DOUG GOLDSTEIN STAR LAB XEN SUMMIT AUG 2016 ATTACK SURFACE REDUCTION
|
|
- Judith Farmer
- 5 years ago
- Views:
Transcription
1 DOUG GOLDSTEIN STAR LAB XEN SUMMIT AUG 2016 ATTACK SURFACE REDUCTION
2 OVERVIEW TOPICS Define attack surface Discuss parts of Xen s attack surface Attack surface metrics for Xen Define attack surface reduction What we ve accomplished to date Identify ways to reduce Xen s attack surface
3 DEFINTION ATTACK SURFACE Any privileged code with an interface (intentional or not) accessible by domains or OOB Before you can protect a system, you must understand your attack surface Best to break the model into functional-, design-, or role- based views Unfortunately its difficult to provide a metric on attack surface for a component but some items that are used but problematic lines of code CVEs relative complexity
4 METRICS LINES OF CODE Not as granular as we really want to get but good enough for this talk Used git tags and not the tarballs Hypervisor k k or ~4% gain k or ~10% gain Tools k k or ~4% gain k or ~4% gain
5 METRICS VULNERABILITIES & COMPLEXITY CVEs for all of Xen CVEs CVEs or ~60% increase CVEs to date (~65% of the way through the year) or ~ 45% decrease to date Complexity Anything that is developed relying on the Intel IA manual has a high degree of complexity
6 ATTACK SURFACE OF XEN HYPERVISOR hypercalls - many are unused based on PV or HVM instruction emulation - emulate in place SMM (x86) - management software / hardware that s under you hypervisors nesting - root hypervisor owns you DMA - evil devices or misconfigured devices live patch - run this code as ring -1 please migration / introspection - ability to peek into guest memory
7 ATTACK SURFACE OF XEN DOM0 qemu device model (i440fx) and all of its devices permissions root vs de-priv vs root in a container ability to open files, connections affect memory in the guest runs in dom0 by default legacy kernel APIs that are unused or untested missing or crashed daemons migration
8 DEFINITION ATTACK SURFACE REDUCTION The mitigation of security risks through the reduction of code exposed to users reduced feature sets aka reducing lines of code If you don t need a feature, don t build it in compartmentalizing to reduce scope of a feature aka reducing permissions
9 IMPROVEMENTS WAYS TO REDUCE THE ATTACK SURFACE WITH 4.7 hypervisor Kconfig - able to disable 14k LOC and at least 1 CVE XSM/Flask - reduce permissions by only having the access you need IOMMU - iommu=force hypervisor data pages marked R/O dom0 stubdoms - device model and xenstore disaggregate the hardware domain(s) from control domain pvgrub2 Unfortunately this is mostly disabled by default
10 ATTACK SURFACE REDUCTION HYPERVISOR Kconfig PVH / HVM / PV hypercall sets instruction emulation require hardware support and remove software fallbacks new features added should be Kconfig d but how will testing and graduating from preview work? add a STM (SMM transfer mode) to Xen signature checks for live patch
11 ATTACK SURFACE REDUCTION HYPERVISOR CONT D refactor instruction emulation (emulate in place vs emulate and modify) seccomp for hypercalls XSM/Flask by default make non-migratable / non-introspectable domains encrypted memory mode for nested hypervisor or domain SGX v3+ or AMD Secure Memory v2+
12 ATTACK SURFACE REDUCTION DOM0 granular ability to enable new features qemu migrate to q35 device model strongly consider using seccomp or unshare dynamically mark a VM unmigratable ship less qemu scripts need bash, python and perl
13 ATTACK SURFACE REDUCTION COMPARTMENTALIZATION One of the leading advantages of Xen over KVM and other HVs Xen really shines in this part of the security space Qubes / OpenXT / SecureView / Crucible Don t make security in Xen hard. Make it default. XSM/Flask proper policy can really limit the damage that can be done hardware domain vs control domain full MILS separation can not be achieved today however
14 ATTACK SURFACE REDUCTION COMPARTMENTALIZATION CONT D xenstore provides configuration parameters for front/back no way to limit what data can be shared between domains allowed to communicate with existing DAC xenstore-rs written in Rust for type and memory safety provides Flask-based security server and access vector cache supports Linux based dom0 (FreeBSD should work too) post-1.0 goals include support stubdom via Rust target for Xen
15 OVERVIEW SUMMARY Defined attack surface Provided some examples of attack surface Reviewed parts Xen s attack surface Discussed attack surface reduction Provided some examples of attack surface reduction Identified ways to reduce Xen s attack surface
