DOCSLIB.ORG

Virtualization of Linux Based Computers: the Linux-Vserver Project

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Virtualization of Linux Based Computers: the Linux-Vserver Project VirtualizationVirtualization ofof LinuxLinux basedbased computers:computers: thethe LinuxLinux--VServerVServer projectproject BenoBenoîîtt desdes Ligneris,Ligneris, Ph.Ph. D.D. [email protected] Objectives:Objectives: Objectives:Objectives: 1)1) PresentPresent thethe availableavailable programsprograms thatthat cancan provideprovide aa virtualizationvirtualization ofof LinuxLinux computerscomputers withwith differentdifferent technologies.technologies. Objectives:Objectives: 1)1) PresentPresent thethe availableavailable programsprograms thatthat cancan provideprovide aa virtualizationvirtualization ofof LinuxLinux computerscomputers withwith differentdifferent technologies.technologies. 2)2) FocusFocus onon LinuxLinux--VServers:VServers: aa veryvery lightweightlightweight andand effectiveeffective technologytechnology forfor thethe regularregular LinuxLinux useruser notnot interstedintersted inin KernelKernel hacking.hacking. PlanPlan PlanPlan ● IntroductionIntroduction PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria ● ComparativeComparative studystudy ofof thethe existingexisting technologytechnology PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria ● ComparativeComparative studystudy ofof thethe existingexisting technologytechnology ● TechnologyTechnology overviewoverview ofof LinuxLinux--VServersVServers PlanPlan ● IntroductionIntroduction ● OverviewOverview ofof thethe availableavailable technologytechnology ● ClassificationClassification ofof thethe problems:problems: usageusage criteriacriteria ● ComparativeComparative studystudy ofof thethe existingexisting technologytechnology ● TechnologyTechnology overviewoverview ofof LinuxLinux--VServersVServers ● ConclusionConclusion IntroductionIntroduction IntroductionIntroduction WhyWhy vservers?vservers? IntroductionIntroduction WhyWhy vservers?vservers? ➔ Virtualization is now more and more acessible for regular users given the extreme processing power of the current computers IntroductionIntroduction WhyWhy vservers?vservers? ➔ Virtualization is now more and more acessible for regular users given the extreme processing power of the current computers ➔ The availability of COTS multi-processor 64 bit architecture accelerates the needs for a mature virtualization technique, as it's more and more difficult for a common application to use 100% of the available resources IntroductionIntroduction WhyWhy vservers?vservers? ➔ Virtualization is now more and more acessible for regular users given the extreme processing power of the current computers ➔ The availability of COTS multi-processor 64 bit architecture accelerates the needs for a mature virtualization technique, as it's more and more difficult for a common application to use 100% of the available resources ➔ Virtualization also affect scientific computing and could become, in the near future, the corner stone of the so called «grid computing» as it solves elegantly most of the problems (security, resources consumption) of the current Grid technology OverviewOverview ofof thethe availableavailable technologytechnology OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 BochsBochs OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 BochsBochs LinuxLinux--VServersVServers OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 BochsBochs LinuxLinux--VServersVServers UserUser ModeMode LinuxLinux (UML)(UML) OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 BochsBochs LinuxLinux--VServersVServers UserUser ModeMode LinuxLinux (UML)(UML) XenXen OverviewOverview ofof thethe availableavailable technologytechnology VMwareVMware plex86plex86 BochsBochs LinuxLinux--VServersVServers UserUser ModeMode LinuxLinux (UML)(UML) XenXen QEMUQEMU VMwareVMware VMwareVMware « Vmware workstation is a powerfull virtual machine software for the desktop. VMware workstation runs multiple operating systems, including Microsoft Windows, Linux and Novell NetWare, simultaneously on a single PC in fully networked, portable virtual machines » http://www.vmware.com/products/ VMwareVMware ➔ ProvideProvide