Based on the Linux host to the virtual machine problems

We do Linux-based arm of multimedia development, use of virtual machine virtual Linux, encountered a very depressed, is host to the virtual machine, install the VMTOOLS, PING Tung, but not always directly from the host directly drag files into the virtual machine.

Engaged for a long time, or modify a lot of things, but not always. May be copied from the host to the virtual machine's other way possible, but I think this approach is the simplest. So ask the expert, he asked my virtual machine account, I say that is the ROOT, he therefore enter the system settings — the server settings — — — — Samba server preferences – security – the guest account is set as ROOT., OK. Hope this issue, see my article BOLG, not engage in half a day.

Based on the i386 architecture implementation features of Linux — memory and process

Summary of the Linux kernel is designed to take into account a variety of microprocessors on implementation, have taken into account in the 64-bit microprocessors (such as Alpha) on the implementation of four, memory management, 1, the basic framework of the Linux kernel is designed to take into account a variety of microprocessors on implementation, have taken into account in the 64-bit microprocessors (such as Alpha) implementation, not only for i386 architecture to design its mapping mechanism, but to just mock, virtual microprocessors and MMU (memory management unit) as the basis for designing a common pattern, then treat it separately to concrete microprocessor.

Thus, the Linux kernel mapping mechanism is designed into three layers, in the page directory and page table created a layer of "intermediate directories". In code, page directory called PGD, the intermediate directory called PMD and page table called PT. The table entries are called PT PTE. PGD, PMD, PT is an array, appropriate, and logically also linear address from high to low is divided into 4 members section, an area several, as the directory index of PGD, the intermediate directory PMD of subscripts, page table of subscript and displacement of the physical page. On the i386 processor, the CPU is actually not by three layers but by a two-tier model to address mapping, which will need to use a virtual three-tier mapping to concrete two layers of mapping, skipping the intermediate of PMD levels. 2. address mapping of the entire process will be on i386 microprocessors in the address you type mapping, and then to make a page style mapping. While the Linux approach actually make-mapping process does nothing for me. Following a simple procedure to see Linux under address mapping of the whole process: the # include greeting () {printf ("Helloworld! ”); }　　main()　　{　　greeing(); The procedures in the master} function call greeting to display "Helloworld!" , Compiled and disassembly, we received the results of its disassembly. 08048568: 8048568: 55push1% ebp 8048856b: 89e5mov1% esp,% ebp 804856b: 6804940408push1 $ 0x8048404 8048570: e8fffeffffcall8048474 8048575: 83c404add1 $ 0x4,% esp 8048578: c9leave 8048579: c3ret 804857a: 89f6mov1% esi,% esi 0804857c: 804857c: 55push1% ebp 804857d: 89e5mov1% esp,% ebp 804857f: e8e4ffffffcall8048568 8048584: c9leave 8048585: c3ret 8048586: 90nop 8048587: 90nop as can be seen from above, greeting () address to 0x8048568. In elf format executable code, always start Scheduler 0x8000000 "snippet", on each program. When the program is executed in the main to the "call8048568" this instruction that you want to transfer to a virtual address 8048568. First, type mapping phase. Address 8048568 is a program of the portal and, more importantly, in the implementation process have CPU's EIP points to, so in the code snippet. I386cpu use CS's current value as a selection of maps. Kernel in the establishment of a process is to set its segment registers, DS, ES, SS are set into the CS _USER_DS, set to _USER_CS, that is to say, in the Linux kernel stack segment and code snippets are not. IndexTIDPL # define_KERNEL_CS0x100000000000010 | 0 | 00 # define_KERNEL_DS0x180000000000011 | 0 | 00 # define_USER_CS0x230000000000100 | 0 | 11 # define_USER_DS0x2B0000000000101 | 0 | 11 _KERNEL_CS: index = 2, TI = 0, DPL = 0 _KERNEL_DS: index = 3, TI = 0, DPL = 0 _USERL_CS: index = 4, TI = 0, DPL = 3 _USERL_DS: index = 5, TI = 0, DPL = 3 TI are all 0, use the global Description table. The kernel of DPL is 0, the highest level; user of DPL is 3, the minimum level. _USER_CS GDT is the table in item 4, the code initializes the GDT content as follows: ENTRY (gdt-table) .quad0x0000000000000000/* .quad0x0000000000000000 NULLdescriptor *//* notused */.quad0x00cf9a00000ffff/* .quad0x00cf920000 0x10kernel4GBcodeat0x00000000 */0ffff/* .quad0x00cffa00000ffff 0x18kernel4GBdataat0x00000000 *//* 0x23user4GBcodeat0x00000000 */.quad0x00cff200000ffff/* 0x2buser4GBdataat0x00000000 */GDT table first, second, and third to fifth total four corresponds to the previous four segment register values. The four items of content description: K_CS: 00000000110011111001101000000000 00000000000000001111111111111111 K_DS: 00000000110011111001001000000000 00000000000000001111111111111111 U_CS: 000000001100111111111101000000000 00000000000000001111111111111111 U_DS: 00000000110011111111001000000000 00000000000000001111111111111111 these four description of the following content is the same. · BO-B15/B16-B31 0 