Hypervisors and Next Generation Virtualization课件.ppt

精品文档 Hypervisors and Next Generation Virtualization William Strickland COT4810 Spring 2008 February 7, 2008 精品文档 Overview Origins Details Typical Usage Dark Side Darker Still In Better Hands 精品文档 Origins Hypervisor also known as Virtual Machine Monitor. Software emulating hardware to operating systems. First developed for Servers and Mainframes by IBM. Due to plentiful hardware not widely used, but fundamental method of virtualization. 精品文档 Details: Native Hypervisor Hypervisor directly on top of hardware. Emulates hardware to operating systems. Difficult to implement. 精品文档 Details: Hosted Hypervisor Runs under host operating system. Easier to implement. Less efficient. 精品文档 Details: x86 Architecture Instruction levels (rings) 0 to 3. Operating Systems use lowest ring (ring 0). Hardware does not support virtualization. 精品文档 Details: x86 Virtualization Support traditionally from layers of software to emulate privileged commands. Recent additions by AMD and Intel provide Virtualization support of hypervisors. Hypervisor code runs below operating systems and assumes control of hardware. 精品文档 Details: OS Paravirtualization Operating system to be virtualized is modified with hypervisor awareness. Avoids using commands that must be emulated, thus improving performance. Simplifies Hypervisor design and implementation. 精品文档 Typical Usage Machine Consolidation - More machines in one, for mutually exclusive function. Sandboxing – performing dangerous actions in contained environment. Whole System Mobility – moving whole system around. 精品文档 Dark side: VM rootkit Whole OS can be under command of software entity. Concerns Cross platform. No way to breach VM. Limitations On typical x86 hardware, hard to put an incumbent operating system into VM. Can detect if running in VM. 精品文档 Darker Still: Blue Pill New hardware support of hypervisors allows machine to be subverted much more easily. Concerns Act as stealthier rootkit. Hypervisor invisible to rest of system. L