completecomplete multimulti--OSOS emulationemulation onon x86x86 CPUCPU onlyonly VMwareVMware ➔ ProvideProvide completecomplete multimulti--OSOS emulationemulation onon x86x86 CPUCPU onlyonly ➔ TheThe wholewhole installationinstallation processprocess ofof aa LinuxLinux distributiondistribution cancan bebe donedone withwith VMwareVMware VMwareVMware ➔ ProvideProvide completecomplete multimulti--OSOS emulationemulation onon x86x86 CPUCPU onlyonly ➔ TheThe wholewhole installationinstallation processprocess ofof aa LinuxLinux distributiondistribution cancan bebe donedone withwith VMwareVMware ➔ ResourceResource consumptionconsumption isis staticstatic (RAM,(RAM, Disck,Disck, etc)etc) andand veryvery importantimportant (up(up toto 50%50% ofof thethe availableavailable computingcomputing power!)power!) plex86plex86 plex86plex86 « (...) a very lightweight Virtual Machine (VM) for running Linux/x86» http://plex86.sourceforge.net/ (Feb/2005) plex86plex86 « (...) a very lightweight Virtual Machine (VM) for running Linux/x86» http://plex86.sourceforge.net/ (Feb/2005) ➔ UseUse thethe samesame VmwareVmware logiclogic butbut isis restrictedrestricted onlyonly toto LinuxLinux OSOS (native(native OSOS asas wellwell asas guestguest OS)OS) plex86plex86 « (...) a very lightweight Virtual Machine (VM) for running Linux/x86» http://plex86.sourceforge.net/ (Feb/2005) ➔ UseUse thethe samesame VmwareVmware logiclogic butbut isis restrictedrestricted onlyonly toto LinuxLinux OSOS (native(native OSOS asas wellwell asas guestguest OS)OS) ➔ It'sIt's neededneeded toto recompilerecompile thethe kernelkernel onon thethe guestguest OSOS plex86plex86 « (...) a very lightweight Virtual Machine (VM) for running Linux/x86» http://plex86.sourceforge.net/ (Feb/2005) ➔ UseUse thethe samesame VmwareVmware logiclogic butbut isis restrictedrestricted onlyonly toto LinuxLinux OSOS (native(native OSOS asas wellwell asas guestguest OS)OS) ➔ It'sIt's neededneeded toto recompilerecompile thethe kernelkernel onon thethe guestguest OSOS ➔ VeryVery slowslow atat thethe timetime ofof thisthis writingwriting BochsBochs BochsBochs « Bochs is a highly portable open source IA-32(x86) PC emulator written in C++, that runs on most popular platforms. It includes emulation of the Intel x86 CPU, common I/O devices and a custom BIOS. Currently, Bochs can be compiled to emulate a 386, 486, Pentium, Pentium Pro or AMD64 CPU including optional MMX, SSE, SSE2 and 3DNow instructions » http://bochs.sourceforge.net/ (Feb/2005) BochsBochs ➔ TheThe performanceperformance ofof bochsbochs doesdoes notnot comparecompare toto VmwareVmware oror plex86plex86 mainlymainly becausebecause itit emulatesemulates thethe CPUCPU insteadinstead ofof usingusing thethe nativenative instructioninstruction setset ofof thethe IAIA--3232 CPUsCPUs BochsBochs ➔ TheThe performanceperformance ofof bochsbochs doesdoes notnot comparecompare toto VmwareVmware oror plex86plex86 mainlymainly becausebecause itit emulatesemulates thethe CPUCPU insteadinstead ofof usingusing thethe nativenative instructioninstruction setset ofof thethe IAIA--3232 CPUsCPUs ➔ ThereThere isis nono lockinglocking mechanismmechanism forfor thethe disks.disks. TheThe LinuxLinux--VServersVServers TheThe LinuxLinux--VServersVServers « Linux-VServer allows you to create virtual private servers and security contexts which operate like a normal Linux server, but allow many independent servers to be run simultaneously in one box at full speed» http://www.linux-vserver.org (Feb/2005) TheThe LinuxLinux--VServersVServers ➔ TheThe LinuxLinux--VServerVServer projectproject consistsconsists ofof aa kernelkernel patchpatch andand installationinstallation ofof userlanduserland toolstools TheThe LinuxLinux--VServersVServers ➔ TheThe LinuxLinux--VServerVServer projectproject consistsconsists ofof aa kernelkernel patchpatch andand installationinstallation ofof userlanduserland toolstools ➔ ItIt managemanage resourcesresources dinamically:dinamically: aa singlesingle kernelkernel isis inin chargecharge ofof allocatingallocating resources.resources. TheThe LinuxLinux--VServersVServers ➔ TheThe LinuxLinux--VServerVServer projectproject consistsconsists ofof aa kernelkernel patchpatch andand installationinstallation ofof userlanduserland toolstools ➔ ItIt managemanage resourcesresources dinamically:dinamically: aa singlesingle kernelkernel isis inin chargecharge ofof allocatingallocating resources.resources. ➔ Priority,Priority, Memory,Memory, DiskDisk space,space, CPUCPU ticksticks cancan bebe managedmanaged dynamicallydynamically