base address full-0 · LO-L15, L16-L19 are 1 segment boundaries are 0xfff · G-bit is 1 long are 4 · D-bit are 132-bit instruction · P bit is 1 four segments in memory is the permission levels for different, kernel, user level 0 to level 3. So, each segment is from address 0 start to the entire virtual memory space 4GB, virtual address to a linear address mapping to maintain the original value unchanged. Back to greeting program through-map the address 8048568 mapped to itself, be a linear address. Each process has its own page directory each time a scheduled a PGD, the process to enter is running, the kernel will have to be running process set up control register CR3, MMU hardware is always obtained from the CR3 of current processes in the page directory pointer. When a program wants to go to address 0x8048568, processes are running, CR3 is already set up to point to this process in the page catalog. 8048568: 00001000000001001000010101101000 follow the linear address format, maximum 10 0000100000, decimal 32, 32 on the following scale to the page catalog table to find the page directory entries. This page directory entries of 20 bits followed on 12 0 to get a pointer to the page table. Find the page table, and then look at the middle of the linear address 10 bit 001001000, 72 in decimal. The 72-subscript in the found page table to find the corresponding table entries. Page table entries to high 20-bit added after 12 0 got physical memory base address of the page. Linear 12-bit address of the base and the base address of the physical page is added to access physical address. 3 address mapping efficiency analysis in page-mapping process, the CPU to access memory, three times, first page directory, the second is page table, the third is the real target you want to access. In this way, the original without paging mechanism once the memory can be accessed, changed three times the memory can be accessed, the obvious implementation of pagination in efficiency is too large for the sacrifice. In order to reduce this overhead, has recently been performed by address translation results will be retained in the MMU conversion fallback buffer (TLB). Although at the first available to specific page contents and page table to read into memory, but once you have mounted the TLB, you do not need to go read up in memory, and all these are done by the hardware, so quickly. TLB corresponding permissions greater than 0 level that is not visible, only at the system level 0 of the program to manipulate it. When the contents of the CR3 changes, all of the contents of TLB will be automatically become invalid. Linux in _flush_tlb macros is the use of this work. _Flush_tlb just two compilation instructions, the CR3 value stored in the temporary variable tmpreg and immediately tmpreg values are copied back to the CR3, so will the entire contents of TLB to is not valid. In addition to the invalid all the contents of TLB, have selected an invalid tlb a record, it will use to INVLPG instruction. 5. process management 1.I386 hardware tasks switching mechanism in the Intel i386 architecture design takes into account the processes of management and scheduling, and hardware support to switch between tasks. To this end, Intel in i386 system structure created a new section "task state segment" TSS. A TSS although like code snippets, segments, etc., is also a paragraph, it is a 104 bytes of data structure, used to record a task critical state information. Like other segments, the TSS to description table has a table entry. Although TSS can only GDT, but should not be placed in any LDT in or IDT. To select an item from one section to access a TSS, and select the item in TI-bit is 1, will result in a GP exception. In addition, the CPU is also an additional task register TR, a pointer to the current tasks of the TSS. Accordingly, it has added one instruction LTR, TR-register for mount operation. Like CS and DS, TR also have a program that is not visible, choose a section whenever the code loaded into TR, the CPU would be self--Find the TSS description entry and loaded into the program invisible TR to accelerate later access TSS segment. Also, in the IDT tables, in addition to interrupt the trap door, door and call door that also defines a task. Task door contains one paragraph selected codes. TSS When the CPU was interrupted while passing through a door, the task of selecting code in the door automatically mount TR, TR point to the new TSS, and complete the task switching. CPU also can pass JMP and CALL instructions for task switching, when jump or call target segment actually point to one of the GDT table describing the item, the TSS will cause a task switching. 2.Linux task switching and field protection of Intel design on task switching is very comprehensive, but provides a very simple task switching mechanism. However, Linux does not use i386 hardware supplied task switching mechanism. Linux is doing, is to a great extent from the efficiency point of view. There is a CPU automated this task switching is not only the equivalent of one instruction. In fact, JMP instruction in through the i386 or CALL instructions to complete the task switching process is a fairly complex process, its implementation process up to 300 CPU clock cycle. In the implementation process, the CPU is actually done all you need to do, but some of it under certain conditions

