Xen Project Hypervisor 4.11 Brings Cleaner Architecture to Hypervisor Core Technologies

Latest release adds PVH functionality for better security and performance

SAN FRANCISCO, July 10, 2018 – The Xen Project, hosted by The Linux Foundation, today announced the release of Xen Project Hypervisor 4.11. The latest release adds new PVH-related functionality to simplify the interface between the Xen Project Hypervisor/Support and operating systems bringing added security and performance. The release also contains mitigations for the Meltdown and Spectre vulnerabilities.

The Xen Project Hypervisor is used by more than 10 million users, and powers some of the largest clouds in production today, including Amazon Web Services, Tencent, Alibaba Cloud, Oracle Cloud and IBM SoftLayer. It is the base for commercial virtualization products from Citrix, Huawei, Inspur and Oracle, and security solutions from Qubes OS, Bromium vSentry, A1Logic, Bitdefender, Star Lab’s Crucible Hypervisor, Zentific and Dornerwork’s Virtuosity.

Long-term development goals of the Xen Project continue to focus on less code, a smaller trusted computing base (TCB), less complexity, ease of maintenance, and better performance as well as scalability. To support these goals, the Xen Project has re-architected the Hypervisor's core technologies, which encompass all core functionality, such as x86 support, device emulation and boot sequence. The latest PVH-related functionality in Xen Project 4.11 is a manifestation of this re-architecture.

“The Xen Project community worked swiftly to address the security needs of Spectre and Meltdown, and continued to match its goals in adding significant features to this release,” said Lars Kurth, chairperson of the Xen Project Advisory Board. "The latest features in this release around PVH functionality bring better security, performance and management to the Hypervisor."

PVH Dom0 Reduces the Attack Surface of Xen Project Based Systems

PVH combines the best of PV and HVM mode to simplify the interface between operating systems with Xen Project Support and the Xen Project Hypervisor and to reduce the attack surface of Xen Project Software. PVH guests are lightweight HVM guests that use hardware virtualization support for memory and privileged instructions. PVH does not require QEMU.

Xen Project 4.11 adds experimental PVH Dom0 support by calling Xen via dom0=pvh on the command line. Running a PVH Dom0 removes approximately 1 million lines of QEMU code from Xen Project’s computing base shrinking the attack surface of Xen Project based systems.

Enabling a PVH Dom0 requires a PVH Dom0 capable Linux or FreeBSD. Patches for each operating system are currently being upstreamed and should be available in the next Linux and FreeBSD versions.

PV in PVH container (PVH Shim) Simplifies Management

Xen Project Hypervisor 4.11 supports unmodified legacy PV-only guest to run in PVH mode. This allows cloud providers to support old, PV-only distros while only providing support for a single kind of guest (PVH) simplifying management, reducing the surface of attack significantly, and eventually allowing end-users to build a Xen Project hypervisor configuration with no “classic” PV support at all.

PCI config space emulation in Xen

Support for the PCI configuration space has been moved from QEMU to the hypervisor. Besides enabling PVH Dom0 support, this code will eventually be available to HVM guests and PVH guests. Additional security hardening needs to be performed before exposing this functionality to security supported guest types, such as PVH or HVM guests.

Mitigations against Cache Side Channel Attacks from Meltdown and Spectre

This release contains mitigations for Meltdown and Spectre vulnerabilities, including:

  • Performance optimized XPTI: Xen Project’s equivalent to Kernel page-table isolation (KPTI). Only “classic PV” guests need XPTI whereas HVM and PVH cannot attack the hypervisor via Meltdown.
  • Branch Predictor Hardening: For x86 CPUs, a new framework for Intel and AMD microcode was added related to Spectre mitigations as well as support for Retpoline .

Contributions for this release of the Xen Project came from Amazon Web Services, AMD, Arm, Citrix, DornerWorks, EPAM Systems, Gentoo Linux, Google, Huawei, Intel Corporation, Invisible Things Lab, Oracle, Qualcomm, SUSE, and a number of universities and individuals. See full list of participants in this release here .

Additional Technical Features  

Scheduler Optimizations: Credit1 and Credit2 scheduling decisions when a vCPU is exclusively pinned to a pCPU or when soft-affinity is used are performance optimized.

Add DMOPs to allow use of VGA with restricted QEMU (x86): Xen Project Hypervisor 4.9 introduced the Device Model Operation Hypercall (DMOPs), which significantly limits the capability of a compromised QEMU to attack the hypervisor. In Xen 4.11 we added DMOPs that enable the usage of the VGA console, which was previously restricted.

Enable Memory Bandwidth Allocation in Xen (Intel® Xeon® Scalable platform or Newer): Support for Memory Bandwidth Allocation (MBA) allows Xen Project Hypervisor 4.11 to slow misbehaving VMs by using a credit-based throttling mechanism.

Emulator enhancements (x86): Support for previously unsupported Intel® Advanced Vector Extensions (Intel® AVX and AVX2), and for AMD F16C, FMA4, FMA, XOP and 3DNow! instructions have been added to the x86 emulator.

