XPDDS19: When Unikraft Meets Arm64 - Jia He, Arm

•

1 like•348 views

Unikraft allows developers to build unikernels targeted at specific applications easily. Since Unikraft was announced, Arm has been actively involved to enable it on arm64 kvm platform. In this presentation I intend to share: 1) Features status on arm64, kvm platform(merged and under review) 2) Scalability: multi-thread, SMP support 3) Todo list I will also show some demos on Arm64 among them: 1) 2 veth NIC tx/rx using virtio-mmio bus 2) a lightweight web server

Technology

1 Confidential Restricted to Arm Board and Executives © 2019 Arm
When Unikraft Meets Arm64
Jia He, Arm
2019 July
Xen summit 2019 Chicago

Agenda
• Introduction to Unikraft
• Status of Unikraft on arm64
• Scalability enhancement (arm64, kvm plat)
• Future plan
• Demo

What are Unikernels
• “Unikernels are specialized, single-address-space machine
images constructed by using library operating systems” – wiki
page
• Concepts
• Everything is a library
• One image: single application + minimalistic OS
• Non-preemptive scheduler
• One process
• One address space

What are Unikernels
• Pros
• No HEAVY Operating System
• Function call instead of system call
• High deterministic performance
• Contains only needed libraries
• Tiny footprint
• Small attack surface
• Fast boot
• Cons
• Unable to re-use existing device drivers in OS
• Debuggability
• Pros vs Cons • Use cases
• Cloud Computing
and NFV
• IoT / Embedded
• Edge computing

From Unikernel to Unikraft
Pictures form “Unikraft: The second revolution of Unikernels”
• Reduce the effort of converting existing applications to Unikernels
• Easy to configure
• Porting effort requires no rewriting
• Recompiling application code
• Small changes

Unikraft architecture
• Library pool(selectable)
• Architecture libraries
• Platform libraries
• OS functional libraries, runtime libraries
• Build tool
• Provides a Linux style kconfig menu
• Provides scripts to integrate/reuse library
• Generates binaries for multiple platforms
automatically
https://www.xenproject.org/developers/teams/unikraft.html

Status on arm64 – roadmap overview
Unikraft
Xen Qemu kvm Linuxu
arm32 arm32 arm32arm64 arm64 arm64
Solo5
arm64
Bare mental

Footprint and boot time
• helloworld_kvm-arm64, 27 Kbytes
• Boot time: ~50ms on Arm® Cortex®-A53 with QEMU
• Minimal memory usage, 132 Kbytes (not the runtime statistics)
Data form “Unikraft: The second revolution of Unikernels”

Status on arm64
• Kvm platform first support on arm64 in year 2018
• Enhancement support on arm64:
• Submitted upstream, but not yet merged
• Ofw (libfdt extended)
• gic v2 irq infrastructure,
• timer support
• multi-thread
• smp first step support
• Solo5 plat support
• Internal review
• virtio-mmio library porting
• backtrace dumping

Scalability enhancement
• Multi-thread
• Context switch
• Need to implement GIC interrupt controller libraries for interrupt
infrastructure.
• GICv2 for low cost Arm SoC(e.g. IoT devices)
• GICv3 and GICv4 for high performance Arm SoC (e.g. Arm Servers)
• Need to implement ARMv8 virtual timer library
• Current timer library only provides ticks for timestamp

Scalability enhancement
• Smp boot
• Cpu fdt scanning
• Psci boot
• Percpu
• New scheduler
Power
on
Boot
Processor
Scan cpu fdt
Secondary
Processors
WFE
Start up aps
Release APs
Spin until the Boot processor
releases the APs
SEV
AP init
ready
Scheduler Scheduler

Future plan
• More lightweight vmm/plat – rust-vmm, solo5, firecracker…
• More performance enhacenment (ECAM PCI controller)
• Integrate DPDK into Unikraft on arm64
• Enable CI/CD of Unikraft
• Add High-level language support (golang, c++, ruby, rust)
• More scalable(enhance smp support)
• Support enhanced debugging facility

Summary
• Unikraft reduces the barrier of converting an application to
Unikernel greatly.
• Unikraft is new, it still has some things TODO on arm64.

