DOCSLIB.ORG

Curs 8 Virtualizare Nativ˘A

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Curs 8 Virtualizare Nativ˘A Curs 8 Virtualizare nativ˘a Servicii avansate pentru ISP 24 aprilie 2017 SAISP Curs 8, Virtualizare nativ˘a 1/37 Outline Introducere KVM KVM s, i libvirt Concluzii ^Intreb˘ari SAISP Curs 8, Virtualizare nativ˘a 2/37 Virtualizare I abstractizarea resurselor unui sistem de calcul I memorie virtual˘a I mas, ini virtuale I emulare I virtualizarea stoc˘arii I system virtual machine I process virtual machine SAISP Curs 8, Virtualizare nativ˘a 3/37 I paravirtualizare (paravirtualization) I virtualizare la nivelul sistemului de operare (operating-system level virtualization) I Cu ce difer˘avirtualizarea de emulare? I la virtualizare, cea mai mare parte a instruct, iunilor se execut˘a pe sistemul fizic I se poate emula o arhitectur˘adiferit˘ade arhitectura sistemului fizic I hypervisor I hosted virtualization (type 2 hypervisor) I bare metal virtualization (type 1 hypervisor) Tipuri de virtualizare I virtualizare complet˘a(full-virtualization) I virtualizare asistat˘ahardware (hardware-assisted virtualization) SAISP Curs 8, Virtualizare nativ˘a 4/37 I virtualizare la nivelul sistemului de operare (operating-system level virtualization) I Cu ce difer˘avirtualizarea de emulare? I la virtualizare, cea mai mare parte a instruct, iunilor se execut˘a pe sistemul fizic I se poate emula o arhitectur˘adiferit˘ade arhitectura sistemului fizic I hypervisor I hosted virtualization (type 2 hypervisor) I bare metal virtualization (type 1 hypervisor) Tipuri de virtualizare I virtualizare complet˘a(full-virtualization) I virtualizare asistat˘ahardware (hardware-assisted virtualization) I paravirtualizare (paravirtualization) SAISP Curs 8, Virtualizare nativ˘a 4/37 I la virtualizare, cea mai mare parte a instruct, iunilor se execut˘a pe sistemul fizic I se poate emula o arhitectur˘adiferit˘ade arhitectura sistemului fizic I hypervisor I hosted virtualization (type 2 hypervisor) I bare metal virtualization (type 1 hypervisor) Tipuri de virtualizare I virtualizare complet˘a(full-virtualization) I virtualizare asistat˘ahardware (hardware-assisted virtualization) I paravirtualizare (paravirtualization) I virtualizare la nivelul sistemului de operare (operating-system level virtualization) I Cu ce difer˘avirtualizarea de emulare? SAISP Curs 8, Virtualizare nativ˘a 4/37 Tipuri de virtualizare I virtualizare complet˘a(full-virtualization) I virtualizare asistat˘ahardware (hardware-assisted virtualization) I paravirtualizare (paravirtualization) I virtualizare la nivelul sistemului de operare (operating-system level virtualization) I Cu ce difer˘avirtualizarea de emulare? I la virtualizare, cea mai mare parte a instruct, iunilor se execut˘a pe sistemul fizic I se poate emula o arhitectur˘adiferit˘ade arhitectura sistemului fizic I hypervisor I hosted virtualization (type 2 hypervisor) I bare metal virtualization (type 1 hypervisor) SAISP Curs 8, Virtualizare nativ˘a 4/37 Virtualizare nativ˘a I Native virtualization I hardware-assisted virtualization I accelerated virtualization I hardware virtual machine I native virtualization I asigur˘afull virtualization I x86 nu avea suport de virtualizare complet˘a I Intel VT-x, AMD-V I Xen 3.x, KVM, Hyper-V, ESXi/vSphere SAISP Curs 8, Virtualizare nativ˘a 5/37 I ulterior, un mecanism pentru virtualizarea memoriei I EPT (Extended Page Tables) - Intel