{"id":41281,"date":"2020-02-07T09:28:13","date_gmt":"2020-02-07T06:28:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12"},"modified":"2020-02-07T09:28:13","modified_gmt":"2020-02-07T06:28:13","slug":"kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12","title":{"rendered":"Spole\u010dnost Siemens vydala hypervisor Jailhouse 0.12","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Spole\u010dnost Siemens <noindex><a rel=\"nofollow\" href=\"https:\/\/lkml.org\/lkml\/2020\/2\/4\/403\">publikovala<\/a><\/noindex> byl vyd\u00e1n voln\u00fd hypervizor <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/siemens\/jailhouse\">Jailhouse 0.12<\/a><\/noindex>. Hypervisor podporuje provoz na syst\u00e9mech x86_64 s roz\u0161\u00ed\u0159en\u00edmi VMX+EPT nebo SVM+NPT (AMD-V), stejn\u011b jako na procesorech ARMv7 a ARMv8\/ARM64 s roz\u0161\u00ed\u0159en\u00edmi pro virtualizaci. Samostatn\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/siemens\/jailhouse-images\">se vyv\u00edj\u00ed<\/a><\/noindex> gener\u00e1tor obraz\u016f pro hypervisor Jailhouse, vytv\u00e1\u0159en\u00fdch na z\u00e1klad\u011b bal\u00ed\u010dk\u016f Debian pro podporovan\u00e9 za\u0159\u00edzen\u00ed. K\u00f3d projektu <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/siemens\/jailhouse\">distribuov\u00e1no<\/a><\/noindex>  pod licenc\u00ed GPLv2. <\/p>\n<p>Hypervisor je implementov\u00e1n jako modul pro j\u00e1dro Linuxu a zaji\u0161\u0165uje virtualizaci na \u00farovni j\u00e1dra. Komponenty pro hostitelsk\u00e9 syst\u00e9my jsou ji\u017e sou\u010d\u00e1st\u00ed z\u00e1kladn\u00edho j\u00e1dra Linuxu. K \u0159\u00edzen\u00ed izolace se pou\u017e\u00edvaj\u00ed hardwarov\u00e9 mechanismy virtualizace, kter\u00e9 poskytuj\u00ed modern\u00ed CPU. V\u00fdznamn\u00fdmi vlastnostmi Jailhouse jsou lehk\u00e1 implementace a zam\u011b\u0159en\u00ed na p\u0159i\u0159azen\u00ed virtu\u00e1ln\u00edch stroj\u016f k pevn\u00e9mu CPU, oblastem RAM a hardwarov\u00fdm za\u0159\u00edzen\u00edm. Tento p\u0159\u00edstup umo\u017e\u0148uje na jednom fyzick\u00e9m v\u00edcej\u00e1drov\u00e9m serveru zajistit provoz n\u011bkolika nez\u00e1visl\u00fdch virtu\u00e1ln\u00edch prost\u0159ed\u00ed, z nich\u017e ka\u017ed\u00e9 je p\u0159id\u011bleno sv\u00e9mu procesorov\u00e9mu j\u00e1dru. <\/p>\n<p>P\u0159i pevn\u00e9 vazb\u011b na CPU se n\u00e1klady spojen\u00e9 s hypervizorem minimalizuj\u00ed a jeho implementace se v\u00fdrazn\u011b zjednodu\u0161uje, proto\u017ee nen\u00ed t\u0159eba slo\u017eit\u00e9ho pl\u00e1nova\u010de rozd\u011blov\u00e1n\u00ed zdroj\u016f \u2014 p\u0159id\u011blen\u00ed jednoho j\u00e1dra CPU zaru\u010duje, \u017ee na tomto CPU nebudou b\u011b\u017eet jin\u00e9 \u00fakoly. V\u00fdhodou tohoto p\u0159\u00edstupu je mo\u017enost zaru\u010dit p\u0159\u00edstup k prost\u0159edk\u016fm a p\u0159edv\u00eddateln\u00fd v\u00fdkon, co\u017e \u010din\u00ed Jailhouse vhodn\u00fdm \u0159e\u0161en\u00edm pro \u00fakoly vykon\u00e1van\u00e9 v re\u00e1ln\u00e9m \u010dase. Nev\u00fdhodou je omezen\u00e1 \u0161k\u00e1lovatelnost, kter\u00e1 z\u00e1vis\u00ed na po\u010dtu jader CPU.<\/p>\n<p>V terminologii Jailhouse se virtu\u00e1ln\u00ed prost\u0159ed\u00ed naz\u00fdv\u00e1 \u201ekamerami\u201c (cell, v kontextu jailhouse). Uvnit\u0159 kamery syst\u00e9m vypad\u00e1 jako jednoprocesorov\u00fd server, kter\u00fd vykazuje v\u00fdkon <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.google.com\/file\/d\/0B6HTUUWSPdd-Zl93MVhlMnRJRjg\/edit\">bl\u00edzk\u00fd<\/a><\/noindex> v\u00fdkonu vyhrazen\u00e9ho j\u00e1dra CPU. V komo\u0159e m\u016f\u017ee b\u011b\u017eet prost\u0159ed\u00ed libovoln\u00e9ho opera\u010dn\u00edho syst\u00e9mu, stejn\u011b jako zjednodu\u0161en\u00e1 prost\u0159ed\u00ed pro spu\u0161t\u011bn\u00ed jedn\u00e9 aplikace nebo speci\u00e1ln\u011b p\u0159ipraven\u00e9 samostatn\u00e9 aplikace ur\u010den\u00e9 k \u0159e\u0161en\u00ed \u00faloh re\u00e1ln\u00e9ho \u010dasu. Konfigurace je ur\u010dena v <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/siemens\/jailhouse\/blob\/master\/configs\/\">.cell-souborech<\/a><\/noindex>, kter\u00e9 definuj\u00ed p\u0159id\u011blen\u00e9 CPU, oblasti pam\u011bti a porty pro vstup\/v\u00fdstup. <\/p>\n<p><center><img decoding=\"async\" alt=\"Spole\u010dnost Siemens vydala hypervisor Jailhouse 0.12\" src=\"\/wp-content\/uploads\/2020\/02\/6cf944a2502d951e550625bfd39a3d38.