16 Questions?
Towards a configurable and slimmer x86 hypervisor
Towards a configurable and slimmer x86 hypervisor Liu Wei Budapest July 11-13, 2017 Current state of affairs PV mode: no hardware extension needed, used in legacy systems, useful in certain cases like
More informationHypervisor security. Evgeny Yakovlev, DEFCON NN, 2017
Hypervisor security Evgeny Yakovlev, DEFCON NN, 2017 whoami Low-level development in C and C++ on x86 UEFI, virtualization, security Jetico, Kaspersky Lab QEMU/KVM developer at Virtuozzo 2 Agenda Why hypervisor
More informationThe only open-source type-1 hypervisor
Monika Danikáková What is Xen? The only open-source type-1 hypervisor For Unix and Unix-like OS Linux, NetBSD and OpenSolaris From ancient greek term Xenos (ξένος), guest-friends Developed by the University
More informationVirtually Impossible
Virtually Impossible The Reality of Virtualization Security Gal Diskin / Chief Research Officer / Cyvera LTD. /WhoAmI? Chief Research Officer @ Cvyera LTD Formerly Security Evaluation Architect of the
More informationVirtual Machines. Part 2: starting 19 years ago. Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved.
Virtual Machines Part 2: starting 19 years ago Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved. Operating Systems In Depth IX 2 Copyright 2018 Thomas W. Doeppner.
More informationWhat is KVM? KVM patch. Modern hypervisors must do many things that are already done by OSs Scheduler, Memory management, I/O stacks
LINUX-KVM The need for KVM x86 originally virtualization unfriendly No hardware provisions Instructions behave differently depending on privilege context(popf) Performance suffered on trap-and-emulate
More informationThe Price of Safety: Evaluating IOMMU Performance
The Price of Safety: Evaluating IOMMU Performance Muli Ben-Yehuda 1 Jimi Xenidis 2 Michal Ostrowski 2 Karl Rister 3 Alexis Bruemmer 3 Leendert Van Doorn 4 1 muli@il.ibm.com 2 {jimix,mostrows}@watson.ibm.com
More informationXen Project 4.4: Features and Futures. Russell Pavlicek Xen Project Evangelist Citrix Systems
Xen Project 4.4: Features and Futures Russell Pavlicek Xen Project Evangelist Citrix Systems About This Release Xen Project 4.4.0 was released on March 10, 2014. This release is the work of 8 months of
More informationIntroduction to SGX (Software Guard Extensions) and SGX Virtualization. Kai Huang, Jun Nakajima (Speaker) July 12, 2017
Introduction to SGX (Software Guard Extensions) and SGX Virtualization Kai Huang, Jun Nakajima (Speaker) July 12, 2017 1 INTEL RESTRICTED SECRET Agenda SGX Introduction Xen SGX Virtualization Support Backup
More informationSpring 2017 :: CSE 506. Introduction to. Virtual Machines. Nima Honarmand
Introduction to Virtual Machines Nima Honarmand Virtual Machines & Hypervisors Virtual Machine: an abstraction of a complete compute environment through the combined virtualization of the processor, memory,
More informationCrashOS: Hypervisor testing tool
ISSRE 2017 Anaïs GANTET - Airbus Digital Security October 2017 Outline 1 Why CrashOS? 2 CrashOS presentation 3 Vulnerability research and results October 2017 2 ISSRE Outline 1 Why CrashOS? 2 CrashOS presentation
More informationXen is not just paravirtualization
Xen is not just paravirtualization Dongli Zhang Oracle Asia Research and Development Centers (Beijing) dongli.zhang@oracle.com December 16, 2016 Dongli Zhang (Oracle) Xen is not just paravirtualization
More informationSecure Containers with EPT Isolation
Secure Containers with EPT Isolation Chunyan Liu liuchunyan9@huawei.com Jixing Gu jixing.gu@intel.com Presenters Jixing Gu: Software Architect, from Intel CIG SW Team, working on secure container solution
More informationModule 1: Virtualization. Types of Interfaces
Module 1: Virtualization Virtualization: extend or replace an existing interface to mimic the behavior of another system. Introduced in 1970s: run legacy software on newer mainframe hardware Handle platform
More informationHostless Xen Deployment
Hostless Xen Deployment Xen Summit Fall 2007 David Lively dlively@virtualiron.com dave.lively@gmail.com Hostless Xen Deployment What Hostless Means Motivation System Architecture Challenges and Solutions
More informationCSC 5930/9010 Cloud S & P: Virtualization
CSC 5930/9010 Cloud S & P: Virtualization Professor Henry Carter Fall 2016 Recap Network traffic can be encrypted at different layers depending on application needs TLS: transport layer IPsec: network
More informationIntel s Virtualization Extensions (VT-x) So you want to build a hypervisor?