Demo
• A lightweight web server
• Unikraft as a qemu guest (kvm plat on arm64)
• Unikraft in runc (linuxu plat on arm64)

References
• Unikraft project wiki:
• https://wiki.xenproject.org/wiki/Category:Unikraft
• Unikraft: The second revolution of Unikernels
• Unikraft: Unikernels Made Easy

16 Confidential Restricted to Arm Board and Executives © 2019 Arm

The use of Virtual GPUs (vGPUs) has widely grown in server farms to give Virtual Machines (VMs) dedicated graphics. Software rendering with virtual CPUs can only take us so far and even with Intel-GVT, which uses integrated graphics, there isn't enough power to do the fun stuff. In this presentation, Jon Farrell will be talking about the process of implementing AMD MxGPU on Xen, challenges that he encountered while doing it, and discussing performance metrics of bare metal and vGPU VM on popular benchmarks like 3D Mark* and The Witcher 3. To wrap up his presentation, Jon will share his thoughts about future research and where this technology can take us.

XPDDS19: Argo and Hypervisor-Mediated Data eXchange (HMX) - Christopher Clark...

The Linux Foundation

Defending the security of interconnected systems is shifting to depend upon methods for determining the level of trust to be placed in devices and users, with mandatory enforcement of access control policies and robust mechanisms for ensuring the integrity of communication between mutually-authenticated entities. Virtualization-based security leverages trust in the hypervisor to provide strong mechanisms to virtual machines, enabling increased protection, in server, client and embedded deployments. The interfaces provided by the hypervisor for inter-domain communication determine critical properties for data isolation and control of information flow. Hypervisor-Mediated data eXchange describes key aspects of these data transfer primitives and has some support in Hyper-V. The first Open Source implementation of HMX is Argo, a Xen hypervisor feature developed with the OpenXT Project.

XPDDS19: Xen API Archaeology: Creating a Full-Featured VMI Debugger for the...

The Linux Foundation

Despite the popularity of the Xen hypervisor, there are very few tools capable of performing virtual machine introspection (VMI) on Xen guests — not even a full-featured debugger! This is in large part because Xen's VMI APIs are obscure and poorly documented; even among Xen developers, there are very few people who know how to use them. This has serious consequences for projects targeting Xen, as the lack of tooling makes it difficult to verify the correctness and security of software running on Xen. In this presentation, Spencer will introduce and explain Xen's VMI APIs in detail, with the goal of providing all the information necessary to construct fully-featured Xen VMI API clients and analysis tools. In doing so, he will share the hands-on experience he gained while developing his recently-released tool Xendbg, a feature-complete reference implementation of a modern Xen VMI debugger.

XPDS16: Xen Project Weather Report 2016

The Linux Foundation

XPDS16: Hypervisor Enforced Data Loss Prevention - Neil Sikka, A1LOGIC

The Linux Foundation

Data Breaches are all over the news these days, and no organization is safe. Nobody, from the largest governments to the biggest banks to the most advanced security companies is able to adequately protect themselves. The difficulty is that there are infinite number of ways to exfiltrate data from an organization ranging from stolen/lost hardware to steganography to malicious insiders to 0Day exploits installing malware to side channels. The industry is trying to solve this problem using detection, heuristics, pattern matching and behavioral analysis. A new approach is clearly needed to fight the Data Breach problem and keep data inside an organization. Come find out how to use Hypervisors to repurpose hardware to protect sensitive data under the assumption of compromised networks, devices and users (Malicious Insiders). In addition, find out how to do so without using any type of detection, heuristics, pattern matching or behavioral analysis, but rather a strictly algorithmic approach rooted in hardware. Finally, learn about how this technology can be used in a generic manner to protect data of DataBases, Server Software, unmodified legacy applications, and unmodified consumer applications such as word processing and spreadsheet software.

Opening last bits of the infrastructure

Erwan Velu

Over the last three decades, the opensource movement has been pushing to open every piece of closed-source software. Linux & BSDs successfully proved that opensource can provide state-of-the-art operating systems: Internet, clouds or large infrastructures couldn't work without OSS. Having control over the operating system doesn't mean servers and the infrastructure are totally open, OSS won a battle but not the war. Criteo will present its vision to break the last barriers and open the last bits of proprietary software running in modern infrastructure and the challenges that go with it.