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center><\/p>\n<p>V nov\u00e9 verzi<\/p>\n<ul>\n<li class=\"l\"> P\u0159id\u00e1na podpora platforem Raspberry Pi 4 Model B a Texas Instruments J721E-EVM;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/static.sched.com\/hosted_files\/kvmforum2019\/4b\/KVM-Forum19_ivshmem2.pdf\">P\u0159epracov\u00e1no<\/a><\/noindex> za\u0159\u00edzen\u00ed ivshmem, vyu\u017e\u00edvan\u00e9 pro organizaci interakce mezi bu\u0148kami. Nad nov\u00fdm ivshmem lze implementovat transport pro VIRTIO;\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/pics_base\/0_1580842059.png\"><img decoding=\"async\" alt=\"Spole\u010dnost Siemens vydala hypervisor Jailhouse 0.12\" src=\"\/wp-content\/uploads\/2020\/02\/f5785c8e73956397f69b56ec804c77c0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<li class=\"l\"> Implementov\u00e1na mo\u017enost deaktivace vytv\u00e1\u0159en\u00ed velk\u00fdch str\u00e1nek pam\u011bti (hugepage) k zablokov\u00e1n\u00ed zranitelnosti <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51852\">CVE-2018-12207<\/a><\/noindex> v procesorech Intel, co\u017e umo\u017e\u0148uje neprivilegovan\u00e9mu \u00fato\u010dn\u00edkovi vyvolat \u00fatok typu denial-of-service, vedouc\u00ed k z\u00e1vad\u011b syst\u00e9mu ve stavu \u201eMachine Check Error\u201c;\n<li class=\"l\"> Pro syst\u00e9my s procesory ARM64 byla implementov\u00e1na podpora SMMUv3 (System Memory Management Unit) a TI PVU (Peripheral Virtualization Unit). Pro izolovan\u00e1 prost\u0159ed\u00ed spu\u0161t\u011bn\u00e1 nad hardwarem (bare-metal) byla p\u0159id\u00e1na podpora PCI;\n<li class=\"l\"> Na syst\u00e9mech x86 pro ko\u0159enov\u00e9 kontejnery byla implementov\u00e1na mo\u017enost aktivace re\u017eimu CR4.UMIP (User-Mode Instruction Prevention), poskytovan\u00e9ho procesory Intel, kter\u00fd umo\u017e\u0148uje zak\u00e1zat vykon\u00e1v\u00e1n\u00ed n\u011bkter\u00fdch instrukc\u00ed v u\u017eivatelsk\u00e9m prostoru, jako jsou SGDT, SLDT, SIDT, SMSW a STR, kter\u00e9 mohou b\u00fdt vyu\u017eity v \u00fatoc\u00edch zam\u011b\u0159en\u00fdch na zv\u00fd\u0161en\u00ed privilegi\u00ed v syst\u00e9mu.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52310\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 Jailhouse 0.12. \u0413\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 x86_64 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 VMX+EPT \u0438\u043b\u0438 SVM+NPT (AMD-V), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 ARMv7 \u0438 ARMv8\/ARM64 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0434\u043b\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0434\u043b\u044f \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 Jailhouse, \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Debian \u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u0413\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41282,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 Jailhouse 0.12 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-07T06:28:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-07T06:28:13+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Spole\u010dnost Siemens vydala hypervisor Jailhouse 0.12 | ProHoster","description":"Spole\u010dnost Siemens vydala verzi voln\u00e9ho hypervisoru","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 Jailhouse 0.12 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Siemens \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u043b\u0438\u0437 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430","og:url":"https:\/\/prohoster.info\/cs\/blog\/kompaniya-siemens-vypustila-gipervizor-jailhouse-0-12","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-07T06:28:13+00:00","article:modified_time":"2020-02-07T06:28:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41281","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:17:48","updated":"2022-09-30 06:27:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=41281"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/41282"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=41281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=41281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=41281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}