I NPT (Nested Page Tables) - AMD I nu toate platformele au suport pentru EPT/NPT I se emuleaz˘aacolo unde nu exist˘a I performante mai sc˘azute I grep -E '(nptjept)' /proc/cpuinfo Virtualizare nativ˘a(2) I lscpu, variabila Virtualization I grep -E '(vmxjsvm)' /proc/cpuinfo I posibil s˘afie nevoie de activarea suportului din BIOS I virtualizare doar la nivelul procesorului SAISP Curs 8, Virtualizare nativ˘a 6/37 I nu toate platformele au suport pentru EPT/NPT I se emuleaz˘aacolo unde nu exist˘a I performante mai sc˘azute I grep -E '(nptjept)' /proc/cpuinfo Virtualizare nativ˘a(2) I lscpu, variabila Virtualization I grep -E '(vmxjsvm)' /proc/cpuinfo I posibil s˘afie nevoie de activarea suportului din BIOS I virtualizare doar la nivelul procesorului I ulterior, un mecanism pentru virtualizarea memoriei I EPT (Extended Page Tables) - Intel I NPT (Nested Page Tables) - AMD SAISP Curs 8, Virtualizare nativ˘a 6/37 Virtualizare nativ˘a(2) I lscpu, variabila Virtualization I grep -E '(vmxjsvm)' /proc/cpuinfo I posibil s˘afie nevoie de activarea suportului din BIOS I virtualizare doar la nivelul procesorului I ulterior, un mecanism pentru virtualizarea memoriei I EPT (Extended Page Tables) - Intel I NPT (Nested Page Tables) - AMD I nu toate platformele au suport pentru EPT/NPT I se emuleaz˘aacolo unde nu exist˘a I performante mai sc˘azute I grep -E '(nptjept)' /proc/cpuinfo SAISP Curs 8, Virtualizare nativ˘a 6/37 Xen I dezvoltat init, ial la University of Cambridge I suport veritabil ^ınnucleul Linux (dom0) de la v2.6.37 (Xen 4.1) I paravirtualizare I hardware-assisted virtualization de la Xen 3.0.2 ^ınsus I Xen Source, Citrix I Guest OS: Linux, Windows, NetBSD SAISP Curs 8, Virtualizare nativ˘a 7/37 Microsoft Hyper-V I lansat prima oar˘a^ın2008, ^ıncadrul Windows 8 I produs stand-alone (Microsoft Hyper-V Server 2008/2012) I rol instalabil I Windows Server 2008 (R2) I Windows Server 2012 (R2) I procesoare x86-64 I suport de virtualizare hardware SAISP Curs 8, Virtualizare nativ˘a 8/37 Microsoft Hyper-V - features I Live Migration I Cluster Shared Volumes I Hot Add Storage I Virtual Networking (jumbo frames) I High Availability I Management folosind Microsoft System Center I Virtual Machine Manager SAISP Curs 8, Virtualizare nativ˘a 9/37 VMware ESX/ESXi I ruleaz˘adirect peste hardware I foloseste un kernel de Linux propriu (vmkernel) I gratuit pentru desc˘arcare I VMware afirm˘ac˘a vmkernel este un microkernel I ESX contine cu consola de management I nu mai exist˘asuport de la versiunea 5.0 pentru ESX I ESXi a ajuns la versiunea 6.0 si este singurul pentru care se asigur˘asuport I se poate configura folosind VMware vSphere Client I suport˘alive migration (vMotion) SAISP Curs 8, Virtualizare nativ˘a 10/37 VMware vSphere I nume de produs I contine hypervisor-ul ESXi I contine feature-uri suplimentare (e.g. migrarea storage-ului) I include si un server de vCenter I vCenter este aplicatia de management centralizat I echivalent cu Microsoft System Center SAISP Curs 8, Virtualizare nativ˘a 11/37 Outline Introducere KVM KVM s, i libvirt Concluzii ^Intreb˘ari SAISP Curs 8, Virtualizare nativ˘a 12/37 I bhyve I inclus ^ınnucleu ^ınfebruarie 2007, v2.6.20 I dezvoltat de Qumranet, cump˘aratde RedHat ^ın2008 I folosit implicit de RHEL > 5.4 KVM I Kernel-based Virtual Machine I x86, x86-64, PowerPC, IA-64, ARM I portat pe FreeBSD (proiect abandonat) I au ^ınceputs˘adezvolte propriul hypervisor SAISP Curs 