Tuesday, May 26, 2015

How to check for Second Level Address Translation with Powershell

Not so long ago Microsoft added Client Hyper-V virtualization technology to its last OS, Windows 8. This move has given ITPros and developers like me the possibility to test the Hyper-V technology on their laptops and build test infrastructures aimed at learning, making demos and developing management scripts.

Now, most of the requirements to run the Hyper-V Client on your Windows 8.1 laptop are pretty simple to check. You need to own a 64-bit Pro or Enterprise version of Microsoft Windows, 4 GB of RAM and a processor (either AMD or Intel) with 64-bit wide registers. All of these requirement are easy to check.

There is one more requirement which is harder to check and to understand: your processor must, I repeat, MUST be able to perform Second Level Address Translation (SLAT).

What is that?

POPEK AND GOLDBERG AND THE DIFFICULTY OF VIRTUALISING X86

It's a long story that starts way back in 1964, when virtualization was born with the arrival of the first IBM/360 mainframe and a lot of efforts were put into optimizing environments upon which enterprises could rely . In 1974, when virtualization was already a pretty widely applied technique in the world of mainframe computing, computer scientists  Gerald J. Popek and Robert P. Goldberg published the three principles of computer virtualization we all know today:
  • fidelity/equivalence
  • safety/resource control
  • performance/efficiency
They basically mean that the executed virtual machine must be able to run as fast as a physical machine, act in the same way of a physical machine and never get out of the control of the virtual machine monitor (VMM).

Requirements for a virtual machine
(extract from 'Formal requirements for virtualizable third generation architectures'
by Popek and Goldberg
1974)
These three requirements were extremely hard to respect, largely because of the inner nature of x86 processors, which copes badly (read: doesn't cope at all) with the trap-and-emulate schema.

FROM BINARY TRANSLATION TO SLAT

Through Binary Translation, Shadow Page Tables and I/O Device Emulation, scientists achieved x86 virtualization in the late 1990s, and the company named VMWare was founded in 1998.

Nonetheless, performance stayed a issue for many years, and many administrators did not want server virtualization for some specific workloads and especially for SQL. That's why virtualizing SQL Server was once unheard of, and it's still refused by old style DBAs.

Here's where SLAT comes in. And it will make your DBAs change their mind.

SECOND LEVEL ADDRESS TRANSLATION
 
SLAT is a mechanism that enables the CPU to keep the mapping between the VM virtual memory (known as Guest Virtual Address, or GVA), the VM physical memory (aka GPA, or Guest Physical Address) and the physical memory in the virtualization host (aka System Physical Address, or SPA).
 
So, since the translation is done in the processor, the hypervisor processing overhead is significantly reduced.

There are many virtualization gurus out there explaining the ins and outs of SLAT as well as the advantages of this technology over older memory translation mechanisms. The important concept to grasp is that the goal of the Secondary Level Address Translation is to increase performance of your virtual machines by adding a new improved memory management capability inside the processors.

The third requirement of Popek and Goldberg is fulfilled. Virtual machines have finally become efficient and Microsoft is forcing us to take advantage of the most recent technology achievements by making SLAT mandatory.

HOW TO CHECK FOR SLAT
 
Now, which is the way to check for SLAT support on your computer? Powershell is one of the answers. There are others of course, like the small but powerful utility named Coreinfo (by Mark Russinovich), which if used in conjunction with the -v parameter dumps virtualization-related features including support for second level address translation.

Coreinfo must be launched with admin rights on Intel platforms otherwise you'll get the following message:

.\Coreinfo.exe -v

Coreinfo v3.31 - Dump information on system CPU and memory topology
Copyright (C) 2008-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Intel(R) Core(TM)2 Duo CPU     T7500  @ 2.20GHz
Intel64 Family 6 Model 15 Stepping 11, GenuineIntel
Microcode signature: 000000BA

Administrator rights are required to query Intel virtualization support.
So, right-click your Powershell icon, Run as administrator and get the desired information:

.\Coreinfo.exe -v

Coreinfo v3.31 - Dump information on system CPU and memory topology
Copyright (C) 2008-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Intel(R) Core(TM)2 Duo CPU     T7500  @ 2.20GHz
Intel64 Family 6 Model 15 Stepping 11, GenuineIntel
Microcode signature: 000000BA
HYPERVISOR      -       Hypervisor is present
VMX             *       Supports Intel hardware-assisted virtualization
EPT             -       Supports Intel extended page tables (SLAT)
In my case the laptop I am using has support for VMX, as indicated by the '*' in the output, but doesn't support EPT (which is the Intel acronym for SLAT), as indicated by the '-' in the output.
 
