Logical Partitions on Many-Core Platforms

Logical Partitions on Many-Core Platforms Ramya Jayaram Masti, Claudio Marforio, Kari Kostiainen, Claudio Soriente, Srdjan Capkun Institute of Information Security, ETH Zurich fi[email protected] ABSTRACT systems | a technique called hypervisor disengagement [39]. Cloud platforms that use logical partitions to allocate dedi- Other benefits of logical partitions include improved perfor- cated resources to VMs can benefit from small and therefore mance [15] and efficient nested virtualization [36]. secure hypervisors. Many-core platforms, with their abun- A many-core processor consists of a large number of sim- dant resources, are an attractive basis to create and deploy ple, energy-efficient cores integrated on a single processor logical partitions on a large scale. However, many-core plat- die. Due to their abundant resources, many-core platforms forms are designed for efficient cross-core data sharing rather may be used, in principle, for deploying systems that scale than isolation, which is a key requirement for logical parti- up to hundreds, or even thousands [7], of logical partitions. tions. Typically, logical partitions leverage hardware vir- However, the available many-core systems [7, 21, 22, 41] are tualization extensions that require complex CPU core en- designed for high-performance computing applications and hancements. These extensions are not optimal for many- allow data sharing across cores. Consequently, such many- core platforms, where it is preferable to keep the cores as core architectures are not tailored to support efficient isola- simple as possible. tion which is a mandatory requirement for logical partitions. In this paper, we show that a simple address-space isola- In this paper, we investigate the feasibility of enabling log- tion mechanism, that can be implemented in the Network- ical partitions on many-core processors, in order to integrate on-Chip of the many-core processor, is sufficient to enable the processors into IaaS clouds. Motivated by the scalability logical partitions. We implement the proposed change for benefits of simple cores, we discard the option of relying on the Intel Single-Chip Cloud Computer (SCC). We also de- hardware virtualization extensions. We show that, without sign a cloud architecture that relies on a small and disen- virtualization extensions, logical partitions can be facilitated gaged hypervisor for the security-enhanced Intel SCC. Our by a simple address-space isolation mechanism, implemented prototype hypervisor is 3.4K LOC which is comparable to in the Network-on-Chip of the many-core processor. This the smallest hypervisors available today. Furthermore, vir- simple hardware enhancement does not affect the processor tual machines execute bare-metal avoiding runtime interac- core's complexity and therefore supports many-core proces- tion with the hypervisor and virtualization overhead. sor scalability. We use the Intel SCC many-core architecture [22] as a case study and demonstrate the feasibility of our solution 1. INTRODUCTION with an emulated software prototype. With the proposed A logical partition is a subset of the physical system re- hardware changes in place, we design a simple, disengaged sources that can run an operating system independently of hypervisor for many-core processors and integrate it into an the rest of the system [19]. Logical partitions are widely used IaaS cloud. Our prototype hypervisor has an implementa- in high-assurance virtualized environments such as formally- tion size of only 3.4K LOC that is comparable to the smallest verified separation kernels [13, 26] and commercial hypervi- hypervisors available today [46]. In contrast to solutions like sor deployments [1, 2, 19]. For example, IBM utilizes logical NoHype [39], our hypervisor does not rely on hardware vir- partitions in its Infrastructure as a Service (IaaS) cloud [4]. tualization extensions. Furthermore, similar to [15, 36], our Hypervisors that use logical partitions, provide dedicated solution allows bare-metal execution of VMs, hence elimi- resources to the hosted operating systems and, therefore, nating virtualization overhead. benefit from lightweight resource management and a small This work demonstrates that many-core processors are an Trusted Computing Base (TCB). Logical partitions also al- attractive basis for implementing secure cloud computing low to reduce the runtime attack surface by minimizing the services. To summarize, we make the following contribu- interaction between the hypervisor and the hosted operating tions: Permission to make digital or hard copies of all or part of this work for personal or 1. We show that on many-core platforms logical parti- classroom use is granted without fee provided that copies are not made or distributed tions can be implemented with a simple hardware en- for profit or commercial advantage and that copies bear this notice and the full cita- tion on the first page. Copyrights for components of this work owned by others than hancement, avoiding the