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Mr. Jacob Torrey May 13, 2014 Dartmouth College 153 Brooks Road, Rome, NY 315.336.3306 http://ainfosec.com @JacobTorrey torreyj@ainfosec.com
More informationVirtualization Device Emulator Testing Technology. Speaker: Qinghao Tang Title 360 Marvel Team Leader
Virtualization Device Emulator Testing Technology Speaker: Qinghao Tang Title 360 Marvel Team Leader 1 360 Marvel Team Established in May 2015, the first professional could computing and virtualization
More informationCS 550 Operating Systems Spring Introduction to Virtual Machines
CS 550 Operating Systems Spring 2018 Introduction to Virtual Machines 1 How to share a physical computer Operating systems allows multiple processes/applications to run simultaneously Via process/memory
More informationVirtualization. Pradipta De
Virtualization Pradipta De pradipta.de@sunykorea.ac.kr Today s Topic Virtualization Basics System Virtualization Techniques CSE506: Ext Filesystem 2 Virtualization? A virtual machine (VM) is an emulation
More informationXen on ARM. Stefano Stabellini
Xen on ARM Stefano Stabellini What is Xen? a type-1 hypervisor small footprint (less than 90K LOC) Xen: Open Source GPLv2 with DCO (like Linux) Diverse contributor community Xen: Open Source source: Mike
More informationEffective Virtual CPU Configuration in Nova
Effective Virtual CPU Configuration in Nova Kashyap Chamarthy OpenStack Summit Berlin, 2018 1 / 39 Timeline of recent CPU flaws, 2018 (a) Jan 03 Spectre v1: Bounds Check Bypass Jan
More informationCSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
More informationOptimizing and Enhancing VM for the Cloud Computing Era. 20 November 2009 Jun Nakajima, Sheng Yang, and Eddie Dong
Optimizing and Enhancing VM for the Cloud Computing Era 20 November 2009 Jun Nakajima, Sheng Yang, and Eddie Dong Implications of Cloud Computing to Virtualization More computation and data processing
More informationVirtualization. Starting Point: A Physical Machine. What is a Virtual Machine? Virtualization Properties. Types of Virtualization
Starting Point: A Physical Machine Virtualization Based on materials from: Introduction to Virtual Machines by Carl Waldspurger Understanding Intel Virtualization Technology (VT) by N. B. Sahgal and D.
More informationCS-580K/480K Advanced Topics in Cloud Computing. VM Virtualization II
CS-580K/480K Advanced Topics in Cloud Computing VM Virtualization II 1 How to Build a Virtual Machine? 2 How to Run a Program Compiling Source Program Loading Instruction Instruction Instruction Instruction
More informationVirtualization. ! Physical Hardware Processors, memory, chipset, I/O devices, etc. Resources often grossly underutilized
Starting Point: A Physical Machine Virtualization Based on materials from: Introduction to Virtual Machines by Carl Waldspurger Understanding Intel Virtualization Technology (VT) by N. B. Sahgal and D.
