts with label kvm. Show all posts
Showing posts with label kvm. Show all posts

Thursday, February 14, 2019

[Links of the Day] 14/02/2019: golang fast HTTP , virtio shared file-system, enclave application

  • FastHTTP : like net/http but up to 10x faster . Zero memory allocation on a fast path. When you really really need to go fast and the standard golang lib is not enough.
  • Virtio-fs : shared file system build on top of the virtio framework. Finally a good way of sharing files and data between the host and the guest VM or between guests [git].
  • Asylo : I recently came across the concept of enclave applications. An enclave is a special execution context where code can run protected from even the OS kernel, with the guarantee that even a user running with root privileges cannot extract the enclave’s secrets or compromise its integrity. It relies on Intel SGX or ARM trustzone security hardware feature to protect the runtime operation of the process. This might be the next security level for highly regulated industries that want to deploy in a public cloud environment which will completely eliminate a lot of the conundrum that they currently face.

Wednesday, May 09, 2018

A look at Google gVisor OCI runtime

Google released a new OCI container runtime: gVisor. This runtime aim at solving part of the security concerns associated with the current container technology stack. One of the big argument of the virtualisation crowd has always been that the lack of explicit partitioning and protection of resource can facilitate “leakage” from the containers to the host or other adjacent containers. 

This stem from the historical evolution of containers in Linux. Linux has no such concept of native containers. Not like BSD with Jails or Solaris with Zones. Containers in Linux are the result of the gradual emergence of a stack of various security and isolation technology that was introduced in the Linux kernel. As a result, Linux ended up with a highly broad technology stack that can be separately turned on / off or tuned. However, there is no such thing as a pure sandbox solution. The classic jack of all trade curse, it’s a master of none solution.
The Docker runtime (Containerd) package all the Linux kernel isolation and security stack (namespaces, cgroup, capabilities, seccomp, apparmor, SELinux) into a neat solution that is easy to deploy and use. 
It allows the user to restrict what the application can do such as which file it can access with which permission or limits resource consumption such as networks, disk I/O or CPU. It allows the applications to share resources without stepping on each other toes happily. Also, limits the risk any of their data being accessed while sitting on the same machine. 
With a correct configuration ( the default one is quite reasonable ) will allow blocking anything that is not authorised and in principle protect from any leak from a malicious or badly coded piece of code running in the container. 







However, you have to understand that Docker has some real limitation already. It has only limited support for user-namespace. The user-namespace allows applications to have UID 0 permission within the containers ( aka root ) while the containers and user running has a lower privilege level. As a result, each container would run under a different user ID without stepping on each other toes. 

All of these features rely on the reliability and security (as in no bugs) of the Linux kernel. Most of Docker advanced feature relies on kernel features. And getting new features is a multi-year effort, it took a while for good resource isolation mechanism percolates from the first RFC to the stable branch by example. As a result, Docker and current container ecosystem are directly dependent on the Linux kernel update inertia as well as its code quality. While being excellent, no system is entirely free of bug, not to mention the eternal race for patching them when they are discovered and fixed. 

Hence the idea is to, rather than having to share the kernel between all the containers, have one kernel per container. Explicitly limiting potential leakage, interference and reduce the attack surface. gVisor adopts this approach, which is not new as KataContainers already implemented something similar. Katacontainers is the result of the fusion of ClearContainer (intel) and runV (hyper). Katacontainers use KVM as a minimalistic kernel dedicated to the container runtime. But, you still need to manage the host machine to ensure fair resource sharing and their securitisation. This additional layer of indirection limits the attack surface as even if a kernel bug is discovered you will be challenged to exploit it to escape to another an adjacent container or underlying one as they are not shared. 






gVisor can use a KVM as kernel; however, it was initially and is still primarily designed around ptrace. User Mode Linux already used the same technique, which is to start a process in userspace for the subsystem that will be running on top. Similarly to a hypervisor model used by virtual machines. All the system calls will be executed using the permission of the userspace process on behalf of the subsystem via an interception mechanism. 








Now, how do you intercept these system calls which should be executed by the kernel? UML and gVisor divert ptrace primary goal ( which is debugging ) and inject a breakpoint in the executable code to intercept and stop for every system call execution. Once caught the new userspace kernel will execute the call on behalf the original process within userspace. It works well, but as you guessed, there is no free lunch. This method what heavily used by the first virtualisation solution. But rapidly, processor vendors realised that offering hardware-specific acceleration method would be highly beneficial ( and sell more at the same time).