Guest resource mapping (x86): Support for directly mapping Grant tables and IOREQ server pages have been introduced into Xen Project Hypervisor 4.11 to improve performance.

Clean-up and future-proofing (Arm): Xen’s VGIC support has been re-implemented. In addition, stage-2 page table handling, memory subsystems and big.LITTLE support have been refactored to make it easier to maintain and update the code in future.

Support for PSCI 1.1 and SMCCC 1.1 compliance (Arm): Xen Project is updated to comply with the latest versions of the Arm® Power State Coordination Interface and Secure Monitor Call Calling Conventions that provides an optimised calling convention and optional, discoverable support for mitigating Spectre Variant 2.

Comments from Xen Project Users and Contributors:

“The Xen Project Hypervisor 4.11 builds on its maturity and flexibility as a dependable, secure, type-1 hypervisor. Xen Project 4.11's support for PVH dom0, added to its existing PVH domU capability, allows it to take advantage of the performance and scalability benefits of paravirtualization, while reducing complexity and code size, making it easier to maintain, enhance and secure,” said James Bulpin, Senior Director of Technology at Citrix. “With several other performance, security and maintainability enhancements, Xen Project 4.11 demonstrates the community's dedication to making Xen the best hypervisor for a wide range of use-cases from huge private clouds to embedded systems.”

“Intel is pleased to see the Xen Project 4.11 release with the latest Intel-based platform features,” said Arjan Van De Ven, Intel Fellow and Director of Core Systems and Linux Pathfinding Engineering at Intel’s Open Source Technology Center. “We remain focused on enabling the best of Intel architecture to help ensure customers can take advantage of the newest features.”

"The Xen Project Hypervisor is an important part of the virtualization solutions SUSE provides to our customers. This newest release of Xen 4.11 offers some important benefits such as increased performance and hardening - which are critical in enterprise environments," said Mike Latimer, Senior Engineering Manager, SUSE. "The Xen Project is an excellent example of our commitment to provide the best quality software to our customers. We look forward to continuing our contributions to this thriving community, and being a part of the exciting future of virtualization."

Additional Resources

About Xen Project

Xen Project software is an open source virtualization platform licensed under the GPLv2 with a similar governance structure to the Linux kernel. Designed from the start for cloud computing, the Project has more than a decade of development and is being used by more than 10 million users. A project at The Linux Foundation, the Xen Project community is focused on advancing virtualization in a number of different commercial and open source applications including server virtualization, Infrastructure as a Services (IaaS), desktop virtualization, security applications, embedded and hardware appliances. It counts many industry and open source community leaders among its members including: Alibaba, Amazon Web Services, AMD, Arm, Bitdefender, Cavium, Citrix, Huawei, Intel, Oracle, and Qualcomm. For more information about the Xen Project software and to participate, please visit XenProject.org.

* Intel and Xeon are trademarks of Intel Corporation or its subsidiaries in the U.S. and/or other countries.

The Xen Project Welcomes Bitdefender to its Advisory Board

Leading security vendor joins open source project to support and accelerate hypervisor’s growth

SAN FRANCISCO, December 18, 2017 – The Xen Project, a project hosted at The Linux Foundation, today announced Bitdefender, a leading global cybersecurity technology company protecting 500 million users worldwide, is a new Advisory Board member. The Xen Project Advisory Board consists of major cloud companies, virtualization providers, enterprises, and silicon vendors, among others, that advise and support the development of Xen Project software for cloud computing, embedded, IoT use-cases, automotive and security applications.

The Xen Project hypervisor is the number one choice for security-first environments due to its architecture, advanced security features, and extensive security disclosure process. Xen Project code provides the basis for security solutions from companies such as A1Logic, Bitdefender, Bromium, Dornerwork, Qubes OS, Star Lab, and Zentific. Its security process earned a Core Infrastructure Initiative Badge, and has been emulated by several open source projects, including OpenStack, OPNFV, and OpenDaylight.

With its Corporate HQ in Bucharest and Enterprise HQ in Santa Clara, Bitdefender protects half a billion users every day and works with large enterprises, SMEs, government organizations, and private individuals across more than 150 countries. It provides solutions for each customer’s specific security needs, and uses open source technology to address the new security needs of today.

Bitdefender and Citrix created the first commercial application of the Xen Project hypervisor’s Virtual Machine Introspection (VMI) infrastructure. VMI is an ideal API for developers building and monitoring security applications. The hardware-assisted VMI protects against intrusion and malware attacks adding an extra layer of security. It has been used to spot some of the newer military-grade cyber weapons, like EternalBlue.

According to Shaun Donaldson, Director of Strategic Alliances at Bitdefender, “Security insights gained from the Xen Project hypervisor VMI capabilities has revolutionized security. Instead of being reactive to what is occurring, security can be a proactive effort by using the architecture of virtualization to bridge the context gap.”

Donaldson went on to say, “We enjoyed working with the Xen Project as a contributor, and are pleased to now be an Advisory Board member. We look forward to contributing to the creation and extension of security capabilities, building on examples like VMI, within the Xen Project framework.”