More informationNested Virtualization and Server Consolidation
Nested Virtualization and Server Consolidation Vara Varavithya Department of Electrical Engineering, KMUTNB varavithya@gmail.com 1 Outline Virtualization & Background Nested Virtualization Hybrid-Nested
More informationCIT 480: Securing Computer Systems. Operating System Concepts
CIT 480: Securing Computer Systems Operating System Concepts Topics 1. What is an OS? 2. Processes 3. Memory management 4. Filesystems 5. Virtual machines A Computer Model An operating system has to deal
More informationLinux Virtualization Update
Linux Virtualization Update Chris Wright Japan Linux Symposium, November 2007 Intro Virtualization mini summit Paravirtualization Full virtualization Hardware changes Libvirt Xen Virtualization
More informationOperating system hardening
Operating system Comp Sci 3600 Security Outline 1 2 3 4 5 6 What is OS? Hardening process that includes planning, ation, uration, update, and maintenance of the operating system and the key applications
More informationCSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
More informationAdvanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
More informationVirtual Machine Monitors!
ISA 673 Operating Systems Security Virtual Machine Monitors! Angelos Stavrou, George Mason University! Virtual Machine Monitors 2! Virtual Machine Monitors (VMMs) are everywhere! Industry commitment! Software:
More informationMultiNyx: A Multi-Level Abstraction Framework for Systematic Analysis of Hypervisors. Pedro Fonseca, Xi Wang, Arvind Krishnamurthy
MultiNyx: A Multi-Level Abstraction Framework for Systematic Analysis of Hypervisors Pedro Fonseca, Xi Wang, Arvind Krishnamurthy Hypervisor correctness is critical Hypervisors need to virtualize correctly
More informationIntroduction to Cloud Computing and Virtualization. Mayank Mishra Sujesha Sudevalayam PhD Students CSE, IIT Bombay
Introduction to Cloud Computing and Virtualization By Mayank Mishra Sujesha Sudevalayam PhD Students CSE, IIT Bombay Talk Layout Cloud Computing Need Features Feasibility Virtualization of Machines What
More informationShadow2. Xen Technical Summit, Summer Tim Deegan (XenSource) & Michael Fetterman (U of Cambridge, Intel) Guilty parties:
Shadow2 Xen Technical Summit, Summer 2006 Guilty parties: Tim Deegan (XenSource) & Michael Fetterman (U of Cambridge, Intel) R Shadow2 Full replacement for the old (shadow1) code. As of about two weeks
More informationI/O and virtualization
I/O and virtualization CSE-C3200 Operating systems Autumn 2015 (I), Lecture 8 Vesa Hirvisalo Today I/O management Control of I/O Data transfers, DMA (Direct Memory Access) Buffering Single buffering Double
More informationVirtualisation: The KVM Way. Amit Shah
Virtualisation: The KVM Way Amit Shah amit.shah@qumranet.com foss.in/2007 Virtualisation Simulation of computer system in software Components Processor Management: register state, instructions, exceptions
More informationSR-IOV support in Xen. Yaozu (Eddie) Dong Yunhong Jiang Kun (Kevin) Tian
SR-IOV support in Xen Yaozu (Eddie) Dong (Eddie.Dong@intel.com) Yunhong Jiang Kun (Kevin) Tian Agenda SR-IOV specification overview Xen/SR-IOV architecture Discussions 2 SR-IOV specification overview Start
More informationThe Challenges of X86 Hardware Virtualization. GCC- Virtualization: Rajeev Wankar 36
The Challenges of X86 Hardware Virtualization GCC- Virtualization: Rajeev Wankar 36 The Challenges of X86 Hardware Virtualization X86 operating systems are designed to run directly on the bare-metal hardware,
More informationA Comparison Study of Intel SGX and AMD Memory Encryption Technology
A Comparison Study of Intel SGX and AMD Memory Encryption Technology Saeid Mofrad, Fengwei Zhang Shiyong Lu Wayne State University {saeid.mofrad, Fengwei, Shiyong}@wayne.edu Weidong Shi (Larry) University
More informationNested Virtualization Update From Intel. Xiantao Zhang, Eddie Dong Intel Corporation
Nested Virtualization Update From Intel Xiantao Zhang, Eddie Dong Intel Corporation Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED,
More informationW11 Hyper-V security. Jesper Krogh.
