I/O virtualization is utilized by cloud platforms to provide tenants with efficient, scalable, and manageable network and storage services. The de-facto industrial standard, paravirtualization, offers rich cloud functionality by introducing split front-end and back-end drivers in the guest and host operating systems, respectively. Given this fact, paravirtualization incurs host inefficiency and performance overhead. Thus, emerging hardware virtio accelerators (i.e., SRIOV-capable devices that conform to virtio specification) with device passthrough technologies mitigate the performance issue. However, adopting these devices presents the challenge of insufficient support for live migration.This paper proposes Un-IOV, a novel I/O virtualization system that simultaneously achieves bare-metal level I/O performance and migratability. The key idea is to develop a new hybrid virtualization stack with: (1) a host-bypassed direct data path for virtio accelerators, and (2) a relayed control path guaranteeing seamless live migration support. Un-IOV achieves high scalability by consuming minimum host resources. Extensive experiment results demonstrate that Un-IOV achieves superior network and storage virtualization performance than software implementations with comparable performance of direct passthrough I/O virtualization, while imposing zero guest modification (i.e., guest transparency).

Emerging network-attached resource disaggregation architecture requires ultra-low latency rack-scale communication. However, current hardware offloading (e.g., RDMA) and user-space (e.g., mTCP) communication schemes still rely on heavily layered protocol stacks which requires the translation between PCIe bus and network protocol, or complex connection/memory resource management within RNICs, inevitably bringing latency overhead.

With the rapid deployment of cloud services and the transformation of traditional on-prem services, e.g., infrastructure, platform, and security, to cloud platforms, the demand for High Availability for cloud services is essential. The growth of compute services through cloud platforms can no longer be met via standard resource provisioning techniques, which includes resources such as compute devices, network devices, etc. Device virtualization is key for cloud resource allocation. Even with the continued adoption of workload containerization, the requirement of domain isolation and the flexibility of service provisioning, containerization within a Virtual Machine is the preferred cloud deployment model. In this paper, we present the design of a live network device update mechanism, e.g., driver and firmware, through a host managed device emulation interface for services deployed on a cloud compute platform. This design does not require scheduled shutdowns of the cloud server, nor does it require hardware redundancy for a system administrator to perform driver and/or firmware maintenance updates. The innovative design presented in this paper enables dynamic resource sharing based upon the service requirements, e.g., failover switching time and network throughput, between the target devices to be updated along with other network devices either in service or on standby. A live networking device mechanism reduces compute service interruption and provides a transparent network function transition between the target interfaces and the failover interfaces.

As SDN-based networking infrastructure continues to evolve, an increasing number of traditional network functions are deployed over virtualized networks. Similar to fixed function switching networks, traffic monitoring in a Software Defined Network is critical in order to ensure the security and performance of the underlying infrastructure. In the context of virtualized networks, deployment of a virtualized TAP service has been reported as an effective VNF that can provide the same monitoring capabilities as a physical TAP. For most virtual switch implementations, e.g., OvS, network device virtualization is based upon a para-virtualization technology, i.e., VIRTIO. One of the primary use cases for port mirroring is inter-VM communication, i.e., packet streams that exist between virtual network devices, which remains prohibitively expensive for TAP devices. Specifically, it has been observed that virtual TAPs can contribute up to 70% performance degradation to the source VNF(s). With reference to prior work, we previously presented a feasibility study that included a novel approach towards the reduction of port-mirroring overhead. In this paper we present our latest contributions, in which we integrate our design into OvS and develop a VLAN based filtering scheme to pass traffic from a source device to a monitoring device. In this case, both devices may reside either within the same or different switch domains. Furthermore, we present an improvement over RSPAN and discuss its feasibility in delivering mirrored traffic across switch domains, which, in contrast to ERSPAN, does not require an L3 overlay network.

As SDN-based networking infrastructure continues to evolve, an increasing number of traditional network functions are deployed over virtualized network. Like traditional networks, traffic monitoring in a Software Defined Network is critical in order to ensure security and performance of the underlying infrastructure. In the context of virtualized networks, deployment of a virtualized TAP service has been reported as an effective VNF that can provide the same monitoring capabilities as a physical TAP. Unfortunately, over a para-virtualization environment, e.g. OVS, where inter-VM communication is expensive it has been observed that virtual TAPs can contribute up to 70% performance degradation. In this paper, we present a hybrid approach that allows network administrators to mirror VIRTIO port traffic to another VF (SR-IOV) via NIC hardware offloading. As a result, the mirrored traffic can be viewed through a monitoring VNF in a separate VM. Through this approach, the throughput overhead can be reduced by as much as 50%.

Virtualization has been widely used as a key technology in cloud computing. Although facilitating the deployment of applications, virtualization introduces huge processing overheads, among which is network I/O virtualization that has become a critical bottleneck of a virtual system. DPDK-vhost is currently the fastest para-virtualized network I/O backend, however it performs poorly when exchanging large packets between virtual machines. Its inefficiency comes from packet copying involved in packet transmission. A zero-copy solution was proposed in the literature to eliminate packet copying by use of shared memory, but it violates the isolation principle of virtual machines. This paper presents a zero-copy vhost design that eliminates packet copying by modifying the extended page tables (EPTs), and meanwhile keeps virtual machines isolated. A prototype adapted from DPDK-vhost is implemented in QEMU/KVM environment, and its performance is verified by experiments to be much higher than that of DPDK-vhost when large packets are transmitted.