8, Virtualizare nativ˘a 13/37 KVM I Kernel-based Virtual Machine I x86, x86-64, PowerPC, IA-64, ARM I portat pe FreeBSD (proiect abandonat) I au ^ınceputs˘adezvolte propriul hypervisor I bhyve I inclus ^ınnucleu ^ınfebruarie 2007, v2.6.20 I dezvoltat de Qumranet, cump˘aratde RedHat ^ın2008 I folosit implicit de RHEL > 5.4 SAISP Curs 8, Virtualizare nativ˘a 13/37 Emulare I foloses, te /dev/kvm pentru pentru configurarea spat, iului de adres˘as, i a dispozitivelor I/O I foloses, te QEMU pentru configurare I user-ul care va porni masina virtual˘atrebuie s˘aaib˘aacces la /dev/kvm I uzual se ad˘aug˘a^ıngrupul din care face parte /dev/kvm SAISP Curs 8, Virtualizare nativ˘a 14/37 Intern I virtualized CPU & memory I modulul kvm.ko { core infrastructure I modulele specifice procesorului kvm-intel.ko, kvm-amd.ko I posibil s˘anecesit˘aconfigur˘ariBIOS de activare a suportului de virtualizare hardware I virtualized I/O (network, disk, video, cdrom) I qemu SAISP Curs 8, Virtualizare nativ˘a 15/37 Instalare I apt-get install qemu-kvm libvirt-bin virtinst virt-top I qemu-kvm: is the new name for the kvm package in squeeze I modprobe -l 'kvm*': kvm, kvm-amd, kvm-intel I adduser YourUserName kvm SAISP Curs 8, Virtualizare nativ˘a 16/37 Creare mas, in˘avirtual˘asimpl˘a I qemu-img create -f qcow2 virtualdisk.qcow2 10G I qemu-img info virtualdisk.qcow2 I kvm -hda virtualdisk.qcow2 -cdrom cdrom.iso -m 256 I ,,pe vremuri" se folosea comanda qemu-kvm I dac˘ase ^ınlocuies, te kvm cu qemu se foloses, te QEMU, f˘ar˘a ,,accelerarea" dat˘ade kvm I ^ınmod implicit se foloses, te ,,user networking", o form˘a simplificat˘a(stiv˘a^ınuser space) SAISP Curs 8, Virtualizare nativ˘a 17/37 I pentru flexibilitate se poate folosi optiunea -drive option[,option[,option[,...]]] I pentru disc: -drive file=file,index=0,media=disk I pentru cdrom: -drive file=file,index=2,media=cdrom Selectarea discului I specificarea discului se face cu -hda,-hdb,-hdc,-hdd I specificarea cdrom-ului se face cu -cdrom SAISP Curs 8, Virtualizare nativ˘a 18/37 Selectarea discului I specificarea discului se face cu -hda,-hdb,-hdc,-hdd I specificarea cdrom-ului se face cu -cdrom I pentru flexibilitate se poate folosi optiunea -drive option[,option[,option[,...]]] I pentru disc: -drive file=file,index=0,media=disk I pentru cdrom: -drive file=file,index=2,media=cdrom SAISP Curs 8, Virtualizare nativ˘a 18/37 Virtualizarea discului - imagini qcow2 I format folosit de QEMU pentru imagini de mas, ini virtuale I cel˘alaltformat este raw I copy-on-write I util pentru dezvoltare s, i testare sau pentru scenarii ^ıncare ai nevoie de mai multe mas, ini virtuale I imaginea init, ial˘aeste nealterat˘a I se creeaz˘aextensii qcow2 pentru fiecare mas, in˘avirtual˘a I imaginea init, ial˘ase numes, te, ^ınacest caz, template SAISP Curs 8, Virtualizare nativ˘a 19/37 Creare imagini qcow2 I qemu-img create -f qcow2 -b winxp.qcow2 winxp-test.qcow2 I imaginea winxp.qcow2 va r˘am^anenealterat˘a(read-only) I imaginea winxp-test.qcow2 va fi transmis˘aca argument pentru pornirea mas, inii virtuale I orice operat, ie de scriere ^ıncadrul imaginii de baz˘arezult˘a^ın actualizarea imaginii celei noi SAISP Curs 8, Virtualizare nativ˘a 20/37 I interfat, a virtual˘adin GuestOS I -device TYPE,netdev=NAME I -device ? I tipul device-ului default depinde de utilitar (qemu sau qemu-kvm) I entitatea de la cel˘alalcap˘at(interfat˘avirtual˘a^ınhypervisor) I -netdev TYPE,id=NAME,..