W11 Hyper-V security Jesper Krogh jesper_krogh@dell.com Jesper Krogh Speaker intro Senior Solution architect at Dell Responsible for Microsoft offerings and solutions within Denmark Specialities witin:
More informationXen on ARM ARMv7 with virtualization extensions
Xen on ARM ARMv7 with virtualization extensions Stefano Stabellini Why? Why? smartphones: getting smarter Quad-core 1.4 GHz Cortex-A9 ARM Servers coming to market 4GB RAM, 4 cores per node 3 x 6 x 4 x
More informationVirtualization. Michael Tsai 2018/4/16
Virtualization Michael Tsai 2018/4/16 What is virtualization? Let s first look at a video from VMware http://www.vmware.com/tw/products/vsphere.html Problems? Low utilization Different needs DNS DHCP Web
More informationSecurity for the Xen Hypervisor Status Quo & Perspective 2006
Security for the Xen Hypervisor Status Quo & Perspective 2006 Reiner Sailer Xen Summit 2006 IBM T J Watson Research Center 1/17/2006 1. Access Control Module 2. Virtual Trusted Platform Module 2 IBM T
More informationXen and the Art of Virtualization
Xen and the Art of Virtualization Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, Andrew Warfield Presented by Thomas DuBuisson Outline Motivation
More informationAMD Pacifica Virtualization Technology
AMD Pacifica Virtualization Technology AMD Unveils Virtualization Platform AMD Pacifica Tutorial 2 Virtual Machine Approaches Carve a Server into Many Virtual Machines Hosted Virtualization Hypervisor-based
More informationAdvanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
More informationThe Architecture of Virtual Machines Lecture for the Embedded Systems Course CSD, University of Crete (April 29, 2014)
The Architecture of Virtual Machines Lecture for the Embedded Systems Course CSD, University of Crete (April 29, 2014) ManolisMarazakis (maraz@ics.forth.gr) Institute of Computer Science (ICS) Foundation
More informationAdvanced Exploitation: Xen Hypervisor VM Escape
Advanced Exploitation: Xen Hypervisor VM Escape Shangcong Luan May 27, 2016 Alibaba Cloud Platform Security Team 1 Who am I? 2014-2015 at Vulnhunt Security Team for APT Defense 2015 - now at Alibaba Cloud
More informationViryaOS RFC: Secure Containers for Embedded and IoT. A proposal for a new Xen Project sub-project
ViryaOS RFC: Secure Containers for Embedded and IoT A proposal for a new Xen Project sub-project Stefano Stabellini @stabellinist The problem Package applications for the target Contain all dependencies
More informationCloud Computing Virtualization
Cloud Computing Virtualization Anil Madhavapeddy anil@recoil.org Contents Virtualization. Layering and virtualization. Virtual machine monitor. Virtual machine. x86 support for virtualization. Full and
More information1 Virtualization Recap
1 Virtualization Recap 2 Recap 1 What is the user part of an ISA? What is the system part of an ISA? What functionality do they provide? 3 Recap 2 Application Programs Libraries Operating System Arrows?
More informationLINUX Virtualization. Running other code under LINUX
LINUX Virtualization Running other code under LINUX Environment Virtualization Citrix/MetaFrame Virtual desktop under Windows NT. aka Windows Remote Desktop Protocol VNC, Dameware virtual console. XWindows
More informationVirtual Machine Virtual Machine Types System Virtual Machine: virtualize a machine Container: virtualize an OS Program Virtual Machine: virtualize a process Language Virtual Machine: virtualize a language
More informationSUSE Linux Enterprise Server: Supported Virtualization Technologies
Technical White Paper Enterprise Linux SUSE Linux Enterprise Server: Supported Virtualization Technologies Table of Contents page Comprehensive Virtualization Support Overview... 2 Upgrade Guidelines...4
More informationVirtualization. ...or how adding another layer of abstraction is changing the world. CIS 399: Unix Skills University of Pennsylvania.