KVM and other hypervisor leverage such accelerator. Now you even have AWS and Azure deploying completely dedicated coprocessor for handling virtualization related acceleration. Allowing VM to run almost that the same speed as a bare metal system. 

And like Qemu leveraging KVM, gVisor also offer KVM as underlying runtime environment. However, there is significant work to be done to enable any container to run on to of it. While ptrace allow to directly leverage existing Linux stack, with KVM you need need to reimplement a good chunk of the system to make it work. Have a look at Qemu code to understand the complexity of the task. This is the reason behind the limited set of supported applications as not all syscalls are implemented yet.

As is, gVisor is probably not ready yet for production. However, this looks like a promising solution providing a middle ground between the Docker approach and the Virtualization one while taking some of the excellent ideas coming from the unikernel world. I hope that this technology gets picked up, and the KVM runtime becomes the default solution for gVisor. It will allow the system to benefit from a rock-solid hardware acceleration with all the paravirtualisation goodies such as virtio. 


Tuesday, September 06, 2016

[Links of the day] 06/09/2016 : KVM forum 2016, Beginner's guide to neural net, Seeing with Wi-Fi

  • KVM forum 2016 : KVM forum videos are up, notable talk on vGPU by NVDIA. This is really interesting as it pave the way to multi tenant GPU in virtual environment. Which allow resource sharing and hence RoI of such device. 
  • A Beginner's Guide To Understanding Convolutional Neural Networks : 3 part blog post explaining neural network, this is a really good introduction. [part-1 , part-2, part-3]
  • We Can "See" You via Wi-Fi : researcher devise a way to identify action using Wi-Fi. Their method allow to some extend the recognition of human interaction. This is really interesting as Wi-Fi is pretty much ubiquitous. It would allow anybody to have the capability to peek into environment without the need to costly setup. 

Tuesday, November 10, 2015

Links of the day 10/11/2015: #containers, #Unikernel & #virtualization power consumption, security, and streamlined

  • Qubes with Rumprun : Interesting application of unikernel to deliver greater security at speed. the goal is to reduce the possible attack surface while maximizing performance.
  • Power Consumption of Virtualization Technologies: empirical Investigation that confirm a lot of what we knew already, virtualization power consumption is higher than container.
  • Vagga : containerisation tool without daemons. Slim down streamline version of container. No deamons or other process to run to support it. Looks like a solid contender to docker and other vagrant.

Friday, October 23, 2015

Links of the day 23/10/2015: #Openstack, #KVM, #Docker at scale at #CERN




Wednesday, September 02, 2015

Links of the day 02/09/2015 : Seagate kintetic @CERN , KVM HA and Intel Omnipath perf

  • KVM HA : Update on the COLO VM replication project. What's interesting is that they only look at the network side of the external state to confirm the coherence of the system. This limits what the VM can do and access but on the other hand simplify the overall setup.
  • Kinetic @ CERN : In a previous blog post I mentioned how this type of approach is a game changer for cloud storage solution. Here you can already see some numbers : ~1/3 of power , ~1/2 of cost, No more storage server ( simplified maintenance ) [video]
  • Omnipath :  the number are really interesting: (a) a 4.6x improvement in small message throughput over the previous generation InfiniBand fabric technology, (b) a 70ns decrease in switch latency  (c) a single ASIC that can deliver 50 GB/s of dual-channel bidirectional bandwidth, or 12.5GB/s single channel unidirectional bandwidth. In short, Omni-Path delivers all this and more as an integrated component inside the processor package or via other form factors like PCIe cards or custom mezzanine cards.

Monday, August 24, 2015

Links of the day 24/08/2015 : #Docker vs #kvm vs #Osv performance, #Linux NVM programming tutorial and Datacenter SLA ontology


Friday, August 21, 2015

Links of the day 21/08/2015: #kvmforum , Two laws, and NVMe transforming the Datacenter


  • KVM forum : slide deck of the 2015 KVM forum, some gems in there especially related to the real time efforts.
  • A tale of two laws : As Amdahl’s law and Moore’s law reach their 50th anniversaries, this paper review the roles they have played in shaping both perception and reality in high-performance computing. Along the way, it also attempt to clarify some misconceptions that have surrounded both of these highly influential but not always fully appreciated ‘‘laws.’’
  • NVM Express - The Data Center and Client Storage Transformation: Loads of good stuff from Intel IDF 2015, i ll be distilling it over the next week. But this one is particularly interesting talk by Intel and DSSD folks ( acquired by EMC recently). It show how the new tech is trying to cut the CPU out of the loop as much as possible and storage start to embrace Memory type transaction model ( RDMA ). To a certain extend storage is just being absorbed back into the overall memory model. The interesting bit is that because of the current performance limitation of flash couple with the fabric capabilities there is a very small overhead in using remote storage vs local one.