Fedora Linux system to mount USB disk and Windows disk

The premise is that in mnt directory, F, D, U, there are three directories are sda, hda-i.e. the difference between serial and parallel communication hard disk root @ localhost yan] # vi/etc/fstabLABEL =//ext3defaults11tmpfs/dev/shmtmpfsdefaults00devpts/dev/ptsdevptsgid = 5, mode = 62000sysfs/syssysfsdefaults00proc/procprocdefaults00/dev/sda7/mnt/Fvfatcodepage = 936, iocharset = cp93600/dev/sda5/mnt/Dvfatcodepage = 936, iocharset = cp93600/dev/sdb1/mnt/Uvfatcodepage = 936, iocharset = cp93600LABEL = SWAP-sda8swapswapdefaults00 to run execute command # mount-aOK, Gao Ding.

Autojump: at the command line to quickly change directory

At the command line, I usually use the cd command to change directory.

However, in most cases, cd command requires users to provide the necessary path information to reach a goal. Autojump overcomes this, it is able to automatically maintain the directory that contains the user's use of the database, and then you only need to enter j plus you want to change the directory part of the name can quickly jump to that directory. If you do not understand what the author said, you may wish to take a look at the screenshot above. By jumpstat can view the specific contents of the database. For example, when I want to change the directory to, simply perform/home/xiaodong/bin/wog jwo. Autojump source code published in the GPLv3 license, may obtain from git. General Linux release users can perform the install.sh script to install autojump, Archlinux users can also install from yaourt. autojump

Comments on seven best biyuan Linux application

AdobeFlash and Linux for the month of May 2006, Adobe Systems (AdobeSystems) company has released a Beta for the Linux operating system and version FlashPlayer9 player final version will be launched in early 2007.