Virtualization...or how adding another layer of abstraction is changing the world. CIS 399: Unix Skills University of Pennsylvania April 6, 2009 (CIS 399 Unix) Virtualization April 6, 2009 1 / 22 What
More informationOriginally prepared by Lehigh graduate Greg Bosch; last modified April 2016 by B. Davison
Virtualization Originally prepared by Lehigh graduate Greg Bosch; last modified April 2016 by B. Davison I. Introduction to Virtualization II. Virtual liances III. Benefits to Virtualization IV. Example
More informationKVM/ARM. Linux Symposium Christoffer Dall and Jason Nieh
KVM/ARM Linux Symposium 2010 Christoffer Dall and Jason Nieh {cdall,nieh}@cs.columbia.edu Slides: http://www.cs.columbia.edu/~cdall/ols2010-presentation.pdf We like KVM It s Fast, Free, Open, and Simple!
More informationLinux and Xen. Andrea Sarro. andrea.sarro(at)quadrics.it. Linux Kernel Hacking Free Course IV Edition
Linux and Xen Andrea Sarro andrea.sarro(at)quadrics.it Linux Kernel Hacking Free Course IV Edition Andrea Sarro (andrea.sarro(at)quadrics.it) Linux and Xen 07/05/2008 1 / 37 Introduction Xen and Virtualization
More informationCSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
More informationCSE 120 Principles of Operating Systems
CSE 120 Principles of Operating Systems Spring 2018 Lecture 16: Virtual Machine Monitors Geoffrey M. Voelker Virtual Machine Monitors 2 Virtual Machine Monitors Virtual Machine Monitors (VMMs) are a hot
More informationXen. past, present and future. Stefano Stabellini
Xen past, present and future Stefano Stabellini Xen architecture: PV domains Xen arch: driver domains Xen: advantages - small surface of attack - isolation - resilience - specialized algorithms (scheduler)
More informationCprE Virtualization. Dr. Yong Guan. Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University
Virtualization Dr. Yong Guan Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University Outline for Today s Talk Introduction Virtualization Technology Applications
More informationIntroduction to Qubes OS
Introduction to Qubes OS bhyvecon Tokyo 2014 @ntddk Self-introduction Yuma Kurogome(@ntddk) Takeda Lab @ KEIO Univ. Researching about security in low-layer Participant of Security Camp '11, '13 CTF player
More information64-bit ARM Unikernels on ukvm
64-bit ARM Unikernels on ukvm Wei Chen Senior Software Engineer Tokyo / Open Source Summit Japan 2017 2017-05-31 Thanks to Dan Williams, Martin Lucina, Anil Madhavapeddy and other Solo5
More informationSecure Server Project. Xen Project Developer Summit 2013 Adven9um Labs Jason Sonnek
Secure Server Project Xen Project Developer Summit 2013 Adven9um Labs Jason Sonnek 1 Outline I. Mo9va9on, Objec9ves II. Threat Landscape III. Design IV. Status V. Roadmap 2 Mo9va9on In a nutshell: Secure
More information24-vm.txt Mon Nov 21 22:13: Notes on Virtual Machines , Fall 2011 Carnegie Mellon University Randal E. Bryant.
