A Virtual Machine Monitor for modern Cloud workloads.
Go to file
Rob Bradford 2c94773bdc docs: seccomp: Enhance strace command to print thread name
Signed-off-by: Rob Bradford <robert.bradford@intel.com>
2022-11-11 16:47:24 +00:00
.github build: Consolidate "gdb" build feature into "guest_debug" 2022-09-27 14:30:57 +01:00
acpi_tables build: Bulk dependencies update 2022-09-14 15:01:04 +01:00
api_client api-client: Allow response to be captured 2022-09-28 15:23:03 +01:00
arch AArch64/fdt: fix PMU irqflag calculation 2022-11-08 11:24:11 +00:00
block_util build: Bump io-uring from 0.5.7 to 0.5.8 2022-11-02 23:56:43 +00:00
devices misc: Fix clippy issues 2022-11-02 09:41:43 +01:00
docs docs: seccomp: Enhance strace command to print thread name 2022-11-11 16:47:24 +00:00
event_monitor build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
fuzz build: Bump rustix from 0.35.12 to 0.35.13 in /fuzz 2022-11-09 23:43:39 +00:00
hypervisor build: Bump env_logger from 0.9.1 to 0.9.3 2022-11-07 23:55:26 +00:00
net_gen build: bump vmm-sys-util from 0.9.0 to 0.10.0 2022-07-20 09:40:28 +00:00
net_util build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
option_parser option_parser: For tuple list type strip brackets only once 2022-08-08 16:23:00 +01:00
pci misc: Fix clippy issues 2022-11-02 09:41:43 +01:00
performance-metrics build: Bump clap from 4.0.17 to 4.0.18 2022-11-01 00:41:51 +00:00
qcow misc: Fix clippy issues 2022-11-02 09:41:43 +01:00
rate_limiter build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
resources build: Update development container to Rust 1.62 2022-07-05 11:50:46 +01:00
scripts tests: Skip building kernel if already present 2022-11-02 09:42:07 +00:00
serial_buffer vmm: Move SerialBuffer to its own crate 2022-08-30 13:47:51 +02:00
src vmm: Make Transparent Huge Pages controllable (default on) 2022-11-09 16:51:21 +00:00
test_data/cloud-init/ubuntu test_data: Use bash TCP support instead of netcat for boot check 2022-10-12 23:04:42 +01:00
test_infra misc: Fix clippy issues 2022-11-02 09:41:43 +01:00
tests tests: Disable test_snapshot_restore_hotplug_virtiomem for MSHV 2022-11-04 12:24:33 -07:00
tracer build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
vfio_user build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
vhdx build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
vhost_user_block build: Bump env_logger from 0.9.1 to 0.9.3 2022-11-07 23:55:26 +00:00
vhost_user_net build: Bump env_logger from 0.9.1 to 0.9.3 2022-11-07 23:55:26 +00:00
virtio-devices virtio-net: net: Wait for threads to exit on Drop 2022-11-10 07:46:16 -08:00
vm-allocator build: Bump libc from 0.2.135 to 0.2.137 2022-10-27 23:57:43 +00:00
vm-device build: Bump serde from 1.0.145 to 1.0.147 2022-10-24 08:41:05 +00:00
vm-migration vmm: virtio-devices: Restore every VirtioDevice upon creation 2022-10-24 14:17:08 +02:00
vm-virtio build: Release v27.0 2022-09-29 17:56:21 +01:00
vmm openapi: Add thp option to MemoryConfig 2022-11-09 16:51:21 +00:00
.gitignore rpm: Extend spec to support aarch64 and more 2022-05-25 10:08:27 +02:00
.rustfmt.toml build: migrate to Rust 2021 edition 2022-04-11 09:51:12 +01:00
build.rs misc: Automatic beta clippy fixes 2022-09-20 10:59:48 +01:00
Cargo.lock build: Bump darling from 0.14.1 to 0.14.2 2022-11-11 08:15:25 +00:00
Cargo.toml build: Bump clap from 4.0.17 to 4.0.18 2022-11-01 00:41:51 +00:00
CODE_OF_CONDUCT.md cloud-hypervisor: Adopt the Contributor Covenant code of conduct 2019-05-12 23:15:30 +02:00
CODEOWNERS ci: Adding a CODEOWNERS file 2022-05-18 14:03:37 +01:00
CONTRIBUTING.md CONTRIBUTING.md: Add sample pre-commit hook 2022-08-16 09:42:39 +01:00
CREDITS.md cloud-hypervisor: Add CREDITS 2019-05-12 23:15:30 +02:00
Jenkinsfile build: Consolidate integration testing to reused built assets 2022-11-02 09:42:07 +00:00
LICENSE-APACHE cloud-hypervisor: Add proper licensing 2019-05-09 15:44:17 +02:00
LICENSE-BSD-3-Clause cloud-hypervisor: Add proper licensing 2019-05-09 15:44:17 +02:00
MAINTAINERS.md docs: Update MAINTAINERS.md 2021-07-29 14:40:31 +02:00
README.md README.md: Add missing backslash to example code 2022-10-24 16:33:14 +02:00
release-notes.md build: Release v27.0 2022-09-29 17:56:21 +01:00

1. What is Cloud Hypervisor?

Cloud Hypervisor is an open source Virtual Machine Monitor (VMM) that runs on top of the KVM hypervisor and the Microsoft Hypervisor (MSHV).