Tuesday, June 09, 2015

Links of the day 09 - 06 - 2015

Today's links 09/06/2015 : Local algorithm for highly scalable architecture, Artic time series Database on top of #MongoDB, KVM Forum

  • Local algorithms : Very good survey of algorithms with the very interesting property that they runs in constant time, independently of the size of the network. Which makes then extremely attractive for large scale distributed systems.
  • Artic : a high performance datastore for numeric data on top of mongoDB. It supports Pandas, numpy arrays and pickled objects out-of-the-box, with plug-gable support for other data types and optional versioning. They have wild claim in regard performance and scalability but until we get a proper time series benchmark out there it still hard to compare time series solutions.
  • KVM forum 2015 :  Schedule of this year KVM forum. Interesting Bits: Real time stuff , some live migration with DPDK and running 1k guests per host.



Thursday, January 08, 2015

Links of the day 08 - 01 - 2015

Today's links 08/01/2015 : Slim down #Qemu in Go, #BrainFuck , Architecture analysis, Data driven #Culture

  • NoVM : lightweight type 2 hypervisor ( qemu) implemented in go 
  • Brainfuck optimization strategies : when you really want to get the best out of your brainfuck :) 
  • Panda : open-source Platform for Architecture-Neutral Dynamic Analysis using QEMU whole system emulator, and so analyses have access to all code executing in the guest and all data.
  • Data Driven : Creating a Data Culture book


Thursday, October 30, 2014

Links of the day 30 - 10 - 2014

Today's links 30/10/2014 : userfault, transaction, cloud frontend , virtkick

  • Phaser : phase Reconciliation for Contended In-Memory Transactions by Neha Narula at MIT [slides
  • Scaling Address-Space Operations on Linux with TSX : Thesis by Christopher Ryan Johnson on transacional memory and how these operations can be scaled within multicore systems. 
  • VirtKick : A simple orchestrator. Manage virtual machines or #docker [github]
  • Userfault : Andrea Arcangeli release the first RFC for page fault resolution in userspace. The interesting bit is the possibility to treat write and read fault differently. I can foresee some promising spin off from this project

Tuesday, October 21, 2014

Links of the day 21 - 10 - 2014

Today's links 21/20/2014: all about #Linux #networking with a little bit of  #HPC distributed #storage

  • State of Linux network stack : what's new and interesting in the latest kernel release, especially the low-latency device polling
  • KVM Forum : all videos of this year KVM forum . Some interesting talk especially on the HPC front and an interesting quote from Vincent Jardin: " if you want to have high performance networking or NVF solution don't use virtualization use container"
  • RDMA and ARM : Mellanox bring its RoCE adapter to the moonshot project. Interesting to see what type of application would leverage such architecture combination: a lot of small processors with a fast fabric.  
  • IX : solution that isclose to achieve the holy grail of networking - Low latency with high throughput (line rate)
  • (Fast Forward) Storage and I/O : Distributed Application Object Storage (DAOS) by Intel for HPC solution. A lot of flash , burst buffer with Lustre for supercomputer. Very interesting approach to address the challenge of future exascale computing platform.

Thursday, September 18, 2014

Links of the day 18 - 09 - 2014

Today's links 18/09/2014: #KVM HA , #SDN , #HPC SSH




Tuesday, July 29, 2014

Links of the day 29 - 07 -2014

Today : Deep learning,  cloud market state of play, Cloud Infrastructure Mgmt tool, and Container vs Hypervisor performance comparison.



Saturday, August 03, 2013

Hecatonchire Version 0.2 Released!

Version 0.2 of Hecatonchire has been released.

What's New:
  1. Write Invalidate coherency model added for those who want to use Heca natively in their application as Distributed Shared Memory( more on that in a subsequent post)
  2. Significant improvement in performance of page transfer as well as a numbres of bugs squashed.
  3. Specific Optimisation for KVM.
  4. Scale out memory mirroring
  5. Hybrid Post copy live migration
  6. Moved to linux Kernel 3.9 Stable
  7. Moved to Qemu-kvm 1.4 stable
  8. Added Test / Proof of concept tools ( specifically for the new coherency model)
  9. Improved Documentation
Voila!