If I run the same tiny utility on a more recent processor I get a positive answer:

.\Coreinfo.exe -v

Coreinfo v3.31 - Dump information on system CPU and memory topology
Copyright (C) 2008-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

Intel(R) Celeron(R) CPU G530 @ 2.40GHz
Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
Microcode signature: 00000028
HYPERVISOR      -       Hypervisor is present
VMX             *       Supports Intel hardware-assisted virtualization
EPT             *       Supports Intel extended page tables (SLAT)

ENTER POWERSHELL

But why lose time installing legacy exes when you have Powershell? With Powershell you can easily check for this SLAT information:

(Get-CimInstance Win32_Processor) | Format-List Name,SecondLevelAddressTranslationExtensions


Name                                    : Intel(R) Celeron(R) CPU G530 @ 2.40GHz
SecondLevelAddressTranslationExtensions : True
Just remember that the SecondLevelAddressTranslationExtensions property is supported starting from Windows 8/2012, so the cmdlet won't work on older versions of Windows.

Other virtualization-related properties you should check when thinking of implementing Hyper-V on your laptop are:
  • VirtualizationFirmwareEnabled
  • VMMonitorModeExtensions
  • DataExecutionPrevention
MAKING A TOOL

The whole requirement check could be consolidated in a simple re-usable function:

function Check-HyperV{

    <#

    .SYNOPSIS

    Checks Hyper-V requirements

    .DESCRIPTION

    This check processor compatibility with Hyper-V

    .PARAMETER ComputerName

    A computer name.

    .EXAMPLE

    Check-HyperV -ComputerName server01

    #> 

    [CmdletBinding()]

    param(

        [Parameter(Mandatory=$True,ValueFromPipeline=$True)][string[]]$ComputerName,

        [switch]$detailed

        )

        foreach($computer in $computername){

            try{

                $ComputerInfo = Get-CimInstance Win32_Computersystem -ComputerName $computer

                $ProcInfo = Get-CimInstance Win32_Processor -ComputerName $computer

                $OsInfo = Get-CimInstance Win32_Operatingsystem -ComputerName $computer

                $VirtualizationInfo = [ordered]@{

               OSArchitecture = $OsInfo.OSArchitecture

               TotalPhysicalMemory=[math]::Round($ComputerInfo.TotalPhysicalMemory/1gb)

               SLAT = $ProcInfo.SecondLevelAddressTranslationExtensions;

               VirtualizationFirmwareEnabled = $ProcInfo.VirtualizationFirmwareEnabled;

               VMMonitorModeExtensions = $ProcInfo.VMMonitorModeExtensions;

               DEP= $OsInfo.DataExecutionPrevention_available

               }

                }

            catch{

                Write-Warning "$computer failed!"

                $ErrorHappened = $True

                }

            if(!$ErrorHappened){

                if($detailed)

                    {

                    $VirtualizationInfo

                    }

                " "

                if(

                    ($VirtualizationInfo.OSArchitecture -eq '64-bit') -and

                    ($VirtualizationInfo.TotalPhysicalMemory -ge 4) -and

                    ($VirtualizationInfo.SLAT) -and

                    ($VirtualizationInfo.VirtualizationFirmwareEnabled) -and

                    ($VirtualizationInfo.VMMonitorModeExtensions) -and

                    ($VirtualizationInfo.DEP)

                  )

                    {"Hyper-V requirements filled on  $Computer!"}

                else

                    {"Time to replace $Computer..."}

                ""

                }

     }

}

Check-HyperV srv01,srv02 -detailed
I hope you have enjoyed this blog post and learned some Powershell as well as some important pieces of the history of IT, which is so easily forgotten. Do not hesitate to comment on the subject as well to correct me if I am wrong or unclear.

Be kind, share!

UPDATE 27 nov 2015

There is an additional method to check for Hyper-V requirements, based on both systeminfo and PowerShell: 
systeminfo | select -last 4
Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
                           Virtualization Enabled In Firmware: No
                           Second Level Address Translation: Yes
                           Data Execution Prevention Available: Yes

No comments:

Post a Comment

Related Posts Plugin for WordPress, Blogger...