 “Security companies look to use the Xen Project hypervisor as its architecture can help mitigate security risks through use of sandboxing techniques, security features like VMI, KCONFIG and Live Patching, and extensive security process,” said Lars Kurth,advisory chairperson for the Xen Project. “Bitdefender is the first security company to join the Xen Project board, and we are excited to increase our expertise and practice in the security space to continue our momentum here and expand to other security-first companies.”

Bitdefender joins 10 advisory board members who are committed to the market and technical success of the Xen Project hypervisor. Member involvement includes financial support, technical contributions, and high-level policy guidance. 

Xen Project Hypervisor 4.10 Focuses on Security, Improved User Experience, and Future Proofing

Rearchitecture and new user interface provide for cleaner and smaller codebase

SAN FRANCISCO, December 14, 2017 – The Xen Project, hosted at The Linux Foundation, today announced the release of Xen Project Hypervisor 4.10. The latest release continues to take a security-first approach with improved architecture and more centralized documentation. The release is equipped with the latest hardware updates from Arm and a more intuitive user interface.

The Xen Project hypervisor is used by more than 10 million users, and powers some of the largest clouds in production today, including Amazon Web Services, Tencent, Alibaba Cloud, Oracle Cloud and IBM SoftLayer. It is the base for commercial virtualization products from Citrix, Huawei, Inspur and Oracle, and security solutions from Qubes OS, Bromium vSentry, A1Logic, Bitdefender, Star Lab’s Crucible Hypervisor, Zentific and Dornerwork’s Virtuosity.

As demand for embedded, automotive and security solutions continues to rise, the revamped Xen Project architecture provides a cleaner and smaller code base for better security and performance.

“This release is a stepping stone for us to solidify a new architecture that uses hardware support for better performance for PV guests, reduces code size and maintenance burden, and provides a smaller TCB for better security,” said Lars Kurth, Chairperson of the Xen Project Advisory Board. “This provides value to traditional markets that the Xen Project is present and popular in, like the server and cloud space, but also continues to open the Xen Project up to new markets like embedded and automotive.”

“The Xen Project Hypervisor already has a number of great security properties; Xen 4.10 builds on these by further reducing the size of the TCB, reducing the complexity of code within the TCB, and limiting additional components’ rights to the bare minimum necessary,” said James Bulpin, Senior Director of Technology, Citrix. “The re-architecting work done in Xen 4.10 will also make it easier to maintain and enhance, while preserving quality and security properties.”

Rearchitecture Creates Smaller Attack Surface and Cleaner Code

Since the introduction of Xen Project Hypervisor 4.8, the project has overhauled the x86 core of its technology. The intention is to create a cleaner architecture, less code and a smaller computing base for security and performance. As part of this re-architecture, Xen Project 4.10 supports PVHv2 DomU. PVHv2 guests have a smaller TCB and attack surface compared to PV and HVM guests.

In Xen Project Hypervisor 4.9, the interface between Xen Project software and QEMU was completely reworked and consolidated via DMOP. For the Xen Project Hypervisor 4.10, the Xen Project community built on DMOP and added a Technology Preview for dm_restrict to constrain what device models, such as QEMU, can do after startup. This feature limits the impact of security vulnerabilities in QEMU. Any previous QEMU vulnerabilities that could normally be used for escalation privileges to the host cannot escape the sandbox.

This work significantly reduces potential security vulnerabilities in the Xen Project software stack.

Better User Experience through the Xen Project User Interface

The Xen Project community also made significant changes to the hypervisor’s user interface. It is now possible to modify certain boot parameters without the need to reboot Xen. Guest types are now selected using the type option in the configuration file, where users can select a PV, PVH or HVM guest. The builder option is being depreciated in favor of the type option, the PVH option has been removed and a set of PVH specific options have been added.

These changes allow the Xen Project to retain backward compatibility on new hardware without old PV code, providing the same functionality with a much smaller codebase. Additional user interface improvements are detailed in our blog post.

Improved Support Documentation

In Xen Project 4.10, a machine-readable file (support.md) was added to describe support related information in a single document. It defines support status and whether features are security supported and to which degree. For example, a feature may be security supported on x86, but not on Arm.

This file will be back-ported to older Xen releases and will be used to generate support information for Xen Project releases and will be published on xenbits.xen.org/docs/. This effort will both allow users to better understand how they are impacted by security issues, and centralizing security support related information is a pre-condition to become a CVE Numbering authority.

Contributions for this release of the Xen Project came from Amazon Web Services, AMD, Aporeto, Arm, BAE Systems, BitDefender, Cavium, Citrix, EPAM, GlobalLogic, Greenhost, Huawei Technologies, Intel, Invisible Things Lab, Linaro, Nokia, Oracle, Red Hat, Suse, US National Security Agency, and a number of universities and individuals. This was a shorter release cycle with a code quality and hardened security a key focus.

Additional Technical Features

Support for Latest System-on-chip (SoC) Technology: The Xen Project now supports SoCs based on the 64-bit Armv8-A architecture from Qualcomm Centriq 2400 and Cavium ThunderX.

