DOCSLIB.ORG

How to Virtualize with KVM

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

How to Virtualize with KVM Christian Bornträger <[email protected]> © 2018,2019 IBM Corporation Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtml The following are trademarks or registered trademarks of other companies. ● Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. © 2018,2019 IBM Corporation 2 Agenda ● Overview ● Components and management infrastructure ● Devices ● Performance measurement ● Problem determination ● Usability © 2018,2019 IBM Corporation 3 What is KVM ● KVM is the abbreviation for Kernel-based virtual machine ● It is part of the Linux ecosystem ● KVM is used as a building block in the industry – KVM components are used to build the public clouds ● KVM Forum conference had many participants from Tencent, AliBaba, Yandex, AWS, Google and many more – IBM HyperProtect Services also use KVM components – KVM is used to isolate containers (e.g. Kata containers) – KVM is used as a normal hypervisor instead of VMWare, z/VM, XEN and others © 2018,2019 IBM Corporation 4 How to get KVM ● Red Hat – RHEL 7.6-alt: Kernel 4.14, QEMU 2.12, Libvirt 4.5 – RHEL 8: Kernel 4.18, QEMU 2.12, Libvirt 4.5 ● SLES – SLES 12 SP4: Kernel 4.12, QEMU 2.11, Libvirt 4.0 SLES 15 SP1: Kernel 4.12; QEMU 3.1, Libvirt 5.0 ● Ubuntu – 16.04 LTS : Kernel 4.4, QEMU 2.5, Libvirt 1.3.1 – 18.04 LTS : Kernel 4.15, QEMU 2.11, Libvirt 4.0 © 2018,2019 IBM Corporation 5 How to get KVM ● Red Hat – yum install qemu-kvm libvirt virt-install – do a modprobe kvm (once) ● SLES – zypper install qemu-kvm libvirt virt-manager virt-install ● Ubuntu – apt install qemu-kvm libvirt-daemon libvirt-clients virt-manager © 2018,2019 IBM Corporation 6 ©2018,2019 Corporation IBM components ● ● ● BASE Others Management – – – – – – – – – – – … Openvswitch virt-install Kubevirt libvirt provided lineVirsh command tool tool small management Virtmanager: Openstack: infrastructurebig management Libvirt: base layer management device emulation, QEMU: exploitation,...kvm Linux kernel: kvm module Linux base system .. LINUX kernel LINUX process LINUX process LINUX process HW guest QEMU KVM guest QEMU sie guest QEMU libvirt virtmanager openstack 7 Being a Linux process ● As KVM guests are just normal processes, KVM inherits a huge amount of features from Linux – SMT – Paging – CPU scheduling – ECKD, FCP, NVMe disks – OSA,ROCE,Hipersocket – Multiple subchannel sets – Parallel Access Volumes (PAVs) – Other storage protocols also available (ie: iSCSI, NFS, GFS2, OCFS2, GPFS) – Encryption of guest disks via dmcrypt – ….. © 2018,2019 IBM Corporation 8 Being related to x86 KVM ● As KVM on z shares a lot of code with the x86 variant , KVM inherits a huge amount of features from that – Live guest migration via TCP/IP – Installs can be automated via scripts (AutoYast, KickStart, PreSeed) – Support for both character and graphical consoles – Network IPL – Can emulate modern hardware such as DVDs via ISO files. – Supports live resize of CPUs, networking, and storage devices in both the KVM host and guest virtual servers – Can take snapshots of running virtual machines (not just the disk storage) – With “Copy On Write” storage, snapshots and cloning of virtual servers are near instantaneous – Support for nested virtualization (KVM under KVM) – ... © 2018,2019 IBM Corporation 9 Being on Z provides unique features ● When running on Z the mature hardware support for virtualization makes it easy to provide support – CPACF crypto hardware exploitable by Host and Guests – Guarded Storage for Java Pause-less Garbage Collection – CryptoExpress cards are exploitable by hosts and guests – support for large pages in guest and host © 2018,2019 IBM Corporation 10 Management by libvirt © 2018,2019 IBM Corporation 11 Domain XML <domain type='kvm'> <name>vs1</name> <memory>524288</memory> <vcpu>2</vcpu> <os> <type arch='s390x' machine='s390-ccw-virtio'>hvm</type> </os> <iothreads>1</iothreads> <devices> <disk type='block' device='disk'> <driver name='qemu' type='raw' cache='none' iothread='1' Host io='native'/> <source dev='/dev/disk/by-path/ccw-0.0.1000'/> vs1 <target dev='vda' bus='virtio'/> 512MB </disk> <interface type='direct'> <source dev='bond0' mode='bridge'/> eth0 <model type='virtio'/> vda </interface> <console type='pty'> <target type='sclp'/> </console> </devices> bond0 </domain> Dont worry! Most things can be handled by tools! 