Load more

Recommended publications
  • Effective Virtual CPU Configuration with QEMU and Libvirt
    Effective Virtual CPU Configuration with QEMU and libvirt Kashyap Chamarthy <[email protected]> Open Source Summit Edinburgh, 2018 1 / 38 Timeline of recent CPU flaws, 2018 (a) Jan 03 • Spectre v1: Bounds Check Bypass Jan 03 • Spectre v2: Branch Target Injection Jan 03 • Meltdown: Rogue Data Cache Load May 21 • Spectre-NG: Speculative Store Bypass Jun 21 • TLBleed: Side-channel attack over shared TLBs 2 / 38 Timeline of recent CPU flaws, 2018 (b) Jun 29 • NetSpectre: Side-channel attack over local network Jul 10 • Spectre-NG: Bounds Check Bypass Store Aug 14 • L1TF: "L1 Terminal Fault" ... • ? 3 / 38 Related talks in the ‘References’ section Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications What this talk is not about 4 / 38 Related talks in the ‘References’ section What this talk is not about Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications 4 / 38 What this talk is not about Out of scope: Internals of various side-channel attacks How to exploit Meltdown & Spectre variants Details of performance implications Related talks in the ‘References’ section 4 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) libvirtd QMP QMP QEMU QEMU VM1 VM2 Custom Disk1 Disk2 Appliance ioctl() KVM-based virtualization components Linux with KVM 5 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) libvirtd QMP QMP Custom Appliance KVM-based virtualization components QEMU QEMU VM1 VM2 Disk1 Disk2 ioctl() Linux with KVM 5 / 38 OpenStack, et al. libguestfs Virt Driver (guestfish) Custom Appliance KVM-based virtualization components libvirtd QMP QMP QEMU QEMU VM1 VM2 Disk1 Disk2 ioctl() Linux with KVM 5 / 38 libguestfs (guestfish) Custom Appliance KVM-based virtualization components OpenStack, et al.
    [Show full text]
  • QEMU Parameter Jungle Slides
    Finding your way through the QEMU parameter jungle 2018-02-04 Thomas Huth <[email protected]> Legal ● Disclaimer: Opinions are my own and not necessarily the views of my employer ● “Jungle Leaves” background license: CC BY 3.0 US : https://creativecommons.org/licenses/by/3.0/us/ Image has been modified from the original at: https://www.freevector.com/jungle-leaves-vector-background 2 Introduction 3 Why a guide through the QEMU parameter jungle? 4 Why a guide through the QEMU parameter jungle? ● QEMU is a big project, supports lots of emulated devices, and lots of host backends ● 15 years of development → a lot of legacy ● $ qemu-system-i386 -h | wc -l 454 ● People regularly ask about CLI problems on mailing lists or in the IRC channels → Use libvirt, virt-manager, etc. if you just want an easier way to run a VM 5 General Know-How ● QEMU does not distinguish single-dash options from double-dash options: -h = --h = -help = --help ● QEMU starts with a set of default devices, e.g. a NIC and a VGA card. If you don't want this: --nodefaults or suppress certain default devices: --vga none --net none 6 Getting help about the options ● Parameter overview: -h or --help (of course) ● Many parameters provide info with “help”: --accel help ● Especially, use this to list available devices: --device help ● To list parameters of a device: --device e1000,help ● To list parameters of a machine: --machine q35,help 7 e1000 example ● $ qemu-system-x86_64 --device e1000,help [...] e1000.addr=int32 (PCI slot and function¼) e1000.x-pcie-extcap-init=bool (on/off) e1000.extra_mac_registers=bool (on/off) e1000.mac=str (Ethernet 6-byte MAC Address¼) e1000.netdev=str (ID of a netdev backend) ● $ qemu-system-x86_64 --device \ e1000,mac=52:54:00:12:34:56,addr=06.0 8 General Know How: Guest and Host There are always two parts of an emulated device: ● Emulated guest hardware, e.g.: --device e1000 ● The backend in the host, e.g.: --netdev tap Make sure to use right set of parameters for configuration! 9 “Classes” of QEMU parameters ● Convenience : Easy to use, but often limited scope.