SBSA UART Emulation for Arm® CPUs: Implementation of SBSA UART emulation support in the Xen Project Hypervisor makes it accessible through the command line tools. This enables the guest OS to access the console when no PV console driver is present. In addition, the SBSA UART emulation is also required to be compliant with the VM System specification.

ITS support for Arm CPUs: Xen Project 4.10 adds support for Arm’s Interrupt Translation Service (ITS), which accompanies the GICv3 interrupt controller such as the Arm CoreLink GIC-500. ITS support allows the Xen Project Hypervisor to harnesses all of the benefits of the GICv3 architecture, improving interrupt efficiency and allowing for greater virtualization on-chip for both those using the Xen Project for the server and embedded space. ITS support is essential to virtualize systems with large amounts of interrupts. In addition ITS increases isolation of virtual machines by providing interrupt remapping, enabling safe PCI passthrough on Arm.

GRUB2 on 64-bit Armv8-A architecture: The GRUB community merged support to boot Xen on 64-bit Arm-based CPU platforms. GRUB2 support for Armv8-A improves the user experience when installing Xen via distribution package on UEFI platform.

Credit 2 scheduler improvements: Soft-affinity support for the Credit 2 scheduler was added to allow those using the Xen Project in the cloud and server space to specify a preference for running a VM on a specific CPU. This enables NUMA aware scheduling for the Credit 2 scheduler. In addition we added cap support allowing users to set a the maximum amount of CPU a VM will be able to consume, even if the host system has idle CPU cycles.

Null scheduler improvements: The recent updates to the “null” scheduler guarantee near zero scheduling overhead, significantly lower latency, and more predictable performance. Added tracing support enables users to optimize workloads and introduced soft-affinity. Soft affinity adds a flexible way to express placement preference of vcpus on processors, which improves cache and memory performance when configured appropriately.

Virtual Machine Introspection improvements: Performance improvements have been made to VMI. A software page table walker was added to VMI on Arm, which lays the groundwork to alt2pm for Arm CPUs. For more information on alt2pm is available here.

PV Calls Drivers in Linux: In Xen Project 4.9, the Xen Project introduced the PV Calls ABI, which allows forwarding POSIX requests across guests. This enables a new networking model that is a natural fit for cloud-native apps. The PV Calls backend driver was added to Linux 4.14.

Additional Resources

Xen Project Introduces the Unikraft Unikernel Project

Xen Project Introduces the Unikraft Unikernel Project

Unikraft aims to simplify the process of building unikernels through a unified and customizable code base

SAN FRANCISCO, December 5, 2017 – The Xen Project, hosted by The Linux Foundation, today announced the formation of Unikraft. Unikraft is an incubation project under the Xen Project focused on easing the creation of building unikernels, which compile source code into a lean operating system that only includes the functionality required by the application logic.

The current generation of cloud computing requires workloads that are efficient, fast and secure. Containers are encouraging new ways of looking at the operating system. These trends are driving innovations with unikernels that allow developers to include only the bare minimum of traditional OS components to create lean, efficient, and fast-to-boot applications with an extra degree of isolation for environments like microservices, embedded devices, IoT, and automotive, among many others.

A long-time advocate of unikernels, the Xen Project supports initiatives like MirageOS, a library operating system that constructs unikernels for secure, high-performance network applications. The Xen Project is compatible with HaLVM, a port of the Glasgow Haskell Compiler toolsuite that enables developers to write high-level, lightweight virtual machines that can run directly on the Xen Project hypervisor. Galois originally developed HaLVM to allow for quick and easy prototyping of operating system components; however, it can also operate as a network appliance.

While many projects focus on building out unikernel components, a single unified code base with a modular architecture, like Unikraft’s, is needed to make the process of building unikernels quick, fast, and easily accessible to more developers.

“Unikernels provide a tremendous opportunity for those who are looking to ship workloads quickly and efficiently with isolation to eliminate security risk, but the complexity of building unikernels have stymied this technology’s time-to-market,” said Dr. Felipe Huici, Chief Researcher, Systems and Machine Learning Group, NEC Laboratories Europe. “Unikraft is on a mission to bring unikernels to market faster through an unified code that is customizable to meet the needs of a wide range of applications, and even runtime-specific unikernels, like MirageOS.”

“We are seeing a growing trend and interest around unikernels from inside and outside the Xen Project community with commits growing daily from a range of vendors in the embedded, automotive, enterprise application space, and more,” said Lars Kurth, Chairperson of the Xen Project. “We look forward to helping incubate this project and furthering collaboration within the unikernel community.”

Customizable Architecture Provides Flexibility

The Unikraft architecture consists of two basic components to make the process of building unikernels more fluidly: library pools and a build tool.

Library pools act as building blocks in creating customizable unikernels on top of a consistent code base. The library pools include:

  • Architecture libraries: Containing libraries specific to a computer architecture (e.g., x86_64, ARM32, or MIPS).
  • Platform Libraries: Allowing users to select platforms like Xen, KVM, bare metal, and user-space Linux.
  • Core libraries: Consisting of a rich set of functionality, which includes components like drivers (both virtual such as netback/netfront and physical such as ixgbe), filesystems, memory allocators, schedulers, network stacks, runtimes (e.g. a Python interpreter), and debugging and profiling tools.
  • External libraries: Ports of standard libs (e.g., libc, openssl) to the Unikraft system.