0.0.1000 0.0.2000 0.0.3000 © 2018,2019 IBM Corporation 12 Disk storage © 2018,2019 IBM Corporation 13 Disk Storage Options – Guest View ● KVM on Z provides no storage emulation ● Paravirtualized storage provided to the guest using virtio interfaces – Virtual hard disks and CD/DVD drives ● Passthrough of host devices in progress © 2018,2019 IBM Corporation 14 Disk Storage Options – Host Backing ● Image files (raw, QCOW) – Residing in host filesystem – Flexible and space efficient ● Full disks (ECKD, FCP, other SAN) – Requires planning – Best performance ● Network storage (NAS) – Image files stored on NFS, CIFS, ... © 2018,2019 IBM Corporation 15 Disk Storage (virtio) Host <disk type='file' device='disk'> vs1 vs2 vs3 <source file='/var/libvirt/images/img01'/> <driver name='qemu' type='raw' io='native' vda vda vda cache='none' iothread='1'/> <target dev='vda' bus='virtio'/> </disk> <disk type='block' device='disk'> img01 <source dev='/dev/dasda'/> dm-0 img00 <driver name='qemu' type='raw' io='native' cache='none' iothread='1'/> <target dev='vda' bus='virtio'/> </disk> multipath dasda dasdb <disk type='block' device='disk'> <source dev='/dev/dm-0'/> <driver name='qemu' type='raw' io='native' fcp0 fcp1 ficon0 ficon1 cache='none' iothread='1'/> <target dev='vda' bus='virtio'/> </disk> SCSI ECKD ECKD LUN vola volb © 2018,2019 IBM Corporation 16 Networking © 2018,2019 IBM Corporation 17 Networking Options ● KVM guest OS only sees virtio network interfaces ● Virtio interfaces are backed most commonly by – Host interfaces directly using macvtap – Linux bridges – OpenVSwitches ● Host interfaces can be – OSA – Hipersocket – PCI (with limitations) © 2018,2019 IBM Corporation 18 Think Switches Logical View ● Conceptually all network Virtual Server 1 Virtual Server 2 attachments can be viewed as switches VNICs eth0 eth1 eth0 ● Differences in capabilities and characteristics exist though p0 p1 p2 p3 … Switch Ports VLAN 42 VLAN 17 VLAN 42 Virtual Switch up0 …Uplink Bonding I/F bond0 (for HA) Host NICs eth0 eth1 © 2018,2019 IBM Corporation 19 Macvtap as a Switch Implementation View Logical View Virtual Server 1 Virtual Server 2 Virtual Server 1 Virtual Server 2 eth0 eth1 eth0 VNICs eth0 eth1 eth0 p0 p1 p2 p3 … Switch VLAN 42 VLAN 17 VLAN 42 Ports macvtap0@ macvtap1@ macvtap2@ Virtual Switch bond0.17 Bond0.42 Bond0.42 up0 …Uplink bond0.17 bond0.42 bond0 Bonding I/F bond0 (for HA) eth0 eth1 Host NICs eth0 eth1 © 2018,2019 IBM Corporation 20 Macvtap: a More Common Setup Implementation View Logical View Virtual Server 1 Virtual Server 2 Virtual Server 1 Virtual Server 2 eth0 eth0 VNICs eth0 eth0 p0 p1 p2 p3 … Switch Ports Virtual Switch macvtap0@ macvtap1@ bond0 bond0 up0 …Uplink bond0 Bonding I/F bond0 (for HA) eth0 eth1 Host NICs eth0 eth1 © 2018,2019 IBM Corporation 21 Macvtap Characteristics ● No extra setup required ● Fastest connectivity option ● Layer 2 Only ● Can use shared OSAs, hipersockets – But no sharing between migration hosts ● VLAN supported in access mode © 2018,2019 IBM Corporation 22 Linux Bridge as a Switch Implementation View Logical View Virtual Server 1 Virtual Server 2 Virtual Server 1 Virtual Server 2 VNICs eth0 eth1 eth0 eth0 eth1 eth0 tap0 tap1 tap2 p0 p1 p2 p3 … Switch br_vlan17 br_vlan42 VLAN 42 VLAN 17 VLAN 42 Ports Virtual Switch bond0.17 bond0.42 up0 …Uplink bond0 Bonding I/F bond0 (for HA) eth0 eth1 Host NICs eth0 eth1 © 2018,2019 IBM Corporation 23 Linux Bridge: a More Common Setup Implementation View Logical View Virtual Server 1 Virtual Server 2 Virtual Server 1 Virtual Server 2 VNICs eth0 eth0 eth0 eth0 tap0 tap1 p0 p1 p2 p3 … Switch Ports virbr0 Virtual Switch up0 …Uplink bond0 Bonding I/F bond0 (for HA) eth0 eth1 Host NICs eth0 eth1 © 2018,2019 IBM Corporation 24 Linux Bridge Characteristics ● Moderate setup requirements ● Layer 2 Only ● OSA must operate in bridgeport mode – Not shareable between KVM hosts ● Hipersockets must enable VNICC learning and flooding – Shareable between KVM hosts ● VLAN supported in access mode © 2018,2019 IBM Corporation 25 OpenVSwitch IS a Switch Logical View Logical View Virtual Server 1 Virtual Server 2 Virtual Server 1 Virtual Server 2 eth0 eth1 eth0 VNICs eth0 eth1 eth0 tap0 tap1 tap2 p0 p1 p2 p3 p0 p1 p2 p3 … Switch VLAN 42 VLAN 17 VLAN 42 VLAN 42 VLAN 17 VLAN 42 Ports ovsbr0 Virtual Switch up0 up0 …Uplink bond0 Bonding I/F bond0 (for HA) eth0 eth1 Host NICs eth0 eth1 © 2018,2019 IBM Corporation 26 OpenVSwitch Characteristics ● Requires some understanding of switches in general and OVS specifically ● Most flexible ● Layer 2 Only ● OSA must operate in bridgeport mode – Not shareable between KVM hosts ● Hipersockets must enable VNICC learning and flooding – Shareable between KVM hosts ● VLAN supported in access and trunk mode © 2018,2019 IBM Corporation 27 Other devices © 2018 IBM Corporation 28 What else ● virtio-balloon: lightweight memory hotplug ● virtio-random: share hardware random numbers ● Virtio-scsi: use a virtual SCSI HBA to talk to disks and others ● Virtio-vsock: network-less communication between guests<→host ● virtio-9p: file system passthrough ● Virtio-gpu: provide a frame buffer device (useful for VNC to the guest) ● Sclp line mode console ● ….
Recommended publications
  • Effective Virtual CPU Configuration with QEMU and Libvirt