CIF16: Building the Superfluid Cloud with Unikernels (Simon Kuenzer, NEC Europe)

The Linux Foundation

The confluence of a number of relatively recent trends including the development of virtualization technologies, the deployment of micro datacenters at PoPs, and the availability of microservers, opens up the possibility of evolving the cloud, and the network it is connected to, towards a superfluid cloud: a model where parties other than infrastructure owners can quickly deploy and migrate virtualized services throughout the network (in the core, at aggregation points and at the edge), enabling a number of novel use cases including virtualized CPEs and on-the-fly services, among others. Towards this goal, we identify a number of required mechanisms and present early evaluation results of their implementation. On an inexpensive commodity server, we are able to concurrently run up to 10,000 specialized virtual machines (based on unikernels), instantiate a VM in as little as 10 milliseconds, and migrate it in under 100 milliseconds.

XPDS14: Unikernels: Who, What, Where, When, Why - Adam Wick, Galois

The Linux Foundation

Over the last several years, I and others have talked about the promise of unikernels â€” single-purpose, lightweight virtual machines â€” in the cloud. However, all of these talks have simply presented our architectures and speculated about their usefulness. Over the last several years, Galois has actually been using unikernels to implement interesting components in critical systems: non-bypassable encryption components, network monitors and alarms, platform obfuscation capabilities, Tor nodes, network re-routers, and so on. In this talk, I will speak briefly on each of them and ask the question: Was a unikernel a good platform for this project? If so, why? If not, why not? What are the general rules we can infer about when unikernels are useful, and what part of the cloud ecosystem they are best suited to serve?

For many years, the Xen community has been delivering a solid virtualization platform for the enterprise. In support of the Xen community innovation effort, Oracle has been translating our enterprise experience with mission-critical workloads and large-scale infrastructure deployments into upstream contributions for the Linux and Xen efforts. In this session, you'll hear from a key Oracle expert, and community member, about Oracle contributions that focus on large-scale Xen deployments, networking, PV drivers, new PVH architecture, performance enhancements, dynamic memory usage with ‘tmem', and much more. This is your chance to get an under the hood view and see why the Xen architecture is the ideal choice for the enterprise.

Xen Project: Windows PV Drivers

The Linux Foundation

XPDS14: OpenXT - Security and the Properties of a Xen Virtualisation Platform...

The Linux Foundation

Released as Open Source Software (OSS) in June 2014, OpenXT is a collection of hardened Linux VMs configured to provide a user facing Xen platform for client devices. This default configuration was mostly static, applying some disaggregation techniques to segregate system components based on a general threat analysis. The goals embodied in this code base up to its release produced a one-size-fits-most configuration with extensibility in specific areas to encapsulate 3rd party value-add. With a community now forming around OpenXT we must come to terms with the limitations of the this approach. In this talk Philip will define what OpenXT is and in this definition, show that OpenXT can meet the varied needs of the security and virtualization community through the construction of a toolkit for the configurable disaggregation of a Xen platform.

XPDS16: libvirt and Tools: What's New and What's Next - James Fehlig, SUSE

The Linux Foundation

A year has passed since the last Xen Developer Summit and it is time to announce the quiet progress made on the libvirt libxl driver and related tooling. New features include memory, cpu, block device, and network interface statistics reporting, support for pvUSB, support for migration stream V2, peer-to-peer migration, UEFI for HVM guests via OVMF, and domain capabilities reporting to name a few. There are also many noteworthy improvements such as better conversion of xl.cfg to/from libvirt domXML, allowing users to easily switch between the xl+libxl and libvirt+libxl toolstacks. The summit also provides an opportunity to discuss new proposals such as better control of domain placement on NUMA systems, exposing Xen's cpu pool feature in libvirt, supporting non-volatile memory for UEFI variables, and improved capabilities reporting. Much of libvirt's value for Xen is in the tools built upon it: virt-manager, virt-viewer, virt-install, virt-builder, kimchi, OpenStack nova, etc. These tools also deserve a quick status update as they relate to Xen. The audience is encouraged to participate, e.g. by requesting a sorely missing feature, warning of an upcoming Xen change that may affect libvirt, or simply suggesting a change that makes virtualization management life a bit easier.