Load more

Recommended publications
  • Institutionalizing Freebsd Isolated and Virtualized Hosts Using Bsdinstall(8), Zfs(8) and Nfsd(8)
    Institutionalizing FreeBSD Isolated and Virtualized Hosts Using bsdinstall(8), zfs(8) and nfsd(8) [email protected] @MichaelDexter BSDCan 2018 Jails and bhyve… FreeBSD’s had Isolation since 2000 and Virtualization since 2014 Why are they still strangers? Institutionalizing FreeBSD Isolated and Virtualized Hosts Using bsdinstall(8), zfs(8) and nfsd(8) Integrating as first-class features Institutionalizing FreeBSD Isolated and Virtualized Hosts Using bsdinstall(8), zfs(8) and nfsd(8) This example but this is not FreeBSD-exclusive Institutionalizing FreeBSD Isolated and Virtualized Hosts Using bsdinstall(8), zfs(8) and nfsd(8) jail(8) and bhyve(8) “guests” Application Binary Interface vs. Instructions Set Architecture Institutionalizing FreeBSD Isolated and Virtualized Hosts Using bsdinstall(8), zfs(8) and nfsd(8) The FreeBSD installer The best file system/volume manager available The Network File System Broad Motivations Virtualization! Containers! Docker! Zones! Droplets! More more more! My Motivations 2003: Jails to mitigate “RPM Hell” 2011: “bhyve sounds interesting...” 2017: Mitigating Regression Hell 2018: OpenZFS EVERYWHERE A Tale of Two Regressions Listen up. Regression One FreeBSD Commit r324161 “MFV r323796: fix memory leak in [ZFS] g_bio zone introduced in r320452” Bug: r320452: June 28th, 2017 Fix: r324162: October 1st, 2017 3,710 Commits and 3 Months Later June 28th through October 1st BUT July 27th, FreeNAS MFC Slips into FreeNAS 11.1 Released December 13th Fixed in FreeNAS January 18th 3 Months in FreeBSD HEAD 36 Days
    [Show full text]
  • Thread Scheduling in Multi-Core Operating Systems Redha Gouicem
    Thread Scheduling in Multi-core Operating Systems Redha Gouicem To cite this version: Redha Gouicem. Thread Scheduling in Multi-core Operating Systems. Computer Science [cs]. Sor- bonne Université, 2020. English. tel-02977242 HAL Id: tel-02977242 https://hal.archives-ouvertes.fr/tel-02977242 Submitted on 24 Oct 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Ph.D thesis in Computer Science Thread Scheduling in Multi-core Operating Systems How to Understand, Improve and Fix your Scheduler Redha GOUICEM Sorbonne Université Laboratoire d’Informatique de Paris 6 Inria Whisper Team PH.D.DEFENSE: 23 October 2020, Paris, France JURYMEMBERS: Mr. Pascal Felber, Full Professor, Université de Neuchâtel Reviewer Mr. Vivien Quéma, Full Professor, Grenoble INP (ENSIMAG) Reviewer Mr. Rachid Guerraoui, Full Professor, École Polytechnique Fédérale de Lausanne Examiner Ms. Karine Heydemann, Associate Professor, Sorbonne Université Examiner Mr. Etienne Rivière, Full Professor, University of Louvain Examiner Mr. Gilles Muller, Senior Research Scientist, Inria Advisor Mr. Julien Sopena, Associate Professor, Sorbonne Université Advisor ABSTRACT In this thesis, we address the problem of schedulers for multi-core architectures from several perspectives: design (simplicity and correct- ness), performance improvement and the development of application- specific schedulers.