    Effective Virtual CPU Configuration with QEMU and Libvirt

    Effective Virtual CPU Configuration with QEMU and libvirt Kashyap Chamarthy <[email protected]> Open Source Summit Edinburgh, 2018 1 / 38 Timeline of recent CPU flaws, 2018 (a) Jan 03 • Spectre v1: Bounds Check Bypass Jan 03 • Spectre v2: Branch Target Injection Jan 03 • Meltdown: Rogue Data Cache Load May 21 • Spectre-NG: Speculative Store Bypass Jun 21 • TLBleed: Side-channel attack over shared TLBs 2 / 38 Timeline of recent CPU flaws, 2018 (b) Jun 29 • NetSpectre: Side-channel attack over local network Jul 10 • Spectre-NG: Bounds Check Bypass Store Aug 14 • L1TF: "L1 Terminal Fault" ... • ? 3 / 38 Related talks in the ‘References’ section Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications What this talk is not about 4 / 38 Related talks in the ‘References’ section What this talk is not about Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications 4 / 38 What this talk is not about Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications Related talks in the ‘References’ section 4 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) libvirtd QMP QMP QEMU QEMU VM1 VM2 Custom Disk1 Disk2 Appliance ioctl() KVM-based virtualization components Linux with KVM 5 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) libvirtd QMP QMP Custom Appliance KVM-based virtualization components QEMU QEMU VM1 VM2 Disk1 Disk2 ioctl() Linux with KVM 5 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) Custom Appliance KVM-based virtualization components libvirtd QMP QMP QEMU QEMU VM1 VM2 Disk1 Disk2 ioctl() Linux with KVM 5 / 38 libguestfs (guestfish) Custom Appliance KVM-based virtualization components OpenStack, et al.
  • QEMU Parameter Jungle Slides