XPDS16: A Paravirtualized Interface for Socket Syscalls - Dimitri Stiliadis, ...

The Linux Foundation

Docker and other container runtimes are gathering momentum and becoming the new industry standard for server applications. Linux namespaces, commonly used to run Docker apps, come with a large surface of attack which is difficult to reduce. Intel’s Clear Containers use KVM to run containers as VMs to provide additional isolation. It is possible to provide VM-like isolation for containers without sacrificing performance. This talk focuses on the benefits of using Xen to provide an execution environment for Docker apps. The presentation starts by listing the requirements of this environment. It explains why monitoring container syscalls is important and what its security benefits are. The talk introduces a new paravirtualized protocol to virtualize IP sockets and provides the design and implementation details. The presentation clarifies the impact of the new protocol from a security perspective. The discussion concludes by comparing performance figures with the traditional PV network frontend and backend drivers in Linux, explaining the reasons for any performance gaps.

XPDDS18: Linux-based Device Model Stubdomains in Qubes OS - Marek Marczykowsk...

The Linux Foundation

One of the killer features of Xen is the ability to contain qemu in a minimal stubdomain. But even though qemu-upstream has been supported by Xen for a long time, stubdomains are compatible only with the ancient qemu-traditional. There were multiple approaches to this problem discussed over time (rumprun, Linux, ...), including some PoC patches. In this presentation I'll explain why we've chosen the Linux solution in Qubes OS and what challenges we faced to make it really work.

Unikernel User Summit 2015: Getting started in unikernels using the rump kernel

The Linux Foundation

XDF18: Heterogeneous Real-Time SoC Software Architecture - Stefano Stabellini...

The Linux Foundation

Hypervisors are key to enable mixed-criticality systems: a critical workload, typically with real-time requirements, running alongside a larger operating system, such as Linux. The interrupt latency needs to be deterministic, and the boot time of the critical function only a fraction of a second. Hypervisors are also the enabling technology to securely deploy new customers apps at runtime, without affecting system safety. This presentation will give an overview of hypervisor technologies for Xilinx platforms. It will introduce the most recent developments of the Xen hypervisor, including the "null" scheduler and dom0less, and it will explain how to make use of the new features to best configure Xen for embedded environments.

XPDS14 - Xen on ARM: Status and Performance - Stefano Stabellini, Citrix

The Linux Foundation

As the first ARM servers and microservers hit the market, Xen on ARM is becoming more mature, stable and reaching feature parity with x86. This talk will present the current status of the project, will describe the latest improvements, the gaps that still need to be filled and the roadmap going forward. ARMv8 silicon is now available for purchase: we can measure how well Xen on ARM 64-bit is performing on real hardware and compare the performance figures with other hypervisors. The presentation will show these results, it will measure the overhead introduced by Xen on ARM and will compare it with the overhead introduced by Xen and KVM on x86. The talk will explain the reasons behind performance shortfalls and present ideas on how to address them in the future. The performance results will be used to determine when it makes sense to use Xen on ARM and what are the best use cases for it.

Scale 12x Securing Your Cloud with The Xen Hypervisor

The Linux Foundation

CIF16: Unikernels, Meet Docker! Containing Unikernels (Richard Mortier, Anil ...

The Linux Foundation

Unikernels are a burgeoning technology, ripe for deployment in a range of situations, from cloud-hosted microservices to Internet-of-Things platforms. By compiling and linking only the required code, they offer a range of benefits over traditional OS-hosted deployments, notably efficiency and, through smaller attack surfaces, security. While increasing in maturity, to date they have remained something of a technologists' choice: technically compelling but requiring considerable effort to build, deploy and use. To address this, some in the community have spent time trying to integrate unikernel management with the popular Docker container management stack. By enabling unikernels to be managed using the standard Docker command line tools, we bring all the ease-of-use and common understandings of that toolchain to bear on this exciting technology. After giving some context to the challenges faced, we will demonstrate building and running a simple LAMP-like stack using Docker to build and manage Rumprun and MirageOS Unikernels. Thanks to Amir Chaudhry, Justin Cormack, Martin Lucina, Mindy Preston and Jeremy Yallop for assistance in building this demo!

