Siemens Company release of the open hypervisor . The hypervisor supports operation on x86_64 systems with VMX+EPT or SVM+NPT (AMD-V) extensions, as well as on ARMv7 and ARMv8/ARM64 processors with virtualization extensions. Separately image generator for the Jailhouse hypervisor, created based on Debian packages for supported devices. The project code is licensed under GPLv2.
is implemented as a module for the Linux kernel, providing virtualization at the kernel level. Components for guest systems are already included in the main Linux kernel. Hardware virtualization mechanisms provided by modern CPUs are used to manage isolation. The distinctive features of Jailhouse are its lightweight implementation and focus on binding virtual machines to a fixed CPU, memory areas, and hardware devices. This approach allows multiple independent virtual environments to operate on a single physical multi-core server, each tied to its own CPU core.
With strict binding to the CPU, the overhead from the hypervisor's operation is minimized and its implementation is greatly simplified since there's no need for a complex resource allocation scheduler — dedicating a CPU core guarantees that no other tasks will run on that CPU. The advantage of this approach is the ability to ensure guaranteed access to resources and predictable performance, making Jailhouse a suitable solution for creating tasks that require real-time operations. The downside is limited scalability, constrained by the number of CPU cores.
In Jailhouse terminology, virtual environments are referred to as 'cells'. Inside a cell, the system appears as a single-processor server, showing performance to that of a dedicated CPU core. An environment of any operating system can run in a cell, as well as stripped-down environments for running a single application or specially prepared separate applications for real-time tasks. The configuration is specified in , defining the allocated environment CPU, memory regions, and input/output ports.
In the new release,
- Added support for Marvell MACCHIATObin, Xilinx Ultra96 platforms,
Microsys miriac SBC-LS1046A, and Texas Instruments AM654 IDK; - Added statistics for each CPU core;
- Ensured PCI device reset upon camera shutdown;
- Device Tree structure adapted for the latest Linux kernel releases;
- Added protection against Spectre v2 attacks for ARM and ARM64 platforms. Latest QEMU releases have been considered in qemu-arm64 settings. Resolved issues with PSCI firmware overwrite on Orange Pi Zero boards;
- For the x86 platform, when launching demonstration environments (inmates), the use of SSE and AVX instructions has been enabled, and an exception report has been added.
Future plans include the long-awaited support for IOMMUv3, improving CPU cache efficiency (), addressing APIC issues on AMD Ryzen processors, redesigning the ivshmem device, and advancing drivers in the main kernel.
Source: opennet.ru
