LFCOLLAB15: Xen 4.5 and Beyond

Editor's Notes

1. 50 Minutes! ACTUAL TALK TIME The 4.5 release no a minor "point" update: it is one of the most feature-rich releases in the project's history. It contains several important additions. Most notably, new Xen PVH virtualization mode now supports running as dom0, enhanced support for Remus, significant ARM architecture updates, security improvements, real-time scheduling, support for Intel Cache Monitoring Technology (CMT), as well as improvements for automotive and embedded use-cases. Other enhancements include additional support for FreeBSD, systemd support, additional libvirt support, the release of Mirage OS 2.0, and more. Besides giving an overview of Xen 4.5, we will explain the project's roadmap process and share what's ahead for 2015: such as improved OpenStack integration and hotpatching (applying security fixes without the need to reboot).
2. Remo
3. TIMING: 35 MINUTES
4. Unit tests, Tempest
5. = 18 MINS = Ties back to the previous use-case
6. Notes: Seen up to 6 VM’s with graphics at good performance TODO: a few notes to zoom stuff forward (playing time)
7. = 22 MINS = Virt spectrum
8. PVH Dom0 : Why relevant? E.g. on EC2 when you chose HVM for Linux and the Linux, you actually get PVHVM – while you get HVM + PV drivers for Windows
9. PVH Dom0 : Why relevant?
10. 2nd part: On x86-32 ISA, Xen ran PV guest kernels in ring 1 to protect the hypervisor from the guests. x86-64 ISA removed rings 1 and 2 (leaving ring 0 for kernels and ring 3 for userspace) and eliminated the segmentation mechanism. This means that on x86-64, the guest kernel and userspace both run in ring 3, requiring a complete TLB flush for transitions between them. This is very expensive and is part of the reason why HVM can outperform PV x86-64 Hardware for some workloads
11. HPET=High Precision Event Timer Soft affinity=sysadmin to define an arbitrary set of physical CPUs on which vCPUs prefer to run on
12. = 27 MINS = VMI – HW assisted Security Process Changes Next (Table)
13. 32 vulnerabilities in 2014 : some require a several conditions to hold at the same time, some affect code and configurations that is not used in a standard hosting provider config Of course the same applies to LXC and KVM Assumptions Intel x86 CPU general purpose operating system as the guest attacker has already gained control of the guest vulnerabilities which, for example, a cloud hosting provider would worry about (containers and KVM both make the case that they are secure in such environments)
14. Dedicated: other features, such as PVH, etc. also have a security dimension TPM=standard for a secure cryptoprocessor There has been a lot of security functionality in Xen for a long time, BUT it is primarily used in a very narrow market segment. Reasons: Security wasn’t such a hot topic until recently. Some of these features in Xen were not well documented, enabled by default … --- Early signs are that this is changing: and you can see some of this if you look at the work which is currently performed by various stake-holders in the community
15. LibVMI: target’s Xen but support for other HV exists (but Xen is by far the best supported). LibVMI: KVM support is rather “rough”. KVM doesn't have the same type of APIs as Xen does to map VM memory into another process, or to forward events. Although some work is going on to improve the situation. 1) Two features that the Bitdefender guys added was the capability to inject pagefaults so that the guest OS would bring back paged-out memory.  2) The other one is mem_access-emulate(-with-no-write) which is very handy when you are tracing the VM execution with EPT permissions (mem_access) you don't need to reset the page permissions every time a trap is hit to let the VM progress. If the -with-no-write flag is enabled than the emulation will not touch the guest VM memory, a good way to get pass the execution of shellcodes safely. Players: BitDefender, TU Muncih, Zentific, Intel (McAfee) as well as the HW group, Cisco
16. Shell in Dom0 Running DRAKVUF Dynamic Malware Analysis System (sits on top of LibVMI)
17. Other issues: Complex deployment / maintenance, Visibility, etc. Duplication of resources Etc.
18. Several = for multi-tenancy, one per customer Advantages: Easier deployment / maintenance, etc. – e.g. centrally managed Better visitiblity / performance Avoids Duplication of resources – e.g. anti-virus storm Hardware support coming: Intel #VE Etc. Notes: Introspection engine is NOT running in Dom0 Use XSM/Flask to tightly control what the security appliance can do
19. Ref: http://www.phoronix.com/scan.php?page=news_item&px=linux-3.20-live-patching
20. = 36 MINS =
21. Course grain Lockstepping
22. Motivator for block replication: performance and community alignment TODO: Split in two and add a picture?
23. = 39 =
24. 16GB => 1TB
25. PCI: In the ARM world, it is quite common to have no PCIe devices and to only access devices using MMIO regions.
26. LLC=last level cache NOISY neighbor : Consider a VM as equivalent to a process. VM A can be running processes that consume (evict) many cache entries from VM b and, therefore, slowing down the performance of VM B. In this case the noisy neighbor is a VM and now your can consider mitigation actions like live migrating VM A to a different host (or at least be able to explain why VM B is running slower than expected). The noisy neighbor is the situation where you 2 processes, A & B. Process A can be noisy in that it runs an algorithm that dirties many entries in the cache, evicting cache entries for process B and thereby slowing down process B. CMT, today, allows you to track which processes are using how much cache and identify the noisy ones (the process A’s that consume too much cache).
27. = 44 =
28. Show example of the first 4.6 mail …
29. = 27 MINS = VMI – HW assisted Security Process Changes Next (Table)
30. Other examples: OSv, HalVM, ErlangOnXen/Ling, Rump Kernels Jitsu: DNS server that spawns unikernels in response to DNS requests and boots them in real-time with no perceptible lag to the end user. Goal = enable a community cloud of ARM-based Cubieboard2 boards that serve user content without requiring centralised data centers, but with the ease-of-use of existing systems.