    [Show full text]
  • Building a Virtualisation Appliance with Freebsd/Bhyve/Openzfs Jason Tubnor ICT Senior Security Lead Introduction
    Building a virtualisation appliance with FreeBSD/bhyve/OpenZFS Jason Tubnor ICT Senior Security Lead Introduction Building an virtualisation appliance for use within a NGO/NFP Australian Health Sector About Me Latrobe Community Health Service (LCHS) Background Problem Concept Production Reiteration About Me 26 years of IT experience Introduced to Open Source in the mid 90’s Discovered OpenBSD in 2000 A user and advocate of OpenBSD and FreeBSD Life outside of computers: Ultra endurance gravel cycling Latrobe Community Health Service (LCHS) Originally a Gippsland based NFP/NGO health service ICT manages 900+ users Servicing 51 sites across Victoria, Australia Covering ~230,000km2 Roughly the size of Laos in Aisa or Minnesota in USA “Better health, Better lifestyles, Stronger communities” Background First half of 2016 awarded contract to provide NDIS services Mid 2016 – deployment of initial infrastructure MPLS connection L3 switch gear ESXi host running a Windows Server 2016 for printing services Background – cont. Staff number grew We hit capacity constraints on the managed MPLS network An offloading guest was added to the ESXi host VPN traffic could be offloaded from the main network Using cheaply available ISP internet connection Problem Taking stock of the lessons learned in the first phase We needed to come up with a reproducible device Device required to be durable in harsh conditions Budget constraints/cost savings Licensing model Phase 2 was already being negotiated so a solution was required quickly Concept bhyve [FreeBSD] was working extremely well in testing Excellent hardware support Liberally licensed OpenZFS Simplistic Small footprint for a type 2 hypervisor Hardware discovery phase FreeBSD Required virtualisation components in CPU Concept – cont.
    [Show full text]
  • Bhyve - Improvements to Virtual Machine State Save and Restore
    bhyve - Improvements to Virtual Machine State Save and Restore Darius Mihai Mihai Carabas, University POLITEHNICA of Bucharest University POLITEHNICA of Bucharest Splaiul Independent, ei 313, Bucharest, Romania, 060042 Splaiul Independent, ei 313, Bucharest, Romania, 060042 Email: [email protected] Email: [email protected] Abstract—As more complex tasks are delegated to distributed Regardless of their exact function, a periodic task is a routine servers, virtual machine hypervisors need to adapt and provide that will have to be called at (or as close as possible) a set features that allow redundancy and load balancing. One such interval. mechanism is the virtual machine save and restore through sys- sleep tem snapshots. A snapshot should allow the complete restoration For example, the basic Unix command can be used of the state that the virtual machine was in when the snapshot to perform an operation every N seconds if sleep $N is was created. Since the snapshot should encapsulate the entire called in a script loop. Since it is safe to assume that all state of the virtualized system, the guest system should not be modern processors have hardware timekeeping components able to differentiate between the moment a snapshot was created implemented, sleep will request from the operating system and the moment when the system was restored, regardless of how much real time has passed between the two events. This that a software timer (i.e., one that is implemented by the paper will present how the time management and block devices operating system as an abstraction [1]) to be set for N are saved and restored for bhyve, FreeBSD’s virtual machine seconds in the future and will yield the processor, without hypervisor.
    [Show full text]
  • In PDF Format
    Arranging Your Virtual Network on FreeBSD Michael Gmelin ([email protected]) January 2020 1 CONTENTS CONTENTS Contents Introduction 3 Document Conventions . .3 License . .3 Plain Jails 4 Plain Jails Using Inherited IP Configuration . .4 Plain Jails Using a Dedicated IP Address . .5 Plain Jails Using a VLAN IP Address . .6 Plain Jails Using a Loopback IP Address . .7 Adding Outbound NAT for Public Traffic . .7 Running a Service and Redirecting Traffic to It . .9 VNET Jails and bhyve VMs 10 VNET Jails Using sysutils/pot ............................. 10 VNET Jails Using sysutils/iocage ............................ 13 Managing Bridges . 13 Adding bhyve VMs and DHCP to the Mix . 16 Preventing Traffic Between VNET Jails/VMs . 17 Firewalling Inside VNET Jails/VMs . 20 VXLAN 22 VXLAN Example Overview . 22 Gateway Configuration . 24 Jailhost-a . 25 Network Configuration (jailhost-a) . 25 VM Configuration (jailhost-a) . 26 Jail Configuration (jailhost-a) . 27 Jailhost-b . 27 Network Configuration (jailhost-b) . 27 Plain Jail Configuration (jailhost-b) . 28 Network Switch Setup (jailhost-b) . 29 VNET Jail Configuration (jailhost-b) . 30 VM Configuration (jailhost-b) . 30 VXLAN Multicast Troubleshooting . 31 Conclusion and Further Reading 33 2020-01-08 (final) 2 CC BY 4.0 INTRODUCTION Introduction Modern FreeBSD offers a range of virtualization options, from the traditional jail environment sharing the network stack with the host operating system, over vnet jails, which allow each jail to have its own network stack, to bhyve virtual machines running their own kernels/operating systems. Depending on individual requirements, there are different ways to configure the virtual network. Jail and VM management tools can ease the process by abstracting away (at least some of) the underlying complexities.