The project focuses on running modern, Cloud Workloads, on specific, common, hardware architectures. In this case Cloud Workloads refers to those that are run by customers inside a Cloud Service Provider. This means modern operating systems with most I/O handled by paravirtualised devices (e.g. virtio), no requirement for legacy devices, and 64-bit CPUs.

Cloud Hypervisor is implemented in Rust and is based on the Rust VMM crates.

Objectives

High Level

  • Runs on KVM or MSHV
  • Minimal emulation
  • Low latency
  • Low memory footprint
  • Low complexity
  • High performance
  • Small attack surface
  • 64-bit support only
  • CPU, memory, PCI hotplug
  • Machine to machine migration

Architectures

Cloud Hypervisor supports the x86-64 and AArch64 architectures. There are minor differences in functionality between the two architectures (see #1125).

Guest OS

Cloud Hypervisor supports 64-bit Linux and Windows 10/Windows Server 2019.

2. Getting Started

The following sections describe how to build and run Cloud Hypervisor on the x86-64 platform. For getting started on the AArch64 platform, please refer to the AArch64 documentation.

Host OS

For required KVM functionality the minimum host kernel version is 4.11. For adequate performance the minimum recommended host kernel version is 5.6. The majority of the CI currently tests with kernel version 5.15.

Use Pre-built Binaries

The recommended approach to getting started with Cloud Hypervisor is by using a pre-built binary. Binaries are available for the latest release. Use cloud-hypervisor-static for x86-64 or cloud-hypervisor-static-aarch64 for AArch64 platform.

Packages

For convenience, packages are also available targeting some popular Linux distributions. This is thanks to the Open Build Service. The OBS README explains how to enable the repository in a supported Linux distribution and install Cloud Hypervisor and accompanying packages. Please report any packaging issues in the obs-packaging repository.

Building from Source

Please see the instructions for building from source if you do not wish to use the pre-built binaries.

Booting Linux

The instructions below are for the x86-64 platform. For AArch64 please see the AArch64 specific documentation.

Cloud Hypervisor supports direct kernel boot (if the kernel is built with PVH support) or booting via a firmware (either Rust Hypervisor Firmware or an edk2 UEFI firmware called CLOUDHV.)

Binary builds of the firmware files are available for the latest release of Rust Hyperivor Firmware and our edk2 repository

The choice of firmware depends on your guest OS choice; some experimentation may be required.

Firmware Booting

Cloud Hypervisor supports booting disk images containing all needed components to run cloud workloads, a.k.a. cloud images.

The following sample commands will download an Ubuntu Cloud image, converting it into a format that Cloud Hypervisor can use and a firmware to boot the image with.

$ wget https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img
$ qemu-img convert -p -f qcow2 -O raw focal-server-cloudimg-amd64.img focal-server-cloudimg-amd64.raw
$ wget https://github.com/cloud-hypervisor/rust-hypervisor-firmware/releases/download/0.4.1/hypervisor-fw

The Ubuntu cloud images do not ship with a default password so it necessary to use a cloud-init disk image to customise the image on the first boot. A basic cloud-init image is generated by this script. This seeds the image with a default username/password of cloud/cloud123. It is only necessary to add this disk image on the first boot.

$ sudo setcap cap_net_admin+ep ./cloud-hypervisor
$ ./create-cloud-init.sh
$ ./cloud-hypervisor \
	--kernel ./hypervisor-fw \
	--disk path=focal-server-cloudimg-amd64.raw path=/tmp/ubuntu-cloudinit.img \
	--cpus boot=4 \
	--memory size=1024M \
	--net "tap=,mac=,ip=,mask="

If access to the firmware messages or interaction with the boot loader (e.g. GRUB) is required then it necessary to switch to the serial console instead of virtio-console.

$ ./cloud-hypervisor \
	--kernel ./hypervisor-fw \
	--disk path=focal-server-cloudimg-amd64.raw path=/tmp/ubuntu-cloudinit.img \
	--cpus boot=4 \
	--memory size=1024M \
	--net "tap=,mac=,ip=,mask=" \
	--serial tty \
	--console off

Custom Kernel and Disk Image

Building your Kernel

Cloud Hypervisor also supports direct kernel boot into a vmlinux ELF kernel (compiled with PVH support). In order to support development there is a custom branch; however provided the required options are enabled any recent kernel will suffice.