    [Show full text]
  • Virtual Machine Technologies and Their Application in the Delivery of ICT
    Virtual Machine Technologies and Their Application In The Delivery Of ICT William McEwan accq.ac.nz n Christchurch Polytechnic Institute of Technology Christchurch, New Zealand [email protected] ABSTRACT related areas - a virtual machine or network of virtual machines can be specially configured, allowing an Virtual Machine (VM) technology was first ordinary user supervisor rights, and it can be tested implemented and developed by IBM to destruction without any adverse effect on the corporation in the early 1960's as a underlying host system. mechanism for providing multi-user facilities This paper hopes to also illustrate how VM in a secure mainframe computing configurations can greatly reduce our dependency on environment. In recent years the power of special purpose, complex, and expensive laboratory personal computers has resulted in renewed setups. It also suggests the important additional role interest in the technology. This paper begins that VM and VNL is likely to play in offering hands-on by describing the development of VM. It practical experience to students in a distance e- discusses the different approaches by which learning environment. a VM can be implemented, and it briefly considers the advantages and disadvantages Keywords: Virtual Machines, operating systems, of each approach. VM technology has proven networks, e-learning, infrastructure, server hosting. to be extremely useful in facilitating the Annual NACCQ, Hamilton New Zealand July, 2002 www. Annual NACCQ, Hamilton New Zealand July, teaching of multiple operating systems. It th offers an alternative to the traditional 1. INTRODUCTION approaches of using complex combinations Virtual Machine (VM) technology is not new. It was of specially prepared and configured OS implemented on mainframe computing systems by the images installed via the network or installed IBM Corporation in the early 1960’s (Varian 1997 pp permanently on multiple partitions or on 3-25, Gribben 1989 p.2, Thornton 2000 p.3, Sugarman multiple physical hard drives.
    [Show full text]
  • OLD PRETENDER Lovrenc Gasparin, Fotolia
    COVER STORY Bochs Emulator Legacy emulator OLD PRETENDER Lovrenc Gasparin, Fotolia Gasparin, Lovrenc Bochs, the granddaddy of all emulators, is alive and kicking; thanks to regular vitamin jabs, the lively old pretender can even handle Windows XP. BY TIM SCHÜRMANN he PC emulator Bochs first saw the 2.2.6 version in the Universe reposi- box). This also applies if you want to the light of day in 1994. Bochs’ tory; you will additionally need to install run Bochs on a pre-Pentium CPU, such Tinventor, Kevin Lawton, distrib- the Bximage program. (Bximage is al- as a 486. uted the emulator under a commercial li- ready part of the Bochs RPM for open- After installation, the program will cense before selling to French Linux ven- SUSE.) If worst comes to worst, you can simulate a complete PC, including CPU, dor Mandriva (which was then known always build your own Bochs from the graphics, sound card, and network inter- as MandrakeSoft). Mandriva freed the source code (see the “Building Bochs” face. The virtual PC in a PC works so emulator from its commercial chains, re- leasing Bochs under the LGPL license. Building Bochs If you prefer to build your own Bochs, or an additional --enable-ne2000 parameter Installation if you have no alternative, you will first to configure. The extremely long list of Bochs has now found a new home at need to install the C++ compiler and de- parameters in the user manual [2] gives SourceForge.net [1] (Figure 1). You can veloper packages for the X11 system. you a list of available options.