Xen Project CI for OpenStack Overview

The Linux Foundation

LCC17 - Securing Embedded Systems with the Hypervisor - Lars Kurth, Citrix

The Linux Foundation

Hypervisors were once seen as purely cloud and server technologies, but have slowly seeped into the embedded space providing extra layers of security. This discussion will showcase how companies from security vendors to automotive are using open source hypervisors (particularly Xen Project) to secure embedded systems, what challenges they face and how they have overcome it. We will also explore what this might mean to IoT at large and how to get started in securing your embedded system with a hypervisor-first approach.

Virtualization with KVM (Kernel-based Virtual Machine)

Novell

As a technical preview, SUSE Linux Enterprise Server 11 contains KVM, which is the next-generation virtualization software delivered with the Linux kernel. In this technical session we will demonstrate how to set up SUSE Linux Enterprise Server 11 for KVM, install some virtual machines and deal with different storage and networking setups. To demonstrate live migration we will also show a distributed replicated block device (DRBD) setup and a setup based on iSCSI and OCFS2, which are included in SUSE Linux Enterprise Server 11 and SUSE Linux Enterprise 11 High Availability Extension.

XPDS16: Xen Orchestra: building a Cloud on top of Xen - Olivier Lambert & Jul...

The Linux Foundation

Since its inception, the Xen Orchestra project which uses AGPLv3, always had a philosophy to listen and engage the community. User feedback shaped our initial concept, which first targeted system administrators. Eventually, our users drove us to support cloud-scale deployments supporting up to 2000 VM's. Retaining simplicity in usage and installation, while evolving Xen Orchestra to cloud scale posed many challenges. This led us to build many new features such ACLs, self-service, live charts, config drive management, and more, forced us to constantly evolve our architecture. First we will show how user needs changed our architecture, and how we implemented challenging problems such as user permissions, ACLs, Containers in a virtualized infrastructure and self service. We will conclude with a short demo, what is next and a lessons learned.

LinuxCon Japan 13 : 10 years of Xen and BeyondThe Linux Foundation

XPDS16: Hypervisor-based Security: Vicarious Learning via Introspektioneerin...

The Linux Foundation

This presentation is based on the technical hurdles we overcame when building a commercial product on the introspection capabilities of the Xen hypervisor. Mihai Dontu will relate the importance of the x86 emulator, the need for a more focused effort on its completeness and correctness, the problems encountered, and the solutions adopted. He will also approach the subject of performance, for which hypervisor features that were not meant to be in the hot path had to be punctually reworked to solve a key requirement for making a theoretical product a commercial reality.

CIF16: Knock, Knock: Unikernels Calling! (Richard Mortier, Cambridge University)

The Linux Foundation

The lightweight and secure nature of Unikernels means that a prime use-case is to customise network behaviour. At the same time, the high-level languages that many are written in means that this sort of low-level coding is opened up to those who might not traditionally consider themselves "systems developers". MirageOS is a particular unikernel platform built in the OCaml functional programming language. Able to seamlessly target a range of environments, from a local (POSIX) development environment to Xen virtual machines running on the cloud, it is a prime example of the ways that unikernels open up low-level development. I will briefly introduce MirageOS before walking through an example developing and then running on Xen a simple network proxy using MirageOS. This proxy will implement a basic form of port-knocking, requiring a sequence of TCP connections (SYNs) to be made to the proxy to indicate a target, before permitting an outgoing connection to that target to be made. Thanks to Thomas Gazagnaire for the material used in the walkthrough!

LCC17 - Live Patching, Virtual Machine Introspection and Vulnerability Manag...

The Linux Foundation

There are three interconnected stories of how the largest clouds in production came together through the Xen Project to develop an industry leading open source security process to manage software vulnerabilities effectively, how those vendors collaborated to stop cloud reboots through Live Patching and how security and CPU vendors collaborated to protect against 0-day vulnerabilities and advanced persistent threats using hardware assisted virtual machine introspection. The talk will cover the impact these technologies have on sys admins and in general.