    QEMU Parameter Jungle Slides

    Finding your way through the QEMU parameter jungle 2018-02-04 Thomas Huth <[email protected]> Legal ● Disclaimer: Opinions are my own and not necessarily the views of my employer ● “Jungle Leaves” background license: CC BY 3.0 US : https://creativecommons.org/licenses/by/3.0/us/ Image has been modified from the original at: https://www.freevector.com/jungle-leaves-vector-background 2 Introduction 3 Why a guide through the QEMU parameter jungle? 4 Why a guide through the QEMU parameter jungle? ● QEMU is a big project, supports lots of emulated devices, and lots of host backends ● 15 years of development → a lot of legacy ● $ qemu-system-i386 -h | wc -l 454 ● People regularly ask about CLI problems on mailing lists or in the IRC channels → Use libvirt, virt-manager, etc. if you just want an easier way to run a VM 5 General Know-How ● QEMU does not distinguish single-dash options from double-dash options: -h = --h = -help = --help ● QEMU starts with a set of default devices, e.g. a NIC and a VGA card. If you don't want this: --nodefaults or suppress certain default devices: --vga none --net none 6 Getting help about the options ● Parameter overview: -h or --help (of course) ● Many parameters provide info with “help”: --accel help ● Especially, use this to list available devices: --device help ● To list parameters of a device: --device e1000,help ● To list parameters of a machine: --machine q35,help 7 e1000 example ● $ qemu-system-x86_64 --device e1000,help [...] e1000.addr=int32 (PCI slot and function¼) e1000.x-pcie-extcap-init=bool (on/off) e1000.extra_mac_registers=bool (on/off) e1000.mac=str (Ethernet 6-byte MAC Address¼) e1000.netdev=str (ID of a netdev backend) ● $ qemu-system-x86_64 --device \ e1000,mac=52:54:00:12:34:56,addr=06.0 8 General Know How: Guest and Host There are always two parts of an emulated device: ● Emulated guest hardware, e.g.: --device e1000 ● The backend in the host, e.g.: --netdev tap Make sure to use right set of parameters for configuration! 9 “Classes” of QEMU parameters ● Convenience : Easy to use, but often limited scope.
  • Many Things Related to Qubesos

    Many Things Related to Qubesos

    Qubes OS Many things Many things related to QubesOS Author: Neowutran Contents 1 Wiping VM 2 1.1 Low level storage technologies .................. 2 1.1.1 Must read ......................... 2 1.1.2 TL;DR of my understanding of the issue ........ 2 1.1.3 Things that could by implemented by QubesOS .... 2 2 Create a Gaming HVM 2 2.1 References ............................. 2 2.2 Prerequise ............................. 3 2.3 Hardware ............................. 3 2.4 Checklist .............................. 4 2.5 IOMMU Group .......................... 4 2.6 GRUB modification ........................ 4 2.7 Patching stubdom-linux-rootfs.gz ................ 5 2.8 Pass the GPU ........................... 6 2.9 Conclusion ............................. 6 2.10 Bugs ................................ 6 3 Create a Linux Gaming HVM, integrated with QubesOS 7 3.1 Goals ................................ 7 3.2 Hardware used .......................... 7 3.3 Main steps summary ....................... 7 3.3.1 Detailled steps ...................... 8 3.3.2 Using a kernel provided by debian ............ 8 3.4 Xorg ................................ 8 3.4.1 Pulseaudio ......................... 11 3.5 Final notes ............................ 11 3.6 References ............................. 12 4 Nitrokey and QubeOS 12 5 Recovery: Mount disk 12 6 Disposable VM 13 6.1 Introduction ............................ 14 6.1.1 References ......................... 14 6.1.2 What is a disposable VM? ................ 14 6.2 Playing online video ....................... 14 6.3 Web browsing ........................... 15 6.4 Manipulating untrusted files/data ................ 16 1 6.5 Mounting LVM image ...................... 17 6.6 Replace sys-* VM ......................... 18 6.7 Replace some AppVMs ...................... 18 7 Building a new QubesOS package 18 7.1 References ............................. 18 7.2 Goal ................................ 18 7.3 The software ............................ 19 7.4 Packaging ............................. 19 7.5 Building .............................
  • QEMU for Xen Secure by Default

