Siemens ewepụtala hypervisor Jailhouse 0.12

Ụlọ ọrụ Siemens bipụtara ntọhapụ hypervisor efu Ụlọ mkpọrọ 0.12. Hypervisor na-akwado usoro x86_64 na VMX + EPT ma ọ bụ SVM + NPT (AMD-V), yana ARMv7 na ARMv8 / ARM64 processors na virtualization extensions. Iche iche na-eto eto ihe na-emepụta ihe onyonyo maka hypervisor Jailhouse, emepụtara dabere na ngwugwu Debian maka ngwaọrụ akwadoro. Koodu oru ngo kesara site ikike n'okpuru GPLv2.

A na-emejuputa hypervisor dị ka modul maka Linux kernel ma na-enye ihe ngosi na ọkwa kernel. Ngwa maka sistemụ ndị ọbịa etinyelarị na kernel Linux bụ isi. Iji jikwaa ịnọpụ iche, a na-eji usoro nrụpụta ngwaike nke ndị CPU ọgbara ọhụrụ nyere. Ihe dị iche iche nke Jailhouse bụ mmejuputa ya dị fechaa ma lekwasị anya na ijikọ igwe mebere na CPU, mpaghara RAM na ngwaọrụ ngwaike. Usoro a na-enye ohere ka otu sava multiprocessor anụ ahụ kwado ọrụ nke ọtụtụ gburugburu mebere onwe ha, nke ọ bụla na-ekenye ya na isi nhazi nke ya.

Site na njikọ siri ike na CPU, a na-ebelata elu nke hypervisor ma na-eme ka mmejuputa ya dị mfe nke ukwuu, ebe ọ bụ na ọ dịghị mkpa ịme usoro nhazi ihe onwunwe dị mgbagwoju anya - ịkenye isi CPU dị iche na-eme ka ọ bụrụ na ọ dịghị ọrụ ọzọ a na-eme na CPU a. . Uru nke usoro a bụ ikike ịnye ohere ịnweta akụrụngwa na arụmọrụ amụma, nke na-eme ka Jailhouse bụrụ ihe ngwọta kwesịrị ekwesị maka ịmepụta ọrụ ndị a na-eme ozugbo. Ọdịda ala bụ oke scalability, nke ọnụọgụ nke cores CPU kpaara ya.

N'okwu okwu Jailhouse, a na-akpọ gburugburu mebere “igwefoto” (cell, na ọnọdụ ụlọ nga). N'ime igwefoto, usoro ahụ dị ka ihe nkesa na-arụ ọrụ na-egosi arụmọrụ nso maka ịrụ ọrụ nke isi CPU raara onwe ya nye. Igwefoto nwere ike na-agba ọsọ gburugburu sistemụ arụmọrụ aka ike, yana ebe a na-ewepụghị ihe maka ịme otu ngwa ma ọ bụ ngwa ndị akwadoro nke ọma nke emebere iji dozie nsogbu ozugbo. Edebere nhazi ahụ .cell faịlụ, nke na-ekpebi CPU, mpaghara ebe nchekwa, na ọdụ ụgbọ mmiri I/O ekenyela gburugburu.

Na mwepụta ọhụrụ

• agbakwunyere nkwado maka Raspberry Pi 4 Model B na Texas Instruments J721E-EVM nyiwe;
• Emegharịrị ivshmem ngwaọrụ eji hazie mmekọrịta n'etiti cell. N'elu ivshmem ọhụrụ, ị nwere ike mejuputa njem maka VARTIO;
  

• Tinyere ikike iji gbanyụọ imepụta nnukwu ibe ebe nchekwa (hugepage) iji gbochie adịghị ike ahụ. CVE-2018-12207 na ndị na-arụ ọrụ Intel, nke na-enye ohere ka onye na-awakpo na-enweghị ohere ịmalite ịgọnarị ọrụ nke na-eme ka usoro ahụ kwụgidere na steeti "Nleba Nchekwa igwe";
• Maka sistemu nwere ndị nrụpụta ARM64, nkwado maka SMMUv3 (System Memory Management Unit) na TI PVU (Peripheral Virtualization Unit). agbakwunyere nkwado PCI maka gburugburu ndị dịpụrụ adịpụ na-agba n'elu ngwaike (bare-metal);
• Na usoro x86 maka igwefoto mgbọrọgwụ, ọ ga-ekwe omume ịme ka ọnọdụ CR4.UMIP (Mgbochi Ntuziaka Ntuziaka) nke ndị na-emepụta Intel na-enye, nke na-enye gị ohere igbochi mmezu nke ụfọdụ ntụziaka na oghere onye ọrụ, dị ka SGDT, SLDT, SIDT. , SMSW na STR, nke enwere ike iji mee ihe na ọgụ , iji mee ka ohere dịkwuo na usoro.

isi: opennet.ru