According to the FAQ, Adobe released the Linux version of FlashPlayer9 features and Windows versions and Mac Edition basically the same, but the version currently does not support full-screen mode and SSL encryption, but Adobe said it would in the final version of the inclusion of these two characteristics. Developers can also use Adobe Flex2 software development kit to develop new applications, these Flash programs will run on Windows, MacOS or Linux operating system. It is understood that the version of FlashPlayer9 is applicable to all mainstream Linux operating system, however Adobe currently only on RedHat and NovellSUSE system has been tested. At that time, Adobe refused to disclose when posting a 64-bit Ultimate Edition FlashPlayer9. Half a year later, Adobe does not have his word. January 17, 2007, Adobe Systems Inc. announced that it will provide to the other Linux vendors FlashPlayer9. This also means that the Linux version of FlashPlayer9 has officially come out. Linux version of Flash Player to enable scanning of network browser, such as multimedia content appear on the Internet of all modern advertising. Adobe said, Windows and Macs version of Flash9 have released six months, the Linux version of the publication to the Linux community to access the Internet a lot of Flash content. The software is also compatible with online video services such as YouTube and GoogleVideo etc, this is the open source platform for the first time in support of this emerging technology. Linux version of FlashPlayer9 player software requires minimal configuration to 800MHz processor and 512 MB memory card memory, as well as 128M video card. At the same time, in order to compatible Advanced Linux sound capabilities, users also need to install the appropriate packages. At that time, the industry's only two supported the player software Linux publishers for RedHat and SuSE. In fact, early in the month of October 2006, the Adobe company has released the beta test version of software, and expressed the hope that more of the Linux operating system versions support the software. Analysts said that Adobe's behavior, marking the company for the open source operating system, increasing the degree of importance, at the same time for Linux platform network applications, the degree of importance has also been improved. On the other hand, the company said that currently plan to launch Linux platform for free software development kit SDK, called the FlexSDK. As Adobe's senior product manager, Amy said, free development kit SDK release, "will put the user into web2.0 Internet experience at the forefront of. "It is understood that the Web2.0 is now the most popular on the Internet, now available in the popular Web2.0 services with Google email service Gmail, Flickr, etc, it is understood that the service will replace the traditional network applications. In order to better compatibility, users often Web2.0 service requires the installation of a browser software, and third-party plug-ins, such as Java and Flash, etc. Compared with the previous version, Linux version of FlashPlayer9 player run faster than 10 times. To make the programmer uses Adobe Flex2 development platform performance writing portable applications. The new version of Flash Player to the Web site provides developers access to more Linux using the Adobe Internet applications and Flex2 development environment. Flex platform including extracting enterprise application data in the server components, such as enterprise resource planning. On the client side, and the current version of Flash Player. Linux version of FlashPlayer9 player have the disadvantage that stability is not very good, and has high CPU usage so that the browser crashes. So the next version of one of the main task is to increase performance. Adobe's Flash is currently one of the universally recognized standards, Red Hat and Novell have announced plans in late 2007 in their Linux bundled version of the player in the sales. 2008 may 15, Adobe released a follow OpenFlash project technology open standards AdobeFlashPlayer10 Linux preview version, code named "Astro". This publication is Adobe's first synchronization publication Windows, MacOSX and Linux system AdobeFlashPlayer. According to Adobe, the new version mainly enhances functionality and users visual experience, the program can be interactive design and development, to establish the beauty of the richest Web experience. This open Beta version offers to developers, and consumers can also be tested Adobe want users to be able to provide feedback on new features of the test to the program enhancements and improved compatibility. If you have already installed the AdobeFlashPlayer10 beta, you can watch an interactive demo of Adobe. The biggest highlight of the software is to be the original two-dimensional plane of an image through special processing to pure 3D animation is displayed. At the same time Flash10 can transfer rate automatically match. That is when you use Flash sowing into network file, it will automatically detect the current network bandwidth, according to the different network environment to automatically adjust the variable that you want to achieve0 cache of the target. This means that Flash10 has more on the ability of the network environment.

Experts discuss: Linux is the most secure operating system?

News on the Linux operating system is often in the IT industry publication.

Many news about its security features. In fact, however, claims that "Linux is all operating system most secure" this argument is exaggerated. Although many Linux distributions compared to Microsoft Windows operating system and the security of the operating system of Apple MacOSX much better, but there is evidence that most of Linux distributions are not comparable to the standard FreeBSD operating system, let alone in common operating systems may have the best safety record of the OpenBSD operating system. Culling as RTOSes, IBMi, OpenVMS and TrustedBSD, used for special purposes of the operating system. Many people tend to think: the operating system than closed source code, the popular open source operating system, has certain security advantages. They put Linux as an open source operating system, and Microsoft Windows operating system is a closed source code. In such an alternative, you should select the "Linux is the most secure operating system". But the real world is not that simple. In fact, Linux is abstract, it wasn't one of the most secure operating system. In fact, there are some Linux distributions is intentionally in the default configuration does not provide complete security assurances. Overall, the Linux operating system of security is in between the two extremes. In addition, identify the most secure operating system is not so simple. Most people do not know what is the real security, as well as how to conduct a security assessment. Even for the professionals, safety factors involved are numerous: · code quality audit · default security configuration · patch quality and response time · privilege separation schema ... ... Other more aspects

Use SELinux and Smack reinforced lightweight containers

Security objective we cannot blindly applying policies and expectations bring some value, but you should first define clear security goals.