Automating the Unikernel Build Process

The Unikraft build tool compiles the application and the selected libraries together to create a binary for a specific platform and architecture (e.g., Xen on x86_64). The tool is inspired by the popular Linux kconfig system and consists of a set of Makefiles allowing users to select libraries, to configure them, and to receive warnings when library dependencies are not met.

To create a simple application, the user simply implements a main() function, fills out a simple Makefile and runs “make menuconfig”, where he or she selects from the libraries described above and configures the image, choosing, in the process, the target platform(s). The user then saves the configuration, types “make”, an Unikraft automatically generates the images, one per selected platform. This means that application developers no longer have to target a particular platform; in essence, with Unikraft, they get multiple platform support for free.

NEC Laboratories Europe, the European labs of NEC’s research branch focused on software research in the areas of IoT, data science and security and networking, is the main driving force behind Unikraft and is providing the initial implementation for this project.

The Xen Project will provide Unikraft with basic infrastructure and marketing support. Unikraft uses the 3-Clause BSD license and is available for download here. For more information on how to get involved in the project, the website is here.

About Unikraft

Unikraft is a project that aims to simplify the process of building unikernels. The architecture consists of customizable libraries and a build tool to create quick, fast and lean applications for embedded, IoT and automotive use cases, and more. Unikraft is an incubation project of the Xen Project, which provides basic infrastructure and marketing support to help a project to progress. For more information about Unikraft and to participate, please visit https://xenproject.org/developers/teams/unikraft.html.

Additional Resources

New Features in Xen Project 4.9 Provide Better Usability in Automotive and Embedded

Updates include increased security to protect against QEMU compromises, features that lay the foundation for the next generation of cloud-native platforms, and more

 

SAN FRANCISCO, June 28, 2017 – Xen Project, hosted at The Linux Foundation, today announced the release of Xen Project Hypervisor 4.9. The latest release focuses on advanced features for embedded, automotive and native-cloud-computing use cases, enhanced boot configurations for more portability across different hardware platforms, the addition of new x86 instructions to hasten machine learning computing, and improvements to existing functionality related to the ARM® architecture, device model operation hypercall, and more.

The Xen Project continues to see growth in embedded and automotive environments as more companies look to expand virtualization to embedded devices while continuing to reap the benefits of the hypervisor, including cost savings due to consolidation; abstraction of the hardware to allow applications to be decoupled from hardware specifics; and the benefit of hardware-based isolation to better protect against software defects and to contain failures. In addition, more contributions are beginning to lay the foundation for hypervisor features and benefits in cloud-native platforms.

“Contributions with the Xen Project have greatly expanded over the last few years, and we are seeing more companies participating in the project with an eye toward automotive, embedded, security, and native-cloud computing,” said Lars Kurth, Chairperson of the Xen Project Advisory Board. “We are very excited to see this engagement from a community standpoint as these additional contributors help the Xen Project progress in embedded, automotive and security, but also conversely help our more traditional stronghold environments like in server virtualization, Infrastructure as a Service, and desktop virtualization.”

Expanding Xen Project Features in Embedded and Automotive

  • The "null" scheduler, which enables use cases where every virtual CPU can be assigned to a physical CPU removing almost all of the scheduler overheads in automotive and embedded environments. Usage of the “null” scheduler guarantees near zero scheduling overhead, significantly lower latency, and more predictable performance.
  • The new vwfi parameter for ARM (virtual Wait For Interrupt) allows fine-grained control of how the Xen Project Hypervisor handles WFI (Wait for Interrupt) instructions. Setting vwfi to "native" reduces interrupt latency by approximately 60%. Benchmarks on Xilinx® Zynq®  Ultrascale+™  MPSoCs have shown a maximum interrupt latency of less than 2 microseconds, which is extremely close to hardware limits and small enough for the vast majority of embedded use cases.
  • Xen 4.9 includes new standard ABIs for sharing devices between virtual machines (including reference implementations) for a number of embedded, automotive and cloud native computing use cases.

    For embedded/automotive a virtual sound ABI was added implementing audio playback and capture as well as volume control and the possibility to mute/unmute audio sources. In addition a new virtual display ABI for complex display devices exposing multiple framebuffers and displays has been added. Multi-touch support has been added to the virtual keyboard/mouse protocol (enabling touch screens).

Laying the Foundation for the Next Generation of Cloud-Native Computing

During the Xen 4.9 release cycle, a Xen 9pfs frontend was upstreamed in the Linux kernel and a backend in QEMU. It is now possible to share a filesystem from one virtual machine to another, which is a requirement for adding Xen Project support to many container engines, such as CoreOS rkt.

The PV Calls ABI has also been introduced to allow forwarding POSIX requests across guests: a POSIX function call originating from an app in a DomU can be forwarded and implemented in Dom0. For example, guest networking socket calls can be executed to Dom0, enabling a new networking model which is a natural fit for cloud-native apps.

