WHITE PAPER Intel® Virtualization Technology Enterprise Server Enabling Intel® Virtualization Technology Features and Benefits Maximizing the benefits of virtualization with Intel’s new CPUs and chipsets EXECUTIVE SUMMARY Although virtualization has been accepted in most data centers, some users have not yet taken advantage of all the virtualization features available to them. This white paper describes the features available in Intel® Virtualization Technology (Intel® VT) that work with Intel’s new CPUs and chipsets, showing how they can benefit the end user and how to enable them. Intel® Virtualization Technology Goldberg. Thus, developers found it difficult Feature Brief and Usage Model to implement a virtual machine platform on Intel VT combines with software-based the x86 architecture without significant virtualization solutions to provide maximum overhead on the host machine. system utilization by consolidating multiple environments into a single server or PC. In 2005 and 2006, Intel and AMD, working By abstracting the software away from the independently, each resolved this by creat- underlying hardware, a world of new usage ing new processor extensions to the x86 models opens up that can reduce costs, architecture. Although the actual implemen- increase management efficiency, and tation of processor extensions differs strengthen security—all while making your between AMD and Intel, both achieve the computing infrastructure more resilient in same goal of allowing a virtual machine the event of a disaster. hypervisor to run an unmodified operating system without incurring significant emula- During the last four years, Intel has intro- tion performance penalties. duced several new features to Intel VT. Most of these features are well known, but others Intel VT is Intel’s hardware virtualization for may not be. the x86 architecture that helps consolidate multiple environments into a single server, This paper describes key features of Intel VT, workstation, or PC so that you need fewer how they fit into Intel’s platforms, and how to systems to complete the same tasks. maximize their benefits. The sections that follow explain some of Intel VT CPU-Based Features the key CPU-based features of Intel VT. The x86 processor architecture did not orig- inally meet the Formal Requirements for Intel® VT FlexPriority Virtualizable Third-Generation Architectures, Intel® VT FlexPriority is a processor exten- Marco Righini sion that optimizes virtualization software Intel Corporation a specification for virtualization created in efficiency by improving interrupt handling. [email protected] 1974 by Gerald J. Popek and Robert P. Enabling Intel® Virtualization Technology Features and Benefits To enable Intel VT FlexPriority, you enable With virtual processor IDs (VPID), a VM ID VPID is available on all new Intel Xeon processors Intel VT extensions. Like most hardware tag in the CPU hardware structures (e.g., starting with the 5500, 5600, and 7500 series. features, Intel VT FlexPriority must be TLB) associates cache lines with each VM VGuest Preemption Timer enabled by the hypervisor or virtual actively running on the CPU. This permits The Guest Preemption Timer is a mecha- machine monitor (VMM), which allows mul- the CPU to flush only the cache lines nism that enables a VMM to preempt the tiple operating systems to run concurrently associated with a particular VM when it execution of a guest OS. on a host computer. is flushed from the CPU, avoiding the need to reload cache lines for a VM that Programmable by VMM, the timer causes Intel VT FlexPriority eliminates most VM was not migrated and resulting in lower the VM to exit when the timer expires. It exits due to guest task priority registers overhead. has no impact on interrupt architecture. (TPR) access. This reduces the virtualiza- tion overhead and improves I/O through- put. Table 1 lists which Intel CPUs have Table 1. Intel Processors with Intel® VT FlexPriority Intel VT FlexPriority; Table 2 maps Intel VT features to CPUs. Figure 1 shows the Intel® Enhanced vMotion* Example reduction of EXITs and also looks at the Microarchitecture Compatibility (EVC) Setting I/O throughput measured (best-case 45nm Intel® Core™ Intel® Xeon® processor (45nm) Intel Xeon processor scenario). processor family Intel Core 2 processor 5400 or 7400 series Intel® VT FlexMigration Next-generation Intel® Intel Xeon processor Intel Xeon processor Intel® VT FlexMigration is a feature of Intel microarchitecture Intel Core i7 processor (45nm) 5500 or 7500 series Virtualization Technology that enables you Intel Xeon processor Intel Xeon processor Intel Xeon processor to build one compatible virtualization pool and 5600 series Intel Core i7 processor (32nm ) 5600 series conduct live virtual machine (VM) migration across all Intel® Core™ microarchitecture-based servers. It gives you the power to choose the Table 2. Intel Virtualization Technology Feature and CPU Mapping right server platform to best optimize per- formance, cost, power, and reliability. Intel® Xeon® Processor 7400 7500/ 5500 5600 3300/ 3400 Combined with