    [Show full text]
  • Integration of KVM in the Openhuaca Cloud Platform
    Integration of KVM in the Openhuaca Cloud Platform A Degree Thesis Submitted to the Faculty of the Escola Tècnica d'Enginyeria de Telecomunicació de Barcelona Universitat Politècnica de Catalunya by Daniel Campos Gómez In partial fulfilment of the requirements for the degree in NETWORK ENGINEERING Advisor: Jose Luis Muñoz Tapia Barcelona, June 2018 Abstract The purpose of this project is the integration of KVM technology into a cloud platform called Openhuaca that lets the user of the software the possibility of creating and managing virtual containers and virtual machines in an easy and fast way. Besides, it can be administrated with domains. It is thought to be implemented in small or medium stages; for example, in a teaching area to help all the students’ necessities in a centralized way. Therefore, every student can connect to all virtualized facilities with their specific digital certificate. The complexity of the project has made it necessary to create a working team formed by a supervisor, ex-students and various TFG students from different universities in order to review and introduce new functionalities to the project efficiently and quicker. 1 Resum L’objectiu d’aquest projecte és integrar la tecnología KVM a una plataforma cloud anomenada Openhuaca. Aquesta plataforma permeteix a l’usuari crear i gestionar diversos contenedors i màquines virtuals d’una manera ràpida i senzilla. A més, pot ser administrada per diversos dominis. Aquest projecte està pensat per a petits o mitjans entorns, per exemple, a l’àrea docent per poder controlar els ordinadors dels laboratoris de la Universitat. Openhuaca està pensat per cobrir les necessitats dels alumnes de forma centralitzada.
    [Show full text]
  • Virtualization Costs: Benchmarking Containers and Virtual Machines Against Bare‑Metal
    SN Computer Science (2021) 2:404 https://doi.org/10.1007/s42979-021-00781-8 ORIGINAL RESEARCH Virtualization Costs: Benchmarking Containers and Virtual Machines Against Bare‑Metal Saverio Giallorenzo1,2 · Jacopo Mauro3 · Martin Gyde Poulsen4 · Filip Siroky4 Received: 16 April 2021 / Accepted: 29 June 2021 © The Author(s), under exclusive licence to Springer Nature Singapore Pte Ltd 2021 Abstract DevOps advocates the usage of Virtualization Technologies (VT), such as Virtual Machines and Containers. However, it is complex to predict how the usage of a given VT will impact on the performance of an application. In this paper, we present a collection of reference benchmarks that developers can use to orient when looking for the best-performing VT w.r.t their application profle. To gather our benchmarks in a resource-wise comprehensive and comparable way, we introduce VTmark: a semi-automatic open-source suite that assembles of-the-shelf tools for benchmarking the diferent resources used by applications (CPU, RAM, etc.). After performing a survey of VTs in the market, we use VTmark to report the benchmarks of 6 of the most widely adopted and popular ones, namely Docker, KVM, Podman, VMWare Workstation, VirtualBox, and Xen. To validate the accuracy of our reference benchmarks, we show how they correlate with the profle performance of a production-grade application ported and deployed on the considered VTs. Beyond our immediate results, VTmark let us shed light on some contradicting fndings in the related literature and, by releasing VTmark , we provide DevOps with an open-source, extendable tool to assess the (resource-wise) costs of VTs.