    QEMU for Xen Secure by Default

    QEMU for Xen secure by default Deprivileging the PC system emulator Ian Jackson <[email protected]> FOSDEM 2016 with assistance from Stefano Stabellini guest guest Xen PV driver IDE driver Xen PV protocol mmio, dma, etc. qemu Emulated IDE controller Xen PV backend (usually), syscalls (usually) dom0 (usu.dom0) kernel Device driver kernel Device driver PV HVM ... ... ... ... ... from Xen Security Team advisories page, http://xenbits.xen.org/xsa/ Xen on x86 modes, and device model bug implications Current status for users of upstream Xen and distros and future plans Status Device model Notes bugs mean PV Fully supported Safe (no DM) Only modified guests HVM qemu in dom0 Fully supported Vulnerable Current default as root HVM qemu stub DM Upstream but not Safe Ancient qemu qemu-xen-trad. in most distros. Build system problems HVM qemu stub DM In progress Safe Rump build system rump kernel Hard work! is mini distro HVM qemu dom0 Targeting No privilege esc. Defence in depth not as root Xen 4.7 Maybe dom0 DoS Hopefully, will be default Xen on x86 modes, and device model bug implications Current status for users of upstream Xen and distros and future plans Status Device model Notes bugs mean PV Fully supported Safe (no DM) Only modified guests HVM qemu in dom0 Fully supported Vulnerable Current default as root HVM qemu stub DM Upstream but not Safe Ancient qemu qemu-xen-trad. in most distros. Build system problems HVM qemu stub DM In progress Safe Rump build system rump kernel Hard work! is mini distro HVM qemu dom0 Targeting No privilege esc.
  • Hyperlink: Virtual Machine Introspection and Memory Forensic Analysis Without Kernel Source Code Jidong Xiao Boise State University

    Hyperlink: Virtual Machine Introspection and Memory Forensic Analysis Without Kernel Source Code Jidong Xiao Boise State University

    Boise State University ScholarWorks Computer Science Faculty Publications and Department of Computer Science Presentations 1-1-2016 HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code Jidong Xiao Boise State University Lei Lu VMware Inc. Haining Wang University of Delaware Xiaoyun Zhu Futurewei Technologies © 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. doi: 10.1109/ICAC.2016.46 HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code Jidong Xiao∗, Lei Luy, Haining Wangz, Xiaoyun Zhux ∗Boise State University, Boise, Idaho, USA yVMware Inc., Palo Alto, California, USA zUniversity of Delaware, Newark, Delaware, USA xFuturewei Technologies, Santa Clara, California, USA Abstract— Virtual Machine Introspection (VMI) is an ap- nel rootkit detection [8], [9], kernel integrity protection [10], proach to inspecting and analyzing the software running inside a and detection of covertly executing binaries [11]. Being the virtual machine from the hypervisor. Similarly, memory forensics main enabling technology for cloud computing, virtualiza- analyzes the memory snapshots or dumps to understand the tion allows us allocating finite hardware resources among runtime state of a physical or virtual machine. The existing VMI a large number of software systems and programs. As the and memory forensic tools rely on up-to-date kernel information key component of virtualization, a hypervisor runs directly of the target operating system (OS) to work properly, which often requires the availability of the kernel source code.
  • Hardware Virtualization