support from a virtualization Series 6500 Series Series 3100 Series software provider, this feature allows IT to Series Series maximize flexibility by providing the ability VT-x Base to build a single live migration compatibility Intel® VT FlexPriority pool with multiple generations of Intel Xeon Intel® VT FlexMigration processor-based servers. Extended Page For details on Intel VT FlexMigration, visit Tables (EPT) http://communities.intel.com/docs/DOC-4124. Virtual Processor Virtual Processor IDs (VPID) ID (VPID) Traditionally, every time a hypervisor Guest Preemption switched execution between different VMs, Timer the VM and its data structure had to be Descriptor-Table flushed out of the transition look-aside Exiting buffers (TLB) associated with the CPU Pause-Loop Exiting caches, since the hypervisor had no informa- TXT tion on which cache line was associated with any particular VM. Real Mode Support 2 Enabling Intel® Virtualization Technology Features and Benefits This feature helps VMM vendors fulfill flexi- Extended Page Table (EPT) hardware features built into the CPU and bility and quality of service guarantees. It Typical Intel® architecture 32-page tables chipset. This hardware-based security pro- can help when you need to switch tasks or (referenced by control register CR3) trans- vides a foundation on which trusted plat- allocate a certain amount of CPU power to a late from linear addresses to guest-physical form solutions can be built to protect the task. For telecom and networking applica- addresses. With the Extended Page Table platform from software-based attacks. tions, it makes virtualization a useful tool— (EPT) feature, a separate set of page tables and possibly a must-have feature. (EPTs) translate from guest-physical Figure 3 shows how Intel TXT works. addresses to host-physical addresses that Descriptor Table Exiting Features of Intel TXT include: are used to access memory. As a result, the This feature allows a VMM to protect a guest OS can be allowed to modify its own guest OS from internal attack by preventing • Verified Launch. An Intel TXT page tables and directly handle page faults. relocation of key system data structures. hardware-based chain of trust enables launch of MLE into a known, This allows a VMM to avoid the VM exits Pause-Loop Exiting expected state. Changes to MLE associated with page-table virtualization, This feature is a hardware assist to enable can be detected via hash-based which is a major source of virtualization detection of spin locks in guest software measurements. and avoid lock-holder preemption. It helps to overhead without EPT. reduce overhead and improve performance. • Protected Configuration. Intel TXT Figure 2 shows how the EPT works. hardware protects the launched con- Real Mode Support Intel® Trusted Execution Technology figurations from malicious software, This feature allows guests to operate in Intel® Trusted Execution Technology (Intel® maintaining the integrity of the real mode, removing the performance TXT) provides a hardware-based security measured launched environment’s overhead and complexity of an emulator. foundation on which to build and maintain identity. a chain of trust to protect the platform Uses include: • Secret Protection. Intel TXT from software-based attacks. hardware removes residual data • Early VMM load The goal of Intel TXT is to provide an accu- at improper MLE shut-down, protect- • Guest boot and resume rate measurement, at launch, of the meas- ing data from memory snooping ured launch environment (MLE) through the software. Without Intel® VT FlexPriority With Intel VT FlexPriority Figure 1. Reduction of EXITs with Intel® VT FlexPriority 3 Enabling Intel® Virtualization Technology Features and Benefits Intel® VT for Directed I/O (Intel® VT-d) Intel® VT-d is a feature integrated into the This has both pros and cons: In computing, an input/output memory man- chipset and therefore not related to the CPU. agement unit (IOMMU) is a memory manage- Before Intel VT-d and hypervisors supporting it, • Pros: This hides any type of change ment unit (MMU) that connects a digital any VM running on top of a VMM was seeing between the hardware vendors and media adapter (DMA)-capable I/O bus to the emulated, or para-virtualized, devices. Figure 4 makes it possible for VMs to migrate main memory. Like a traditional MMU, which shows how Intel VT-d works. easily. translates CPU-visible virtual addresses to • Cons: Performance takes a hit. This is physical addresses, the IOMMU takes care of No matter what type of hardware was physical- true even if the emulated device is mapping device-visible virtual addresses ly present in the server, the VM itself sees a vir- based on a para-virtualized or synthet- (also called device addresses or I/O address- tualized device. So, for example, on VMware ic driver, either in terms of CPU utiliza- es in this context) to physical addresses. vSphere*, you would typically see a VMXnet* tion, bandwidth, or latency. Some units also provide memory protection network card instead of the real network inter- from misbehaving devices.