    [Show full text]
  • Many Things Related to Qubesos
    Qubes OS Many things Many things related to QubesOS Author: Neowutran Contents 1 Wiping VM 2 1.1 Low level storage technologies .................. 2 1.1.1 Must read ......................... 2 1.1.2 TL;DR of my understanding of the issue ........ 2 1.1.3 Things that could by implemented by QubesOS .... 2 2 Create a Gaming HVM 2 2.1 References ............................. 2 2.2 Prerequise ............................. 3 2.3 Hardware ............................. 3 2.4 Checklist .............................. 4 2.5 IOMMU Group .......................... 4 2.6 GRUB modification ........................ 4 2.7 Patching stubdom-linux-rootfs.gz ................ 5 2.8 Pass the GPU ........................... 6 2.9 Conclusion ............................. 6 2.10 Bugs ................................ 6 3 Create a Linux Gaming HVM, integrated with QubesOS 7 3.1 Goals ................................ 7 3.2 Hardware used .......................... 7 3.3 Main steps summary ....................... 7 3.3.1 Detailled steps ...................... 8 3.3.2 Using a kernel provided by debian ............ 8 3.4 Xorg ................................ 8 3.4.1 Pulseaudio ......................... 11 3.5 Final notes ............................ 11 3.6 References ............................. 12 4 Nitrokey and QubeOS 12 5 Recovery: Mount disk 12 6 Disposable VM 13 6.1 Introduction ............................ 14 6.1.1 References ......................... 14 6.1.2 What is a disposable VM? ................ 14 6.2 Playing online video ....................... 14 6.3 Web browsing ........................... 15 6.4 Manipulating untrusted files/data ................ 16 1 6.5 Mounting LVM image ...................... 17 6.6 Replace sys-* VM ......................... 18 6.7 Replace some AppVMs ...................... 18 7 Building a new QubesOS package 18 7.1 References ............................. 18 7.2 Goal ................................ 18 7.3 The software ............................ 19 7.4 Packaging ............................. 19 7.5 Building .............................
    [Show full text]
  • QEMU for Xen Secure by Default
    QEMU for Xen secure by default Deprivileging the PC system emulator Ian Jackson <[email protected]> FOSDEM 2016 with assistance from Stefano Stabellini guest guest Xen PV driver IDE driver Xen PV protocol mmio, dma, etc. qemu Emulated IDE controller Xen PV backend (usually), syscalls (usually) dom0 (usu.dom0) kernel Device driver kernel Device driver PV HVM ... ... ... ... ... from Xen Security Team advisories page, http://xenbits.xen.org/xsa/ Xen on x86 modes, and device model bug implications Current status for users of upstream Xen and distros and future plans Status Device model Notes bugs mean PV Fully supported Safe (no DM) Only modified guests HVM qemu in dom0 Fully supported Vulnerable Current default as root HVM qemu stub DM Upstream but not Safe Ancient qemu qemu-xen-trad. in most distros. Build system problems HVM qemu stub DM In progress Safe Rump build system rump kernel Hard work! is mini distro HVM qemu dom0 Targeting No privilege esc. Defence in depth not as root Xen 4.7 Maybe dom0 DoS Hopefully, will be default Xen on x86 modes, and device model bug implications Current status for users of upstream Xen and distros and future plans Status Device model Notes bugs mean PV Fully supported Safe (no DM) Only modified guests HVM qemu in dom0 Fully supported Vulnerable Current default as root HVM qemu stub DM Upstream but not Safe Ancient qemu qemu-xen-trad. in most distros. Build system problems HVM qemu stub DM In progress Safe Rump build system rump kernel Hard work! is mini distro HVM qemu dom0 Targeting No privilege esc.
    [Show full text]
  • Hyperlink: Virtual Machine Introspection and Memory Forensic Analysis Without Kernel Source Code Jidong Xiao Boise State University
    Boise State University ScholarWorks Computer Science Faculty Publications and Department of Computer Science Presentations 1-1-2016 HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code Jidong Xiao Boise State University Lei Lu VMware Inc. Haining Wang University of Delaware Xiaoyun Zhu Futurewei Technologies © 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. doi: 10.1109/ICAC.2016.46 HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code Jidong Xiao∗, Lei Luy, Haining Wangz, Xiaoyun Zhux ∗Boise State University, Boise, Idaho, USA yVMware Inc., Palo Alto, California, USA zUniversity of Delaware, Newark, Delaware, USA xFuturewei Technologies, Santa Clara, California, USA Abstract— Virtual Machine Introspection (VMI) is an ap- nel rootkit detection [8], [9], kernel integrity protection [10], proach to inspecting and analyzing the software running inside a and detection of covertly executing binaries [11]. Being the virtual machine from the hypervisor. Similarly, memory forensics main enabling technology for cloud computing, virtualiza- analyzes the memory snapshots or dumps to understand the tion allows us allocating finite hardware resources among runtime state of a physical or virtual machine. The existing VMI a large number of software systems and programs. As the and memory forensic tools rely on up-to-date kernel information key component of virtualization, a hypervisor runs directly of the target operating system (OS) to work properly, which often requires the availability of the kernel source code.