    Hardware Virtualization

    Hardware Virtualization E-516 Cloud Computing 1 / 33 Virtualization Virtualization is a vital technique employed throughout the OS Given a physical resource, expose a virtual resource through layering and enforced modularity Users of the virtual resource (usually) cannot tell the difference Different forms: Multiplexing: Expose many virtual resources Aggregation: Combine many physical resources [RAID, Memory] Emulation: Provide a different virtual resource 2 / 33 Virtualization in Operating Systems Virtualizing CPU enables us to run multiple concurrent processes Mechanism: Time-division multiplexing and context switching Provides multiplexing and isolation Similarly, virtualizing memory provides each process the illusion/abstraction of a large, contiguous, and isolated “virtual” memory Virtualizing a resource enables safe multiplexing 3 / 33 Virtual Machines: Virtualizing the hardware Software abstraction Behaves like hardware Encapsulates all OS and application state Virtualization layer (aka Hypervisor) Extra level of indirection Decouples hardware and the OS Enforces isolation Multiplexes physical hardware across VMs 4 / 33 Hardware Virtualization History 1967: IBM System 360/ VM/370 fully virtualizable 1980s–1990s: “Forgotten”. x86 had no support 1999: VMWare. First x86 virtualization. 2003: Xen. Paravirtualization for Linux. Used by Amazon EC2 2006: Intel and AMD develop CPU extensions 2007: Linux Kernel Virtual Machines (KVM). Used by Google Cloud (and others). 5 / 33 Guest Operating Systems VMs run their own operating system (called “guest OS”) Full Virtualization: run unmodified guest OS. But, operating systems assume they have full control of actual hardware. With virtualization, they only have control over “virtual” hardware. Para Virtualization: Run virtualization-aware guest OS that participates and helps in the virtualization. Full machine hardware virtualization is challenging What happens when an instruction is executed? Memory accesses? Control I/O devices? Handle interrupts? File read/write? 6 / 33 Full Virtualization Requirements Isolation.
  • Virtualization

    Virtualization

    Virtualization ...or how adding another layer of abstraction is changing the world. CIS 399: Unix Skills University of Pennsylvania April 6, 2009 (CIS 399 Unix) Virtualization April 6, 2009 1 / 22 What is virtualization? Without virtualization: (CIS 399 Unix) Virtualization April 6, 2009 2 / 22 What is virtualization? With virtualization: (CIS 399 Unix) Virtualization April 6, 2009 3 / 22 Why virtualize? (CIS 399 Unix) Virtualization April 6, 2009 4 / 22 Why virtualize? Operating system independence Hardware independence Resource utilization Security Flexibility (CIS 399 Unix) Virtualization April 6, 2009 5 / 22 Virtualization for Users Parallels Desktop and VMware Fusion have brought virtualization to normal computer users. Mostly used for running Windows programs side-by-side with OS X programs. Desktop use has pushed support for: I USB devices I Better graphics performance (3d acceleration) I Integration between the guest and host operating system and applications. (CIS 399 Unix) Virtualization April 6, 2009 6 / 22 Virtualization for Developers Build and test on multiple operating systems with a single computer. Use VM snapshots to provide a consistent testing environment. Run the debugger from outside the virtual machine. I Isolates the debugger and program from each other. I Allows easy kernel debugging. I Snapshotting and record/replay allow you to capture and analyze rare bugs. (CIS 399 Unix) Virtualization April 6, 2009 7 / 22 Virtualization for Business Hardware independence - upgrade hardware without reinstalling software. Resource utilization - turn 10 hosts with 10% utilization into 1 host with 100% utilization. Big power and cooling savings! Migration - move a server to a different machine without shutting it down.
  • Virtualization of Linux Based Computers: the Linux-Vserver Project

    Virtualization of Linux Based Computers: the Linux-Vserver Project

    VirtualizationVirtualization ofof LinuxLinux basedbased computers:computers: thethe LinuxLinux--VServerVServer projectproject BenoBenoîîtt desdes Ligneris,Ligneris, Ph.Ph. D.D. [email protected] Objectives:Objectives: Objectives:Objectives: 1)1) PresentPresent thethe availableavailable programsprograms thatthat cancan provideprovide aa virtualizationvirtualization ofof LinuxLinux computerscomputers withwith differentdifferent technologies.technologies. Objectives:Objectives: 1)1) PresentPresent thethe availableavailable programsprograms thatthat cancan provideprovide aa virtualizationvirtualization ofof LinuxLinux computerscomputers withwith differentdifferent technologies.technologies. 2)2) FocusFocus onon LinuxLinux--VServers:VServers: aa veryvery lightweightlightweight andand effectiveeffective technologytechnology forfor thethe regularregular LinuxLinux useruser notnot interstedintersted inin KernelKernel hacking.hacking. PlanPlan PlanPlan ● IntroductionIntroduction PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria ● ComparativeComparative studystudy ofof thethe existingexisting
  • Draft NISTIR 8221