 

Contributions for this release of the Xen Project hypervisor came from Amazon, AMD Aporeto, ARM, BitDefender, Citrix, EPAM, Fujitsu, Huawei Technologies, Intel, Invisible Things Lab, Nokia, Oracle, Star Lab, Suse, Xilinx, Zentific, and a number of universities and individuals. The Xen Project continues to see contributions go up release after release. This release had 25% more contributors to the core hypervisor, and an increase of 17% of contributions coming from the hypervisor, tests, and other related components.

Additional new features and Improvements to existing functionality include:

  • Boot Xen on EFI platforms using GRUB2 (x86): from Xen Project 4.9 and GRUB2 2.02 onwards, the Xen Project Hypervisor can be booted using the multiboot2 protocol on legacy BIOS and EFI x86 platforms. Partial support for the multiboot2 protocol was also introduced into network boot firmware (iPXE). This makes the Xen Project boot process much more flexible; boot configurations can be changed directly from within a bootloader (without having to use text editors) and boot configurations are more portable across different platforms.
  • DMOP (Device Model Operation Hypercall): In Xen 4.9 the interface between Xen Project software and QEMU was completely re-worked and consolidated. There is now only a single hypercall in Xen (the DMOP hypercall) that is carefully designed to allow the privcmd driver to audit any QEMU memory ranges and parameters that are passed to Xen via DMOP. The Linux privcmd driver enables DMOP auditing, which significantly limits the capability of a compromised QEMU to attack the hypervisor.
  • Alternative runtime patching and GICv3 support for ARM 32-bit guests: Alternative runtime patching enables the hypervisor to apply workarounds for erratas affecting the processor and to apply optimizations specific to a CPU and GICv3 support was extended for 32-bit ARM platforms, bringing this functionality to embedded use-cases.
  • System Error Detection (ARM): Xen on ARM made a step forward in reliability and serviceability with the introduction of System Error detection and reporting, a key feature for customers with highly available systems.
  • Intel and x86 Feature Support: The latest version of the Xen Project hypervisor adds the support of Neural Network Instructions AVX512_4VNNIW and Multiply Accumulation Single precision AVX512_4FMAPS as subfamilies of AVX512 instruction sets. With these instructions enabled in Xen for both HVM and PV guests, programs in guest OSes can take full advantage of these important instructions to speed up machine learning computing. This Xen release also further enhances VT-d Posted Interrupt (PI) optimization, Machine Check Exception(MCE) handling, and more.
  • GCOV support: We removed the old GCOV implementation and replaced it with an updated version that supports more formats and exposes a more generic interface.

Comments from Xen Project Users and Contributors

"PVCalls and Xen 9pfs lay the foundation for next generation of cloud-native platforms,” said Stefano Stabellini, Virtualization Architect at Aporeto. “They enable Xen Project software integration in container engines such as CoreOS rkt. More importantly, Xen Project software with PVCalls and 9pfs support will allow better, simpler protection for cloud-native apps because it provides security by default with a smaller overhead than traditional virtualization."

“Xen plays an important role in the future of embedded systems and the next generation of data centers and cloud computing,” said Philippe Robin, Director of Open Source, ARM. “Performance, efficiency and reliability are fundamental attributes of the ARM architecture, and enabling lower interrupt latency and the inclusion of features to better support system error detection is a big step forward in improving reliability and serviceability, while maintaining the right levels of performance.”

“Native support of key peripherals is important to increase the Xen Project hypervisor footprint in the embedded systems domain,” said Alex Agizim, CTO Automotive & Embedded Systems, EPAM. “It is essential to isolate exposed and potentially vulnerable software from hardware and other mission-critical parts in cloud-connected devices. Standardized PV ABIs for sound, display and input provide a simple and reliable way to build a fully interactive digital cockpit solution for the connected vehicle. The latest Xen Project release encourages a wider adoption of the Xen Project Hypervisor in automotive, industrial and IoT applications.”

“Intel is committed to furthering open cloud and virtualization technologies to help data centers transform today’s massive amounts of data into meaningful insights,” said Imad Sousou, Vice President and General Manager, Intel Open Source Technology Center. “Working across the industry, Intel helps to ensure that open virtualization hypervisors, such as the Xen Project, are optimized for the latest Intel® platforms, delivering maximum flexibility, security and value.”

“We are continuing to see a need for low interrupt latency in both the embedded space as well as in traditional and native-cloud computing environments,” said Edgar Iglesias, Principal Engineer at Xilinx. “The Xen Project hypervisor continues to deliver features and improvements with each release to make it easier for us to create new programmable technology for next generation systems. Congratulations to all those that participated in the development of Xen Project 4.9 for creating another solid and essential release.”

 

Xen Project will be hosting its annual conference, Xen Project Developer and Design Summit from July 11 to July 13 in Hungary, Budapest. The conference brings together the Xen Project’s community of developers and power users to determine the future of the project and to share knowledge around best practices with the Xen Project in embedded, automotive, cloud, security environments and more.