We are now focusing on Stabilizing the code as well as robustness ( we aim at making the code production ready by 0.4) . Also, we are starting significant work to transparently integrate Hecatonchire so it can be transparently leverage via a cloud stack and more specifically openstack.

You can download it here : http://hecatonchire.com/#download.html
You can see the install doc here: https://github.com/hecatonchire/heca-misc/tree/heca-0.2/docs
And finally the changelog  there : http://hecatonchire.com/#changelog-0.2.html
Or you can just pull the Master branch on github:  https://github.com/hecatonchire


Stay tuned for more in depth blog post on Hecatonchire.

Monday, June 24, 2013

Scaling Out SAP HANA In Memory DB with Hecatonchire

Many shared-memory parallel applications do not scale beyond  a few tens of cores.However, may benefit from large amounts of memory:  
  • In-memory databases
  • Datamining
  • VM
  • Scientific applications
  • etc
Moreover,  memory in the nodes of current clusters are often Overscaled in order to fit the requirements of “any” application and  remains unused most of the time. One of the objective we try to achieve with project Hecatonchire is to unleash your memory-constrained application by using the memory in the rest of nodes.In this post we demonstrate how Hecatonchire enables users to have memory that grows with their  business or applications, not before. While using high-volume components to build high-value systems and eliminating physical limitation of Cloud / Datacenter or servers.

The application : SAP HANA

HANA DB takes advantage of the low cost of main memory (RAM), data processing abilities of multi-core processors and the fast data access of solid-state drives relative to traditional hard drives to deliver better performance of analytical and transactional applications. It offers a multi-engine query processing environment which allows it to support both relational data (with both row- and column-oriented physical representations in a hybrid engine) as well as graph and text processing for semi- and unstructured data management within the same system. HANA DB is 100% ACID compliant.



The Benchmark, hardware and  Methodology 


  •  Application: SAP HANA ( In memory Database)
  • Workload: OLAP ( TPC-H Variant)
    • Data size 
      • For Mall and Medium Instance: ~600 GB uncompressed ( ~30 GB compressed in RAM)
      • For Large: 300 GB compressed Data ( 2 TB of uncompressed data) 
    • 18 different Queries (TPC-H Variant)
    • 15 iteration of each query set
  • Virtual Machine:
    • Small Size: 64 GB Ram - 32 vCPU
    • Medium Size: 128 GB RAM – 40 vCPU 
    • Large Size: 1 TB RAM 40 vCPU
    • Hypervisor: KVM

  • Hardware:
    • Server with Intel Xeon West Mere
      •  4 socket
      •  10Core
      •  1 TB or 512 GB RAM
    • Fabric:
      • Infiniband QDR 40Gbps Switch +  Mellanox ConnectX2



 Results 


The results demonstrate the scalability and performance of the Hecatonchire solution, for small and large instance we only notice an average of 3% overhead compare to non-scale out benchmark.

Hecatonchire Over Head vs Standard Virtualised HANA ( Small Instance)





 Moreover, we can notice in the query break down that for very short (almost point) query (13-14) the cost of accessing scaled out memory is immediately perceptible. However, Hecatonchire demonstrated that we are able to smooth out the impact of the scaling out for lengthier and memory intensive query.
Per Query Overhead breakdown for Small instance Benchmark



We officially tested Hecatonchire and HANA only up to 1 TB and obtained similar results as the one with the small and medium instance (3% overhead). We are currently running test for 4 to 8 TB scale out solution in order to  validate larger scale scenario which require new feature that are currently added into the code. Stay tuned for a new and improved Heca!
1 TB Virtualized SAP HANA scaled out with Hecatonchire



Finally, we can demonsrated that for Hecatonchire scale very well when we spread the memory across multiple memory provider nodes. We not only benefit  form the increased bandwidth but also from the improved latency with excellent performance result with 1.5% overhead when 2 third of the memory is externalised.
Various Hecatonchire deployment scenario of a  virtualized medium Instance HANA

Note: typically running HANA on Top of KVM add by default a 5% to 8% overhead compare to a bare bone instance that we didn't take into account in the result as we are only comparing virtualized against scaled out virtualized.

Tuesday, April 09, 2013

Hecatonchire High Availaility and redundancy of memory scale out node



Delivering transparent memory scale-out presents certain challenges. Two main aspects can be compromised by the deployment of such a solution:
  1. Performance may be hindered, due to the generic nature of implementation at the infrastructure level.
  2. Fault Resilience might be compromised, as the frequency of failures increases along with the increased number of hosts participating in the system. The latter challenge is significant: the decrease in Mean Time Between Failures (MTBF) exposes a non-resilient system to an increased risk of down-times, which might be unacceptable in many business environments.
In Hecatonchire we developed a solution revolving around a scale-out approach with mirroring of the remote memory in two or more parallel hosts.


