一句话：提出 BM-Hive，用 PCIe 计算板在单台服务器上承载最多 16 个硬件隔离的裸金属租户
虚拟化是 IaaS 云的基础，但多租户共享物理服务器带来侧信道等安全风险，并引入 CPU、内存和 I/O 开销。现有单租户裸金属云虽提供强隔离、硬件直通和可预测性能，却存在扩展性差、成本效率低、租出后难以控制等问题。本文提出高密度多租户裸金属云 BM-Hive：每个裸金属 guest 运行在独立的 PCIe 扩展计算板上，该板带有专用 CPU 和内存模块；同时设计软硬件混合 virtio I/O 系统，使 guest 可直接访问云网络和存储服务。BM-Hive 在单台物理服务器中最多承载 16 个裸金属 guest，并在硬件层面严格隔离租户。该系统已部署于大型公有云，同时服务数万用户；评估表明其性能优于 VM。
Virtualization is the cornerstone of the infrastructure-as-a-service (IaaS) cloud, where VMs from multiple tenants share a single physical server. This increases the utilization of data-center servers, allowing cloud providers to provide cost-efficient services. However, the multi-tenant nature of this service leads to serious security concerns, especially in regard to side-channel attacks. In addition, virtualization incurs non-negligible overhead in the performance of CPU, memory, and I/O. To this end, the bare-metal cloud has become an emerging type of service in the public clouds, where a cloud user can rent dedicated physical servers. The bare-metal cloud provides users with strong isolation, full and direct access to the hardware, and more predicable performance. However, the existing single-tenant bare-metal service has poor scalability, low cost efficiency, and weak adaptability because it can only lease entire physical servers to users and have no control over user programs after the server is leased. In this paper, we propose the design of a new high-density multi-tenant bare-metal cloud called BM-Hive. In BM-Hive, each bare-metal guest runs on its own compute board, a PCIe extension board with the dedicated CPU and memory modules. Moreover, BM-Hive features a hardware-software hybrid virtio I/O system that enables the guest to directly access the cloud network and storage services. BM-Hive can significantly improve the cost efficiency of the bare-metal service by hosting up to 16 bare-metal guests in a single physical server. In addition, BM-Hive strictly isolates the bare-metal guests at the hardware level for better security and isolation. We have deployed BM-Hive in one of the largest public cloud infrastructures. It currently serves tens of thousands of users at the same time. Our evaluation of BM-Hive demonstrates its strong performance over VMs.
DOI 原文 ·
@inproceedings{paperbot5431,
title = {High-density Multi-tenant Bare-metal Cloud},
author = {Xiantao Zhang and Xiao Zheng and Zhi Wang and Hang Yang and Yibin Shen and Xin Long},
booktitle = {ASPLOS},
year = {2020},
doi = {10.1145/3373376.3378507}
}