    Draft NISTIR 8221

    Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date June 5, 2019 Original Release Date September 21, 2018 Superseding Document Status Final Series/Number NISTIR 8221 Title A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data Publication Date June 2019 DOI https://doi.org/10.6028/NIST.IR.8221 CSRC URL https://csrc.nist.gov/publications/detail/nistir/8221/final Additional Information 1 Draft NISTIR 8221 2 3 A Methodology for Determining 4 Forensic Data Requirements for 5 Detecting Hypervisor Attacks 6 7 8 Ramaswamy Chandramouli 9 Anoop Singhal 10 Duminda Wijesekera 11 Changwei Liu 12 13 14 Draft NISTIR 8221 15 16 A Methodology for Determining 17 Forensic Data Requirements for 18 Detecting Hypervisor Attacks 19 20 Ramaswamy Chandramouli 21 Anoop Singhal 22 Duminda Wijesekera 23 Changwei Liu 24 Computer Security Division 25 Information Technology Laboratory 26 27 28 29 30 31 32 33 34 35 36 September 2018 37 38 39 40 41 U.S. Department of Commerce 42 Wilbur L. Ross, Jr., Secretary 43 44 National Institute of Standards and Technology 45 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 46 47 National Institute of Standards and Technology Internal Report 8221 48 27 pages (September 2018) 49 50 51 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 52 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 53 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 54 available for the purpose.
  • Virtualization Technologies Overview Course: CS 490 by Mendel

    Virtualization Technologies Overview Course: CS 490 by Mendel

    Virtualization technologies overview Course: CS 490 by Mendel Rosenblum Name Can boot USB GUI Live 3D Snaps Live an OS on mem acceleration hot of migration another ory runnin disk alloc g partition ation system as guest Bochs partially partially Yes No Container s Cooperati Yes[1] Yes No No ve Linux (supporte d through X11 over networkin g) Denali DOSBox Partial (the Yes No No host OS can provide DOSBox services with USB devices) DOSEMU No No No FreeVPS GXemul No No Hercules Hyper-V iCore Yes Yes No Yes No Virtual Accounts Imperas Yes Yes Yes Yes OVP (Eclipse) Tools Integrity Yes No Yes Yes No Yes (HP-UX Virtual (Integrity guests only, Machines Virtual Linux and Machine Windows 2K3 Manager in near future) (add-on) Jail No Yes partially Yes No No No KVM Yes [3] Yes Yes [4] Yes Supported Yes [5] with VMGL [6] Linux- VServer LynxSec ure Mac-on- Yes Yes No No Linux Mac-on- No No Mac OpenVZ Yes Yes Yes Yes No Yes (using Xvnc and/or XDMCP) Oracle Yes Yes Yes Yes Yes VM (manage d by Oracle VM Manager) OVPsim Yes Yes Yes Yes (Eclipse) Padded Yes Yes Yes Cell for x86 (Green Hills Software) Padded Yes Yes Yes No Cell for PowerPC (Green Hills Software) Parallels Yes, if Boot Yes Yes Yes DirectX 9 Desktop Camp is and for Mac installed OpenGL 2.0 Parallels No Yes Yes No partially Workstati on PearPC POWER Yes Yes No Yes No Yes (on Hypervis POWER 6- or (PHYP) based systems, requires PowerVM Enterprise Licensing) QEMU Yes Yes Yes [4] Some code Yes done [7]; Also supported with VMGL [6] QEMU w/ Yes Yes Yes Some code Yes kqemu done [7]; Also module supported