    [Show full text]
  • AWS Firecracker VMM 之 ⼤熱天捲起袖⼦動⼿玩
    Playing with AWS Firecracker VMM 之 ⼤熱天捲起袖⼦動⼿玩 ... Ernest Chiang @ COSCUP 2020, Track: Cloud Native Hub Give me a place to stand on, and I will move the Earth. —Archimedes 2 sli.do #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm 議程中有任何問題、好奇、疑問，都可以隨時丟進 sli.do US$25 AWS Credits 問券連結，也放在 sli.do 裡頭喔 3 Ernest Chiang Worked on process integration engineering in semiconductor industry @tsmc. Doing product and technology integration in fitness industry @pafers. Off Work TGO Networks Taipei. AWS Community Hero. Mozillian. AIESECer. 4 Outline Problems & Solutions Firecracker Virtualization & Containerization Lambda & Fargate Firecracker & container d Live Demo Getting started with Firecracker in 2 Minutes Creating 4,000 microVMs in 90 seconds Firecracker & Open Source Projects 8 Problems & Solutions 9 Firecracker, Part 1 10 What is Firecraker Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services. 11 What is Firecraker Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services. 12 What problem is AWS helping to solve? 13 What problem is AWS helping to solve? 14 What problem is AWS helping to solve? Multiple functions on multiple environments from multiple accounts . 15 What is Firecracker Open source virtualization technology (microVM) Security and isolation of traditional VMs Speed and density of containers Low resource overhead Developed at Amazon 16 Benefits of Firecracker 17 Benefits of Firecracker 18 安全隔離好 啟動時間短 產能效率⾼ #像極了愛情 -- AWS Firecracker VMM 19 Virtualization & Containerization 20 Virtualization (1/3) In computing, virtualization refers to the act of creating a virtual (rather than actual) version of something , including virtual computer hardware platforms, storage devices, and computer network resources.
    [Show full text]
  • A Survey on Shared Disk I/O Management in Virtualized Environments Under Real Time Constraints
    A survey on shared disk I/O management in virtualized environments under real time constraints Ignacio Sañudo Roberto Cavicchioli Nicola Capodieci University of Modena University of Modena University of Modena and Reggio Emilia and Reggio Emilia and Reggio Emilia ignacio.sanudoolmedo [email protected] nicola.capodieci @unimore.it @unimore.it Paolo Valente Marko Bertogna University of Modena University of Modena and Reggio Emilia and Reggio Emilia [email protected] [email protected] ABSTRACT the case of next-generation automotive architectures, where In the embedded systems domain, hypervisors are increas- cost-effective solutions ever more require sharing an on-board ingly being adopted to guarantee timing isolation and appro- computing platform among different applications with het- priate hardware resource sharing among different software erogeneous safety and criticality levels, e.g., the infotain- components. However, managing concurrent and parallel ment part on one side, and a safety-critical image processing requests to shared hardware resources in a predictable way module on the other side. These domains are independent, still represents an open issue. We argue that hypervisors with different period, deadline, safety and criticality require- can be an effective means to achieve an efficient and pre- ments. However, they need to be properly isolated with no dictable arbitration of competing requests to shared devices mutual interference, or a misbehaving module may endanger in order to satisfy real-time requirements.
    [Show full text]
  • P4A: Hands-On Bhyve, the BSD Hypervisor
    The bhyve Operator's Manual Michael Dexter AsiaBSDCon 2013 OVERVIEW bhyve is a legacy-free Type-2 hypervisor for FreeBSD that was imported into the mainline FreeBSD development repository in January of 2013 with svn revision r245652. A hypervisor allow for the operation of one or more guest operating systems within a host operating system. As a legacy-free hypervisor, a bhyve host requires the Extended Page Tables (EPT) feature found on "Nehalem" and newer generations of Intel processors. This requirement eliminates the need for memory management routines that are traditionally implemented in software and yields virtually bare metal guest performance. A bhyve guest requires VirtIO network and block devices, which were already available in FreeBSD 8-STABLE, 9-STABLE and 10-CURRENT at the time of bhyve's import. If these two requirements are satisfied, the bhyve host and guests will operate in the established FreeBSD manner. HARDWARE REQUIREMENTS The presence of the Extended Page Table (EPT) feature can be determined by examining the host's demesg(8) output for the presence of the POPCNT (POP Count) feature as the two are coupled but not related. Established dynamic memory and storage requirements apply otherwise with the caveat that there is a 1:1 relationship between the deduction of dynamic memory from the host and its allocation to guests. SOFTWARE REQUIREMENTS A FreeBSD 10-CURRENT system from svn revision r245652 onward will include all of the necessary bhyve host components: the vmm(4) kernel module, the libvmmapi library and the bhyveload(8), bhvye(8) and bhyvectl(8) utilities. A suitable FreeBSD 8-STABLE, 9-STABLE or 10-CURRENT guest can exist in a disk image or any valid storage device and only requires a modified /etc/ttys entry to work.