24-vm.txt Mon Nov 21 22:13:36 2011 1 Notes on Virtual Machines 15-440, Fall 2011 Carnegie Mellon University Randal E. Bryant References: Tannenbaum, 3.2 Barham, et al., "Xen and the art of virtualization,"
More informationLINUX KVM FRANCISCO JAVIER VARGAS GARCIA-DONAS CLOUD COMPUTING 2017
LINUX KVM FRANCISCO JAVIER VARGAS GARCIA-DONAS CLOUD COMPUTING 2017 LINUX KERNEL-BASED VIRTUAL MACHINE KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware
More informationRMRR EXCLUSION. Technical Whitepaper. Alex Williamson Myron Stowe Laura Novich
RMRR EXCLUSION Technical Whitepaper Alex Williamson alex.williamson@redhat.com Myron Stowe myron.stowe@redhat.com Laura Novich lnovich@redhat.com Version 1.0 March 2015 1 100 East Davie Street Raleigh
More informationTowards Massive Server Consolidation
Towards Massive Server Consolidation Filipe Manco, João Martins, Felipe Huici {filipe.manco,joao.martins,felipe.huici}@neclab.eu NEC Europe Ltd. Xen Developer Summit 2014 Agenda 1. Use Cases and Goals
More informationOn the DMA Mapping Problem in Direct Device Assignment
On the DMA Mapping Problem in Direct Device Assignment Ben-Ami Yassour Muli Ben-Yehuda Orit Wasserman benami@il.ibm.com muli@il.ibm.com oritw@il.ibm.com IBM Research Haifa On the DMA Mapping Problem in
More informationZdeněk Kubala Senior QA
(Kernel) Isolation PV, HVM, OS-V technologies in Linux Introduction and description of the isolation diferences between HM, PV and OS-level virt. technologies. Zdeněk Kubala Senior QA Engineer zkubala@suse.com
More informationXen Project Status Ian Pratt 12/3/07 1
Xen Project Status Ian Pratt 12/3/07 1 Project Status xen.org and the Xen Advisory Board Xen project mission Ubiquitous virtualization Realizing Xen s architectural advantages From servers to clients Interoperability
More informationA Survey on Virtualization Technologies
A Survey on Virtualization Technologies Virtualization is HOT Microsoft acquires Connectix Corp. EMC acquires VMware Veritas acquires Ejascent IBM, already a pioneer Sun working hard on it HP picking up
More informationXen Project Overview and Update. Ian Pratt, Chairman of Xen.org, and Chief Scientist, Citrix Systems Inc.
Xen Project Overview and Update Ian Pratt, Chairman of Xen.org, and Chief Scientist, Citrix Systems Inc. Xen Community Story 2002 Oct Xen hypervisor development starts 2004 Xen 1.0 and 2.0 released, First
More informationCOMPUTER ARCHITECTURE. Virtualization and Memory Hierarchy
COMPUTER ARCHITECTURE Virtualization and Memory Hierarchy 2 Contents Virtual memory. Policies and strategies. Page tables. Virtual machines. Requirements of virtual machines and ISA support. Virtual machines:
More informationVirtualization and Performance
Virtualization and Performance Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
More informationPVHVM Linux guest why doesn't kexec work? Vitaly Kuznetsov Red Hat Xen Developer Summit, 2015
PVHVM Linux guest why doesn't kexec work? Vitaly Kuznetsov Red Hat Xen Developer Summit, 2015 Why? We support Red Hat Enterprise Linux. Bare hardware, virtualized and cloud environments,... Kernel issues
More informationOracle Corporation. Speaker: Dan Magenheimer. without the Commitment. Memory Overcommit. <Insert Picture Here>
2008 Memory Overcommit without the Commitment Speaker: Dan Magenheimer Oracle Corporation Overview What is overcommitment? aka oversubscription or overbooking Why (and why not) overcommit
More informationLaying a Secure Foundation for Mobile Devices. Stephen Smalley Trusted Systems Research National Security Agency
Laying a Secure Foundation for Mobile Devices Stephen Smalley Trusted Systems Research National Security Agency Trusted Systems Research Conduct and sponsor research to provide information assurance for
More informationVirtual Machines. Jinkyu Jeong Computer Systems Laboratory Sungkyunkwan University
Virtual Machines Jinkyu Jeong (jinkyu@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Today's Topics History and benefits of virtual machines Virtual machine technologies
More informationVirtual Machine Security
Virtual Machine Security CSE443 - Spring 2012 Introduction to Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ 1 Operating System Quandary Q: What is the primary goal
More informationTransforming XenServer into a proper open-source project