  • KVM: Linux-Based Virtualization

    KVM: Linux-based Virtualization Avi Kivity [email protected] Columbia University Advanced OS/Virtualization course Agenda Quick view Power management Features Non-x86 KVM Execution loop Real time Memory management Xenner Linux Integration Community Paravirtualization Conclusions I/O Copyright © 2007 Qumranet, Inc. All rights reserved. At a glance KVM – the Kernel-based Virtual Machine – is a Linux kernel module that turns Linux into a hypervisor Requires hardware virtualization extensions Supports multiple architectures: x86 (32- and 64- bit) s390 (mainframes), PowerPC, ia64 (Itanium) Competitive performance and feature set Advanced memory management Tightly integrated into Linux 3 Copyright © 2007 Qumranet, Inc. All rights reserved. The KVM approach Reuse Linux code as much as possible Focus on virtualization, leave other things to respective developers Integrate well into existing infrastructure, codebase, and mindset Benefit from semi-related advances in Linux Copyright © 2007 Qumranet, Inc. All rights reserved. VMware Console User User User VM VM VM VM Hypervisor Driver Driver Driver Hardware Copyright © 2007 Qumranet, Inc. All rights reserved. Xen User User User Domain 0 VM VM VM Driver Driver Hypervisor Driver Hardware Copyright © 2007 Qumranet, Inc. All rights reserved. KVM Ordinary LinuxOrdinary User User User Ordinary ProcessLinux VM VM VM ProcessLinux Process KVM Modules Linux Driver Driver Driver Hardware Copyright © 2007 Qumranet, Inc. All rights reserved. KVM model enefits Reuse scheduler, memory management, bringup Reuse Linux driver portfolio Reuse I/O stack Reuse management stack Copyright © 2007 Qumranet, Inc. All rights reserved. KVM Process Model task task guest task task guest kernel 9 Copyright © 2007 Qumranet, Inc. All rights reserved. KVM Execution Model Three modes for thread execution instead of the traditional two: User mode Kernel mode Guest mode A virtual CPU is implemented using a Linux thread The Linux scheduler is responsible for scheduling a virtual cpu, as it is a normal thread 10 Copyright © 2007 Qumranet, Inc.
  • Using QEMU to Build and Deploy Virtual Machines (Vms) from Scratch on Ubuntu 10.04 LTS

    Using QEMU to Build and Deploy Virtual Machines (Vms) from Scratch on Ubuntu 10.04 LTS

    GOV Cloud Comp Labs Using QEMU to Build a Virtual Machine from Scratch on Ubuntu 10.04 LTS v1.1 Global Open Versity Cloud Computing Hands-on Labs Training Manual Using QEMU to Build and Deploy Virtual Machines (VMs) from Scratch on Ubuntu 10.04 LTS Kefa Rabah Global Open Versity, Vancouver Canada [email protected] www.globalopenversity.org Table of Contents Page No. USING QEMU TO BUILD AND DEPLOY VIRTUAL MACHINES (VMS) FROM SCRATCH ON UBUNTU 10.04 LTS 2 1.0 Introduction 2 Hands-On Labs Session 3 Part 1: Using QEMU to create VM locally on UI: 3 Step 1: Install Pre-requisite Packages 3 Step 2: Preparation of the QEMU Virtual Environment 4 Step 3: VM Contextualization 4 Step 4: Run & Install your Distro of an Operating Systems from ISO to the QEMU Environment 5 Step 5: Shutdown the your DSL Virtual Machine 10 Part 2: Optional - System with HVM Capability 11 Part 3: Troubleshooting VM Installation “pxe-rtl8139.bin” Error 12 Part 4: Need More Training on Linux: 12 Ubuntu Server Administration Training 12 Cloud Computing Training 13 Part 5: Hands-on Labs Assignments 13 Other Related Articles & Hands-on Lab Manuals References: 13 http://creativecommons.org/licenses/by-nc-sa/3.0/ A GOV Open Access Technical Academic Publications Enhancing education & empowering people worldwide through eLearning in the 21st Century 1 April 2007, Kefa Rabah, Global Open Versity, Vancouver Canada www.globalopenversity.org GOV - High Performance Computing Labs GOV Cloud Comp Labs Using QEMU to Build a Virtual Machine from Scratch on Ubuntu 10.04 LTS v1.1 Global Open Versity Cloud Computing Hands-on Labs Training Manual Using QEMU to Build and Deploy Virtual Machines (VMs) from Scratch on Ubuntu 10.04 LTS By Kefa Rabah, [email protected] Aug 15, 2010 GTS Institute 1.0 Introduction QEMU is a fast processor emulator.