Additional Resources

About Xen Project

Xen Project software is an open source virtualization platform licensed under the GPLv2 with a similar governance structure to the Linux kernel. Designed from the start for cloud computing, the Project has more than a decade of development and is being used by more than 10 million users. A project at The Linux Foundation, the Xen Project community is focused on advancing virtualization in a number of different commercial and open source applications including server virtualization, Infrastructure as a Services (IaaS), desktop virtualization, security applications, embedded and hardware appliances. It counts many industry and open source community leaders among its members including: Alibaba, Amazon Web Services, AMD, ARM, Cavium, Citrix, Huawei, Intel, Oracle, Qualcomm, and Rackspace. For more information about the Xen Project software and to participate, please visit XenProject.org.

###

Media Contact
Zibby Keaton
Xen Project
208-290-4853
zkeaton@linuxfoundation.org

Xen Project’s MirageOS Expands its Ecosystem in Latest Release

Innovative unikernel open source project increases commercial use cases and improves ease of use with contributions from Docker, IBM, Citrix and more

SAN FRANCISCO, February 23, 2016 – The Xen Project, a project hosted at The Linux Foundation, today announced the release of MirageOS v3.0. The new version includes support and tooling that allows MirageOS unikernels to target additional hypervisors such as KVM and FreeBSD’s bhyve. MirageOS 3.0 also provides building blocks that can be used within traditional applications for advanced features and capabilities like out-of-the-box VPN support in native applications.

The current generation of cloud computing requires workloads that are efficient, fast and secure. Unikernels allow developers to include only the bare minimum of traditional operating system components to create lean, efficient, and fast-to-boot applications, whether they are working with microservices, embedded devices, or IoT. The open source MirageOS ecosystem now consists of hundreds of these systems building blocks that can be combined with application code into single-purpose unikernels or be used as components.

"Interest in unikernels continues to grow, and with the release of MirageOS v3.0, including the contribution of KVM support from IBM research, developers can enjoy an expanded set of target platforms. With MirageOS in widespread usage as a key component of Docker for Mac and Windows, and Docker Inc’s ongoing support of the project, the MirageOS ecosystem looks well placed for a strong future." – Fintan Ryan, industry analyst at RedMonk

New Targets for MirageOS: Expanding its Ecosystem

MirageOS v3.0 adds new targets for virtio and ukvm via the Solo5 unikernel base contributed by IBM. The virtio target allows deployment of unikernels onto KVM/QEMU and FreeBSD’s bhyve. The new ukvm target extends the unikernel philosophy of modularity and “only what is required” to the next layer down, creating a monitor with thinner interfaces that are specialised to the guest unikernel.

"Unikernels are emerging in response to needs for an ever-more responsive and secure cloud. This technology has the potential to influence cloud applications, serverless computing, network function virtualization, and Internet of Things, making these platforms more efficient and secure. IBM Research is excited to be part of the MirageOS 3.0 release. Through contributions like the Solo5 unikernel base and 'ukvm', we are helping lay the foundation for new ways of using the cloud in the cognitive era." – Giovanni Pacifici, Vice President of Cloud and Cognitive Platform at IBM Research

Real world deployments of MirageOS

A number of use cases that illustrate the versatility and the high-growth potential of MirageOS have emerged since its inception in December 2013, including:

  • Docker for Mac and Windows used MirageOS to provide the filesystem and networking translation layers between OSX, Windows and Linux, allowing for a more seamless user experience on the most popular operating systems.

  • "Using MirageOS libraries as building blocks helped us accelerate development on Docker for Mac and Windows. By using the MirageOS TCP/IP stack, we enabled a critical feature for customers on enterprise networks — that Docker for Mac can be used even when connected to restrictive corporate VPNs. We're excited that users now have an integrated environment for building, assembling and shipping applications from Mac or Windows.” - Patrick Chanezon, Chief Developer Advocate at Docker

  • Ericsson Research in Silicon Valley have demonstrated a new standalone software platform concept to unify automation, orchestration and the compilation of a designated set of Network Function Virtualization (NFV) platforms. These platforms do not rely on current cloud orchestration or software-defined network technologies, but instead introduce the concept of ‘nanoservices’ that are orchestrated by MirageOS unikernels and Xen.

  • By applying unikernel technology to the NFV space, Ericsson Research demonstrated a set of specialized highly secure and stable ‘nano-NFVs’ that can easily be streamed into its next-gen cloud with better performance and security than existing NFVs.

    “Applying Unikernel technology and MirageOS offered Ericsson Research a new way of innovating, designing and implementing a new event-driven framework that we used for a technical PoC. We are looking forward to applying the new features of MirageOS 3.0 to further explore possibilities for optimizing our prototype.” – Per Karlsson, Head of Ericsson Research Silicon Valley

Improvement to User Experience and General Growth

Contributions to the project have vastly grown creating a more stable base of libraries and tooling. User experience has improved in many different areas including the build, packaging and release process, debugging and logging, workflow to simplify the development phase, and documentation. A full list of user experience improvements is recorded in the MirageOS blog.