    [Show full text]
  • Hardware Virtualization
    Hardware Virtualization E-516 Cloud Computing 1 / 33 Virtualization Virtualization is a vital technique employed throughout the OS Given a physical resource, expose a virtual resource through layering and enforced modularity Users of the virtual resource (usually) cannot tell the difference Different forms: Multiplexing: Expose many virtual resources Aggregation: Combine many physical resources [RAID, Memory] Emulation: Provide a different virtual resource 2 / 33 Virtualization in Operating Systems Virtualizing CPU enables us to run multiple concurrent processes Mechanism: Time-division multiplexing and context switching Provides multiplexing and isolation Similarly, virtualizing memory provides each process the illusion/abstraction of a large, contiguous, and isolated “virtual” memory Virtualizing a resource enables safe multiplexing 3 / 33 Virtual Machines: Virtualizing the hardware Software abstraction Behaves like hardware Encapsulates all OS and application state Virtualization layer (aka Hypervisor) Extra level of indirection Decouples hardware and the OS Enforces isolation Multiplexes physical hardware across VMs 4 / 33 Hardware Virtualization History 1967: IBM System 360/ VM/370 fully virtualizable 1980s–1990s: “Forgotten”. x86 had no support 1999: VMWare. First x86 virtualization. 2003: Xen. Paravirtualization for Linux. Used by Amazon EC2 2006: Intel and AMD develop CPU extensions 2007: Linux Kernel Virtual Machines (KVM). Used by Google Cloud (and others). 5 / 33 Guest Operating Systems VMs run their own operating system (called “guest OS”) Full Virtualization: run unmodified guest OS. But, operating systems assume they have full control of actual hardware. With virtualization, they only have control over “virtual” hardware. Para Virtualization: Run virtualization-aware guest OS that participates and helps in the virtualization. Full machine hardware virtualization is challenging What happens when an instruction is executed? Memory accesses? Control I/O devices? Handle interrupts? File read/write? 6 / 33 Full Virtualization Requirements Isolation.
    [Show full text]
  • Introduction to Virtualization Virtualization
    Introduction to Virtualization Prashant Shenoy Computer Science CS691D: Hot-OS Lecture 2, page 1 Virtualization • Virtualization: extend or replace an existing interface to mimic the behavior of another system. – Introduced in 1970s: run legacy software on newer mainframe hardware • Handle platform diversity by running apps in VMs – Portability and flexibility Computer Science CS691D: Hot-OS Lecture 2, page 2 Types of Interfaces • Different types of interfaces – Assembly instructions – System calls – APIs • Depending on what is replaced /mimiced, we obtain different forms of virtualization Computer Science CS691D: Hot-OS Lecture 2, page 3 Types of Virtualization • Emulation – VM emulates/simulates complete hardware – Unmodified guest OS for a different PC can be run • Bochs, VirtualPC for Mac, QEMU • Full/native Virtualization – VM simulates “enough” hardware to allow an unmodified guest OS to be run in isolation • Same hardware CPU – IBM VM family, VMWare Workstation, Parallels,… Computer Science CS691D: Hot-OS Lecture 2, page 4 Types of virtualization • Para-virtualization – VM does not simulate hardware – Use special API that a modified guest OS must use – Hypercalls trapped by the Hypervisor and serviced – Xen, VMWare ESX Server • OS-level virtualization – OS allows multiple secure virtual servers to be run – Guest OS is the same as the host OS, but appears isolated • apps see an isolated OS – Solaris Containers, BSD Jails, Linux Vserver • Application level virtualization – Application is gives its own copy of components that are not shared • (E.g., own registry files, global objects) - VE prevents conflicts – JVM Computer Science CS691D: Hot-OS Lecture 2, page 5 Examples • Application-level virtualization: “process virtual machine” • VMM /hypervisor Computer Science CS691D: Hot-OS Lecture 2, page 6 The Architecture of Virtual Machines J Smith and R.