Transforming XenServer into a proper open-source project James Bulpin CTO, XenServer, Citrix About the speaker James Bulpin Head of technology for XenServer group in Citrix; member of the Citrix CTO office
More informationExtended Page Tables (EPT) A VMM must protect host physical memory Multiple guest operating systems share the same host physical memory VMM typically implements protections through page-table shadowing
More informationVirtualized SISCI. Extending Virtual Machines With a Shared Memory API Utilizing PCIe Networking. Halvor Kielland-Gyrud Master s Thesis Spring 2017
Virtualized SISCI Extending Virtual Machines With a Shared Memory API Utilizing PCIe Networking Halvor Kielland-Gyrud Master s Thesis Spring 2017 Virtualized SISCI Halvor Kielland-Gyrud February 15, 2017
More informationUsing a Separation Kernel to Protect against the Remote Exploitation of Unaltered Passenger Vehicles
Safety & Security for the Connected World Using a Separation Kernel to Protect against the Remote Exploitation of Unaltered Passenger Vehicles 16 th June 2015 Mark Pitchford, Technical Manager, EMEA Today
More informationXen Test Framework. Testing from a guest s perspective. Andrew Cooper. Citrix XenServer. Thursday 13 th July 2017
Xen Test Framework Testing from a guest s perspective Andrew Cooper Citrix XenServer Thursday 13 th July 2017 Andrew Cooper (Citrix XenServer) Xen Test Framework Thursday 13 th July 2017 1 / 13 Views on
More informationIntel Virtualization Technology Roadmap and VT-d Support in Xen
Intel Virtualization Technology Roadmap and VT-d Support in Xen Jun Nakajima Intel Open Source Technology Center Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS.
More informationUnit 2. VMMs and hypervisors 2966-Network and Services Virtualisation First semester Assistant professor: Katja Gilly Departament: Physics
Unit 2. VMMs and hypervisors 2966-Network and Services Virtualisation 2013-2014 First semester Assistant professor: Katja Gilly Departament: Physics and Computer Architectures Outline Introduction Xen
More informationData Center Virtualization: Xen and Xen-blanket
Data Center Virtualization: Xen and Xen-blanket Hakim Weatherspoon Assistant Professor, Dept of Computer Science CS 5413: High Performance Systems and Networking November 17, 2014 Slides from ACM European
More informationIndex. 3D support, 257. Boot firmware, 47 Boot trampoline, 40 Booting, 27 Borrowed virtual time scheduler, 219 Breakpoints, , 27
Index 3D support, 257 8086, 27 ACPI, see Advanced Configuration and Power Interface Adding new devices, 187 Address Space ID, 238 Administration tools, 200 Advanced Configuration and Power Interface, 259
More informationVirtualization technology
Virtualization technology Zhonghong Ou Post-doc researcher Data Communications Software (DCS) Lab, Department of Computer Science and Engineering, Aalto University Zhonghong Ou 16/10/2012 Aalto University
More informationOS Security IV: Virtualization and Trusted Computing
1 OS Security IV: Virtualization and Trusted Computing Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 More questions? 3 Virtual machine monitor +-----------+----------------+-------------+
More informationXen VT status and TODO lists for Xen-summit. Arun Sharma, Asit Mallick, Jun Nakajima, Sunil Saxena
Xen VT status and TODO lists for Xen-summit Arun Sharma, Asit Mallick, Jun Nakajima, Sunil Saxena R Outline VMX Guests Status Summary Status Domain0 restructuring PCI/IOAPIC X86-64 VMX guests enhancements
More informationDocker and Security. September 28, 2017 VASCAN Michael Irwin
Docker and Security September 28, 2017 VASCAN Michael Irwin Quick Intro - Michael Irwin 2011 - Graduated (CS@VT); started full-time at VT Sept 2015 - Started using Docker for QA June 2016 - Attended first
More informationAdvanced Operating Systems (CS 202) Virtualization
Advanced Operating Systems (CS 202) Virtualization Virtualization One of the natural consequences of the extensibility research we discussed What is virtualization and what are the benefits? 2 Virtualization
More informationVirtualization Introduction
Virtualization Introduction Simon COTER Principal Product Manager Oracle VM & VirtualBox simon.coter@oracle.com https://blogs.oracle.com/scoter November 21 st, 2016 Safe Harbor Statement The following
More information