Since its last major release in June 2014, the project has received an uptick in interest and contributions from research groups and now has over 350 contributors across hundreds of repositories. This includes Mindy Preston, the current release manager, who first came to the project as a Xen Project Outreachy intern. Outreachy is an organization that helps people from groups underrepresented in free and open source software get involved.

“Having a healthy open source community is essential in the growth and vitality of incubation projects that the Xen Project fosters. MirageOS has done a great job of activating its community to create more tooling and use cases for this project and unikernels in general. We look forward to seeing this project continue to mature and expand as we believe that unikernels are the next wave of instrumenting applications for the current and future needs of cloud computing.” – Lars Kurth, Chairperson of the Xen Project Advisory Board

For more information about MirageOS and to participate, please visit mirage.io. In addition, please find the following links for:

About MirageOS

MirageOS is an open source project led by Dr. Anil Madhavapeddy of the Systems Research Group at the University of Cambridge. Additional contributors include developers from Citrix, Docker, IBM, the FreeBSD Core Team, Galois, Jane Street, OCamlPro, and a growing number of individual contributors. Institutional and grant support for MirageOS comes from OCaml Labs, Horizon Digital Economy Research, the User Centric Networking, Networks as a Service, Contrive, and Databox projects, as well as Jane Street. MirageOS is an incubation project of the Xen Project, which provides basic infrastructure and marketing support to help a project to progress. For more information about MirageOS and to participate, please visit mirage.io.

About Xen Project

Xen Project software is an open source virtualization platform licensed under the GPLv2 with a similar governance structure to the Linux kernel. Designed from the start for cloud computing, the Project has more than a decade of development and is being used by more than 10 million users. A Project at The Linux Foundation, the Xen Project community is focused on advancing virtualization in a number of different commercial and open source applications including server virtualization, Infrastructure as a Services (IaaS), desktop virtualization, security applications, embedded and hardware appliances. It counts many industry and open source community leaders among its members including: Alibaba, Amazon Web Services, AMD, ARM, Cavium, Citrix, Huawei, Intel, Oracle, Qualcomm, and Rackspace. For more information about the Xen Project software and to participate, please visit XenProject.org.

###

Media Contact
Zibby Keaton
Xen Project
208-290-4853
zkeaton@linuxfoundation.org

Xen Project Welcomes Qualcomm to its Advisory Board

A world leader in next-generation wireless technologies joins open source project to accelerate ARM-server and hyperscale cloud development

SAN FRANCISCO, December 19, 2016 - The Xen Project, a project hosted at The Linux Foundation, today announced that Qualcomm Technologies, Inc., a subsidiary of Qualcomm Incorporated, is a new Advisory Board member. Qualcomm Technologies actively contributes to the Xen Project hypervisor and is increasing its support for the foundational open source technologies that enable hyperscale cloud computing.

The Xen Project hypervisor is often first-to-market in offering support for the latest features in ARM and is heavily committed to pushing its technology forward with ARM-based servers. Xen Project virtualization has a lean architecture that is perfectly suited to ARM architecture-based solutions for data center applications, energy-efficient cloud operations as well as embedded applications.

"Qualcomm Technologies is committed to supporting many open source communities that power the foundation of hyperscale cloud computing, including Xen Project," said Elsie Wahlig, director of product management, Qualcomm Datacenter Technologies. "As an advisory board member and through our code contributions, we are working to continue to make the Xen Project hypervisor a first-class hypervisor for the ARM architecture."

Qualcomm Technologies is one of the top 10 contributors to the Xen Project’s latest release 4.8, which was released in early December. Qualcomm Technologies’ contributions include ARM enablement and bug fixes. The Xen Project continues to focus on improving performance, enhancing security and management, and fine-tuning the hypervisor for better ARM support to capitalize on new developments with mobile, cloud and web-scale computing.

"Xen Project virtualization has continually helped advance the server space and supports some of the largest clouds in production today," said Lars Kurth, advisory chairperson for the Xen Project. "We're excited to welcome Qualcomm Technologies as a new advisory board member. By stepping up their commitment to the Xen Project, Qualcomm Technologies is making a commitment to advance Xen Project virtualization now and into the future."

Qualcomm Technologies joins 15 advisory board members who are committed to the segment and technical success of the Xen Project hypervisor. Member involvement includes, financial support, technical contributions and high-level policy guidance.

About Xen Project

Xen Project software is an open source virtualization platform licensed under the GPLv2 with a similar governance structure to the Linux kernel. Designed from the start for cloud computing, the Project has more than a decade of development and is being used by more than 10 million users. A Project at The Linux Foundation, the Xen Project community is focused on advancing virtualization in a number of different commercial and open source applications including server virtualization, Infrastructure as a Services (IaaS), desktop virtualization, security applications, embedded and hardware appliances. It counts many industry and open source community leaders among its members including: Alibaba, Amazon Web Services, AMD, ARM, Bromium, Cavium, Citrix, Huawei, Intel, Oracle, Qualcomm, and Rackspace. For more information about the Xen Project software and to participate, please visit XenProject.org.

###

Media Contact
Zibby Keaton
Xen Project 
208-290-4853 
zkeaton@linuxfoundation.org