To build the kernel:

# Clone the Cloud Hypervisor Linux branch
$ git clone --depth 1 https://github.com/cloud-hypervisor/linux.git -b ch-5.15.12 linux-cloud-hypervisor
$ pushd linux-cloud-hypervisor
# Use the cloud-hypervisor kernel config to build your kernel
$ wget https://raw.githubusercontent.com/cloud-hypervisor/cloud-hypervisor/main/resources/linux-config-x86_64
$ cp linux-config-x86_64 .config
$ KCFLAGS="-Wa,-mx86-used-note=no" make bzImage -j `nproc`
$ popd

The vmlinux kernel image will then be located at linux-cloud-hypervisor/arch/x86/boot/compressed/vmlinux.bin.

Disk image

For the disk image the same Ubuntu image as before can be used. This contains an ext4 root filesystem.

$ wget https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img
$ qemu-img convert -p -f qcow2 -O raw focal-server-cloudimg-amd64.img focal-server-cloudimg-amd64.raw

Booting the guest VM

These sample commands boot the disk image using the custom kernel whilst also supplying the desired kernel command line.

$ sudo setcap cap_net_admin+ep ./cloud-hypervisor
$ ./create-cloud-init.sh
$ ./cloud-hypervisor \
	--kernel ./linux-cloud-hypervisor/arch/x86/boot/compressed/vmlinux.bin \
	--disk path=focal-server-cloudimg-amd64.raw path=/tmp/ubuntu-cloudinit.img \
	--cmdline "console=hvc0 root=/dev/vda1 rw" \
	--cpus boot=4 \
	--memory size=1024M \
	--net "tap=,mac=,ip=,mask="

If earlier kernel messages are required the serial console should be used instead of virtio-console.

	--kernel ./linux-cloud-hypervisor/arch/x86/boot/compressed/vmlinux.bin \
	--console off \
	--serial tty \
	--disk path=focal-server-cloudimg-amd64.raw \
	--cmdline "console=ttyS0 root=/dev/vda1 rw" \
	--cpus boot=4 \
	--memory size=1024M \
	--net "tap=,mac=,ip=,mask="

3. Status

Cloud Hypervisor is under active development. The following stability guarantees are currently made:

  • The API (including command line options) will not be removed or changed in a breaking way without a minimum of 2 major releases notice. Where possible warnings will be given about the use of deprecated functionality and the deprecations will be documented in the release notes.

  • Point releases will be made between individual releases where there are substantial bug fixes or security issues that need to be fixed. These point releases will only include bug fixes.

Currently the following items are not guaranteed across updates:

  • Snapshot/restore is not supported across different versions
  • Live migration is not supported across different versions
  • The following features are considered experimental and may change substantially between releases: TDX, vfio-user, vDPA.

Further details can be found in the release documentation.

As of 2022-10-13, the following cloud images are supported:

Direct kernel boot to userspace should work with a rootfs from most distributions although you may need to enable exotic filesystem types in the reference kernel configuration (e.g. XFS or btrfs.)

Hot Plug

Cloud Hypervisor supports hotplug of CPUs, passthrough devices (VFIO), virtio-{net,block,pmem,fs,vsock} and memory resizing. This document details how to add devices to a running VM.

Device Model

Details of the device model can be found in this documentation.

Roadmap

The project roadmap is tracked through a GitHub project.

4. Relationship with Rust VMM Project

In order to satisfy the design goal of having a high-performance, security-focused hypervisor the decision was made to use the Rust programming language. The language's strong focus on memory and thread safety makes it an ideal candidate for implementing VMMs.

Instead of implementing the VMM components from scratch, Cloud Hypervisor is importing the Rust VMM crates, and sharing code and architecture together with other VMMs like e.g. Amazon's Firecracker and Google's crosvm.

Cloud Hypervisor embraces the Rust VMM project's goals, which is to be able to share and re-use as many virtualization crates as possible.

Differences with Firecracker and crosvm

A large part of the Cloud Hypervisor code is based on either the Firecracker or the crosvm project's implementations. Both of these are VMMs written in Rust with a focus on safety and security, like Cloud Hypervisor.

The goal of the Cloud Hypervisor project differs from the aforementioned projects in that it aims to be a general purpose VMM for Cloud Workloads and not limited to container/serverless or client workloads.

The Cloud Hypervisor community thanks the communities of both the Firecracker and crosvm projects for their excellent work.

5. Community

The Cloud Hypervisor project follows the governance, and community guidelines described in the Community repository.

Contribute

The project strongly believes in building a global, diverse and collaborative community around the Cloud Hypervisor project. Anyone who is interested in contributing to the project is welcome to participate.

Contributing to a open source project like Cloud Hypervisor covers a lot more than just sending code. Testing, documentation, pull request reviews, bug reports, feature requests, project improvement suggestions, etc, are all equal and welcome means of contribution. See the CONTRIBUTING document for more details.

Slack

Get an invite to our Slack channel and join us on Slack.

Mailing list

Please report bugs using the GitHub issue tracker but for broader community discussions you may use our mailing list.

Security issues

Please contact the maintainers listed in the MAINTAINERS.md file with security issues.