    [Show full text]
  • Safe Kernel Programming with Rust
    DEGREE PROJECT IN COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2018 Safe Kernel Programming with Rust JOHANNES LUNDBERG KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE Safe Kernel Programming with Rust JOHANNES LUNDBERG Master in Computer Science Date: August 14, 2018 Supervisor: Johan Montelius Examiner: Mads Dam Swedish title: Säker programmering i kärnan med Rust School of Computer Science and Communication iii Abstract Writing bug free computer code is a challenging task in a low-level language like C. While C compilers are getting better and better at de- tecting possible bugs, they still have a long way to go. For application programming we have higher level languages that abstract away de- tails in memory handling and concurrent programming. However, a lot of an operating system’s source code is still written in C and the kernel is exclusively written in C. How can we make writing kernel code safer? What are the performance penalties we have to pay for writing safe code? In this thesis, we will answer these questions using the Rust programming language. A Rust Kernel Programming Inter- face is designed and implemented, and a network device driver is then ported to Rust. The Rust code is analyzed to determine the safeness and the two implementations are benchmarked for performance and compared to each other. It is shown that a kernel device driver can be written entirely in safe Rust code, but the interface layer require some unsafe code. Measurements show unexpected minor improvements to performance with Rust. iv Sammanfattning Att skriva buggfri kod i ett lågnivåspråk som C är väldigt svårt.
    [Show full text]
  • CYBERSECURITY When Will You Be Hacked?
    SUFFOLK ACADEMY OF LAW The Educational Arm of the Suffolk County Bar Association 560 Wheeler Road, Hauppauge, NY 11788 (631) 234-5588 CYBERSECURITY When Will You Be Hacked? FACULTY Victor John Yannacone, Jr., Esq. April 26, 2017 Suffolk County Bar Center, NY Cybersecurity Part I 12 May 2017 COURSE MATERIALS 1. A cybersecurity primer 3 – 1.1. Cybersecurity practices for law firms 5 – 1.2. Cybersecurity and the future of law firms 11 – 2. Information Security 14 – 2.1. An information security policy 33 – 2.2. Data Privacy & Cloud Computing 39 – 2.3. Encryption 47 – 3. Computer security 51 – 3.1. NIST Cybersecurity Framework 77 – 4. Cybersecurity chain of trust; third party vendors 113 – 5. Ransomware 117 – 5.1. Exploit kits 132 – 6. Botnets 137 – 7. BIOS 139 – 7.1. Universal Extensible Firmware Interface (UEFI) 154– 8. Operating Systems 172 – 8.1. Microsoft Windows 197 – 8.2. macOS 236– 8.3. Open source operating system comparison 263 – 9. Firmware 273 – 10. Endpoint Security Buyers Guide 278 – 11. Glossaries & Acronym Dictionaries 11.1. Common Computer Abbreviations 282 – 11.2. BABEL 285 – 11.3. Information Technology Acronymns 291 – 11.4. Glossary of Operating System Terms 372 – 2 Cyber Security Primer Network outages, hacking, computer viruses, and similar incidents affect our lives in ways that range from inconvenient to life-threatening. As the number of mobile users, digital applications, and data networks increase, so do the opportunities for exploitation. Cyber security, also referred to as information technology security, focuses on protecting computers, networks, programs, and data from unintended or unauthorized access, change, or destruction.
    [Show full text]