Memory Scale out redundancy design in Hecatonchire


Design


To enable fault-resilience, we mirrored the memory stored at memory sponsors. All remote memory, residing in memory sponsors, is mirrored, and therefore failure in one sponsor does not cause any loss of data. Furthermore, such failure does not cause any delay or downtime in the operation of the running application.
When the kernel module faults on an address, it sends the request to both memory sponsors. Upon reception of the first response, the memory demander uses it to allow the application to continue operating. When a page is not required anymore on the computing node, the kernel module swaps the page out. To do so, it sends the page to both memory sponsors, and waits for validation that both of them stored the content, before discarding the page.
The biggest advantage of this approach is zero-downtime failover of memory sponsors. If one sponsor fails, the other sponsor continues responding to the memory demander’s requests for memory content. 
Fault Tolerance in Hecatonchire

Tradeoff

 The advantage of fault-resiliency in our approach is mitigated by several trade-offs. First of all, this approach needs twice the amount of memory, compared to a non-resilient scheme. Furthermore, the approach potentially induces an additional performance overhead: swap-out operations are delayed (waiting for responses from two hosts), and some additional computation and storage is needed.

Moreover, the mirroring approach doubles the needed bandwidth, luckily today’s fabrics have bandwidth capacities reaching 100Gbps and it is currently rare that application consume more than 50Gbps continuously.

Note  that our approach does not deal with fault tolerance for the main host running the application (the memory demander).The issue of VM replication has numerous solutions that are orthogonal to our approach, such as Kemari  and Remus.

Benchmark with Synthetic Workload


To assess the impact of using the High availability solution of Hecatonchire we used  a realistic scenario: Running an application over the system, and measuring completion time overhead, compared to running the application on top of sufficient local DRAM. For this scenario we used an application which performs a quicksort over an arbitrary amount of generated data, in similar fashion to previous evaluations of DSM systems. This simulates a memory-intensive application, as memory is accessed rapidly, with minimal computations per access. Our two main KPIs are the overhead in completion time of using an redundant cluster to extend available memory, compared to using sufficient local, physical memory; and more importantly, the trend of performance degradation as the cluster scales. Scaling was created both by extending the workload size - amount of data to be sorted - and by limiting the amount of physical memory on the computation host. The ratio of workload size to available memory on the computation host reflects a scaling factor of the system.

Note: in the figure the redundant memory cluster is called RRAIM for redundant array of inexpensive RAM






The results  show completion times for the quicksort benchmark, with a total workload of 500MB, 1GB and 2GB, respectively. The cgroup memory in the computation  host was capped, such that workload size was up to ×5 larger than available memory, reflecting memory aggregation for the process.

The results reflect very low overhead for using HA , compared to local DRAM. Table  displays the % of overhead per scaling factor. Quintupling (×5) the available memory for the quicksort application process using RRAIM results in an overhead less than 5%; using a fault-tolerant schema still results in an overhead less than 10%.
More importantly, the trend of performance degradation, as the scaling factor increases, reflects good scalability of the solution : the difference between doubling the available memory and quintupling it is less than 2.5 − 4%. The singular steep incline in the 512 GB scenario probably represents thrashing as the size of physical memory was too small for the working set - rather than a simple overhead increase. And this seems to be confirmed  as enough memory on the computation host is available to hold the working set, this phenomenon does not occur (1GB + scenario).

Benchmark with Enterprise Application Workload




The quicksort benchmark suffers from two disadvantages: The first is using small memory workloads (up to 2GB in our evaluations); and the second being a synthetic benchmark, not necessarily reflecting real-world scenarios. We therefore chose to evaluate the performance of RRAIM in transparently scaling-out a commercial in-memory database - SAP HANA - using the standard commercial benchmark. Note that this benchmark was not designed to test distributed systems at all: Only the performance of the database itself. A low overhead in completion time of the benchmark, when extending the available memory using RRAIM, reflects a transparent scale-out, with minimal disruption to the running database. The average overhead for running HANA with HECA on a  128 GB VM instance with 600 GB of DATA loaded up and running a SAP-H variant is on average 4% in a 1:2 and 1:3 memory ratio scenario. When we introduce RRAIM the overhead stay almost the same as showed in the following table.