    [Show full text]
  • Virtualizing Servers with Xen
    Virtualization Xen Features Escalabilidade Performance QoS Implementation Future Virtualizing servers with Xen Evaldo Gardenali VI International Conference of Unix at UNINET Virtualization Xen Features Escalabilidade Performance QoS Implementation Future Outline Virtualization Xen Features Scalability Performance Quality of Service Implementation Future of Xen Virtualization Xen Features Escalabilidade Performance QoS Implementation Future Overview Why? Support heterogeneous environments: Linux r 2.4 e 2.6, NetBSD r , Plan9 r FreeBSD r , OpenSolaris r Consolidate work Legacy Systems Gradual Upgrade Service Isolation Quality of Service Isolated testing and development Ease of administration Ease of relocation and migration Virtualization Xen Features Escalabilidade Performance QoS Implementation Future Virtualization Techniques Single System Image: Ensim r , Vservers, CKRM, VirtuozzoTM, BSD r jail(), Solaris r Zones √ Groups processes in “resource containers” Hard to get isolation × Emulation: QEMU, Bochs √ Portable Extremely slow × Virtualization: VMware r , VirtualPC r √ Runs unmodified Operating Systems Virtualizing x86 is inefficient × User Mode Kernel: User Mode Linux, CoLinux Guest runs as a process on the host OS × Low performance (I/O, context switches) × Paravirtualization: Xen r , Denali √ Excellent performance Requires port to special architecture × Virtualization Xen Features Escalabilidade Performance QoS Implementation Future Virtualization Techniques Single System Image: Ensim r , Vservers, CKRM, VirtuozzoTM, BSD r jail(), Solaris
    [Show full text]
  • Virtualization
    Virtualization ...or how adding another layer of abstraction is changing the world. CIS 399: Unix Skills University of Pennsylvania April 6, 2009 (CIS 399 Unix) Virtualization April 6, 2009 1 / 22 What is virtualization? Without virtualization: (CIS 399 Unix) Virtualization April 6, 2009 2 / 22 What is virtualization? With virtualization: (CIS 399 Unix) Virtualization April 6, 2009 3 / 22 Why virtualize? (CIS 399 Unix) Virtualization April 6, 2009 4 / 22 Why virtualize? Operating system independence Hardware independence Resource utilization Security Flexibility (CIS 399 Unix) Virtualization April 6, 2009 5 / 22 Virtualization for Users Parallels Desktop and VMware Fusion have brought virtualization to normal computer users. Mostly used for running Windows programs side-by-side with OS X programs. Desktop use has pushed support for: I USB devices I Better graphics performance (3d acceleration) I Integration between the guest and host operating system and applications. (CIS 399 Unix) Virtualization April 6, 2009 6 / 22 Virtualization for Developers Build and test on multiple operating systems with a single computer. Use VM snapshots to provide a consistent testing environment. Run the debugger from outside the virtual machine. I Isolates the debugger and program from each other. I Allows easy kernel debugging. I Snapshotting and record/replay allow you to capture and analyze rare bugs. (CIS 399 Unix) Virtualization April 6, 2009 7 / 22 Virtualization for Business Hardware independence - upgrade hardware without reinstalling software. Resource utilization - turn 10 hosts with 10% utilization into 1 host with 100% utilization. Big power and cooling savings! Migration - move a server to a different machine without shutting it down.
    [Show full text]
  • Draft NISTIR 8221
    Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date June 5, 2019 Original Release Date September 21, 2018 Superseding Document Status Final Series/Number NISTIR 8221 Title A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data Publication Date June 2019 DOI https://doi.org/10.6028/NIST.IR.8221 CSRC URL https://csrc.nist.gov/publications/detail/nistir/8221/final Additional Information 1 Draft NISTIR 8221 2 3 A Methodology for Determining 4 Forensic Data Requirements for 5 Detecting Hypervisor Attacks 6 7 8 Ramaswamy Chandramouli 9 Anoop Singhal 10 Duminda Wijesekera 11 Changwei Liu 12 13 14 Draft NISTIR 8221 15 16 A Methodology for Determining 17 Forensic Data Requirements for 18 Detecting Hypervisor Attacks 19 20 Ramaswamy Chandramouli 21 Anoop Singhal 22 Duminda Wijesekera 23 Changwei Liu 24 Computer Security Division 25 Information Technology Laboratory 26 27 28 29 30 31 32 33 34 35 36 September 2018 37 38 39 40 41 U.S. Department of Commerce 42 Wilbur L. Ross, Jr., Secretary 43 44 National Institute of Standards and Technology 45 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 46 47 National Institute of Standards and Technology Internal Report 8221 48 27 pages (September 2018) 49 50 51 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 52 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 53 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 54 available for the purpose.
    [Show full text]