need for hardware virtualiza- ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re- tion extensions. We use the Intel SCC architecture as a publish, to post on servers or to redistribute to lists, requires prior specific permission case study and propose minor hardware enhancements and/or a fee. Request permissions from [email protected]. that enable secure partitions. ACSAC ’15, December 07-11, 2015, Los Angeles, CA, USA c 2015 ACM. ISBN 978-1-4503-3682-6/15/12. $15.00 2. We design and implement a complete IaaS architec- DOI: http://dx.doi.org/10.1145/2818000.2818026 ture that leverages the security-enhanced Intel SCC INTEL SINGLE-CHIP CLOUD COMPUTER (SCC) MANY-CORE PROCESSOR TILE Tile1 Tile2 ... Tilen TILE STRUCTURE MESH-BASED INTERCONNECT Core(s) To Pentium Tile Pentium To R R R R Caches Network core memory core DRAM DRAM Memory interface Network R R R R Network-on-Chip (NoC) L2 cache L2 cache DMA interface R R R R DRAM Peripherals Host NoC Router To R R R R To DRAM DRAM Figure 1: Many-core architecture overview. Most To System Interface (I/O) many-core processors are organized in tiles that are connected to memory and peripherals over a Network-on-Chip. Figure 2: Intel SCC architecture overview. The pro- Each tile has one or more cores, network interface and op- cessor has 24 tiles and each tile hosts two cores. Each tile tionally some local memory and a DMA engine. Each pro- is connected to a mesh Network-on-Chip (NoC) via a net- cessor could include a host interface if it is a co-processor. work interfaces and a router. Cores access shared memory (DRAM) on the processor and peripherals, via the NoC. platform. The architecture includes a disengaged hypervisor with a TCB size comparable to the smallest known hypervisors. Asymmetric multi-core processors, such as Intel SCC [22], are in contrast designed to execute multiple operating sys- 3. We evaluate the performance of our architecture and tems on the same platform. demonstrate its suitability for practical cloud deploy- While most current many-core platforms do not support ments. virtualization extensions, there are also examples of SMP architectures that provide such functionality partially. For ex- The rest of this paper is organized as follows. In Section 2 ample, the Tilera TILE-GX [41] processors include memory we provide background information on many-core architec- virtualization support but lack CPU virtualization. Since tures. Section 3 describes hypervisor design alternatives and future many-core platforms are likely to scale to hundreds explains the goals of this work. Section 4 presents our se- or even thousands of cores, it is desirable to keep the cores curity enhancements to the Intel SCC platform and an em- as simple as possible. Solutions where operating systems ulated implementation. In Section 5 we describe an IaaS run directly on the hardware, without explicit virtualization cloud architecture, its implementation and evaluation. In mechanisms also have performance benefits [15, 36]. Section 6 we discuss deployment properties. Section 7 re- We, therefore, focus on the Intel SCC platform which is views related work and we conclude in Section 8. an AMP architecture capable of running multiple operating systems directly on its cores. 2. BACKGROUND 2.2 Intel SCC 2.1 Many-Core Architectures Figure 2 shows an overview of the Intel SCC architecture. A many-core platform consists of a large number of cores Intel SCC is a co-processor that is connected to a host plat- (hundreds or even thousands [7]) integrated into a single form. The processor has 48 cores arranged in 24 tiles. Each processor chip. Figure 1 shows the general architecture of tile contains two Pentium P54C cores enhanced with an L2 a many-core platform. Many-core processors are typically cache and special instructions to use the local on-tile mem- organized as tiles that can access memory and peripherals ory. Cores can be dynamically turned on and off depending over an interconnect. A network interface connects the com- on current computing load. Each tile also has some local ponents on each tile to the Network-on-Chip (NoC). Each memory that is shared between the cores called the Message tile contains a set of cores and, optionally, some local mem- Passing Buffer (MPB) and an on-tile network interface that ory and a DMA engine. All system resources, including connects the tile to a router. Each core is capable of run- peripherals, are accessible via memory-mapped I/O. If the ning a separate operating system independent of the other platform is designed to be a co-processor, it may optionally cores. No two cores on the system share any cache and the incorporate a dedicated memory module (DRAM) and an platform does not implement cache-coherence. Ethernet card that is separate from the host platform. The The routers at each tile are connected to a mesh network number of cores, their underlying instruction set (e.g., x86, which allows cores to access off-tile memory (DRAM) and RISC), and the type of interconnect (e.g., ring, mesh) vary I/O peripherals.

Load more