Smack simplicity indeed qualify achievable objectives, we will seek to achieve the following objectives: to use the provided Web and ssh service isolation of file system to create the container. The container should be independent and to protect each other's security. Container vs1 cannot read another container vs2 files or interrupt its mandate. Host key files without a container. External access to the container's Web server and ssh server. General settings in this article, we will conduct two experiments: first set by SELinux protection container, and then set the container by the Smack protection. These two experiments demonstrates most of the basic settings. You can use a real machine to complete these two experiments, but easier to use the virtual machine. Kvm qemu or you want to use, you can create a hard disk qemu-imgcreatevm.img10G. Use the command boot from CDROM kvm-hdavm.img-cdromcdrom.iso-bootd-m512M virtual machine. To get the CDROM images, you can download from fedoraproject.org/get-fedora Fedora10fori386 installation DVD. Use the download file to replace the name of a command in cdrom.iso. The basic installation process, you can use the default, but you must not choose, but choose officeandproductivity softwaredevelopment. In addition, you need to use the yum package manager to install debootstrap and ncurses-develrpms bridge-utils,. Now you need to compile a custom kernel. Download kernel source rpm and use patch enable-netns.patch (see download section) to provide a network name space (the 2.6.29 for upstream (upstream), but is not in the Fedora10), and then change the configuration and compile and install. This requires as a root user with the following directives: yumdownloader--sourcekernelrpm-ikernel * cdrpmbuildrpmbuild-bcSPECS/kernel-* cdBUILD/kernel-2.6.27/<~ nable-netns.patcmakemenuconigmake&&makemodules_install&&makeinstall对于这两个实验，在makemenuconfig步骤中都需要选择networknamespaces（在networkingsupport-="">linux-2.6 * patch-p1 Networkingoptions menu). Experimental for Smack, you also need to enter the menu, deselect Securityoptions SELinux and selects the next option Smack. You will also need to be in default of/boot/grub/grub.conf boot entries to 0 instead of 1. Now we try liblxc. "LXC: Linux container tool" details liblxc basic usage, so there is no longer talk. Just use container_setup.sh script (see download section) to set up network bridge (bridge), container network devices will in this dialogue. It also clears the firewall (the default does not handle the bridges), and in the conduct of experimental set Smack Smack policy (we will create the file/etc/smackaccesses). After each reboot, or must run container_setup.sh set to run automatically at boot time (if you know how to do it). Now you are ready to virtual machine we to try liblxc. You can download from cvs lxc.sf.net through the latest source code and compile it as described in the following way: cvs-d pserveranonymous@lxc.cvs.sourceforge.net:/cvsroot/lxc logincvs-z3-d pserveranonymous@lxc.cvs.sourceforge.net:/cvsroot/lxc co-Plxccdlxc./bootstrap & & & &./configure & & make makeinstall now, if you view the README document, will find that there are several entry points can be selected. Container is very lightweight, because they share many of the resources and systems — including the file system. But our goal is to provide some simple isolation, use a script for each container lxc-debian create complete debianchroot image. First create a container named vsplain: mkdir/vsplaincd/vsplainlxc-debiancreatecontainername: vsplainhostname: vsplainIP10.0.2.20gateway: 10.0.2.2 the container's configuration is stored in/usr/local/var/lxc/vsplain directory. If you find a file named cgroup would see some to deVices. at the beginning of the line. These are device whitelist cgroup directive that coordinates implementation of device by the container to create, read and write. Use the command to start the container lxc-start-nvsplain. The login prompt appears. By does not require a password for the root user name to log on to the container. Finally, when the container is running, you need to execute the following command: apt-getinstallopenssh-serverapt-getinstallapace can now use ssh technology safely from the kvm host to the container, and use vsplain and host IP address (namely 10.0.2.20 and 10.0.2.15) see its Web page. You can pass command lxc-stop-nvsplain root from the kvm host container terminal is closed. Here, from this template clone two new virtual machines can save some time. Turn off vm and execution: cpvm.imgselinux.imgcpvm.imgsmack.img