XPDS16: The OpenXT Project in 2016 - Christopher Clark, BAE Systems

The Linux Foundation

The OpenXT Project is an Open Source community producing a Xen-based platform for client devices with a focus on providing strong security properties. The different primary use cases of this project versus server-based Xen systems have motivated notable technical differences and consequently OpenXT should be of interest to anyone seeking to understand the full set of capabilities on offer within the Xen ecosystem. In this presentation, Christopher Clark will describe the technical architecture of OpenXT, its current status and development activity within the project and its engagement with the upstream OpenEmbedded and Xen projects. This will include an overview of OpenXT's differentiating features such as Measured Launch, Virtual TPMs, Linux-based stubdoms, a specialized input layer and a distinct PV USB stack for Windows and Linux.

XPDDS18: Unikraft: An easy way of crafting Unikernels on Arm - Kaly Xin, ARM

The Linux Foundation

Unikernels have good performance and a very tiny footprint. But the process of converting an application to a Unikernel requires expert porting work and a considerable amount of time. Wei will introduce a new Unikernel development model – Unikraft. Unikraft aims to free Unikernels from the fundamental drawback of manual porting costs. Since Unikraft was announced, Wei has been actively working with the community to get involved in this project. In this presentation Wei intends to share some knowledge of Unikraft, including: 1) The concept and architecture of Unikraft, 2) The tool stack and config menu, 3) Features available on Arm, 4) Upcoming features on Arm. Wei also will run a demo on an Arm server showing: 1) Conversion of an application to Unikernel, 2) Configuration of this Unikernel through a menu system, 3) The converted Unikernel running!

stackconf 2020 | Replace your Docker based Containers with Cri-o Kata Contain...

NETWAYS

They provide the workload isolation and security advantages of VMs. but at the same time maintain the speed of deployment and usability of containers.by using kata containers, instead of namespace, small virtual machines are created on the kernel and be strongly isolated. The technology of Kata Containers is based on KVM hypervisor. That’s why the level of isolation is equivalent to typical hypervisors. This session will focus on a live production phase when choosing kata instead of docker, and why they are preferable Although containers provides software-level isolation of resources, the kernel needs to be shared. That’s why the isolation level in terms of security is not so high when compared with hypervisors.This learns to shift from Docker as the de facto standard to Kata containers and learn how to obtain higherl level of security

What's hot

LCNA14: Why Use Xen for Large Scale Enterprise Deployments? - Konrad Rzeszute...

The Linux Foundation

Xen Project: Windows PV Drivers

The Linux Foundation

XPDS14: OpenXT - Security and the Properties of a Xen Virtualisation Platform...

The Linux Foundation

XPDS16: libvirt and Tools: What's New and What's Next - James Fehlig, SUSE

The Linux Foundation

XPDS16: A Paravirtualized Interface for Socket Syscalls - Dimitri Stiliadis, ...

The Linux Foundation

XPDDS18: Linux-based Device Model Stubdomains in Qubes OS - Marek Marczykowsk...

The Linux Foundation

Unikernel User Summit 2015: Getting started in unikernels using the rump kernel

The Linux Foundation

XDF18: Heterogeneous Real-Time SoC Software Architecture - Stefano Stabellini...

The Linux Foundation

XPDS14 - Xen on ARM: Status and Performance - Stefano Stabellini, Citrix

The Linux Foundation

Scale 12x Securing Your Cloud with The Xen Hypervisor

The Linux Foundation

CIF16: Unikernels, Meet Docker! Containing Unikernels (Richard Mortier, Anil ...

The Linux Foundation

Xen Project CI for OpenStack Overview

The Linux Foundation

LCC17 - Securing Embedded Systems with the Hypervisor - Lars Kurth, Citrix

The Linux Foundation

Virtualization with KVM (Kernel-based Virtual Machine)

Novell

XPDS16: Xen Orchestra: building a Cloud on top of Xen - Olivier Lambert & Jul...

The Linux Foundation

LinuxCon Japan 13 : 10 years of Xen and BeyondThe Linux Foundation

XPDS16: Hypervisor-based Security: Vicarious Learning via Introspektioneerin...

The Linux Foundation

CIF16: Knock, Knock: Unikernels Calling! (Richard Mortier, Cambridge University)

The Linux Foundation

LCC17 - Live Patching, Virtual Machine Introspection and Vulnerability Manag...

The Linux Foundation

XPDS16: The OpenXT Project in 2016 - Christopher Clark, BAE Systems

The Linux Foundation

What's hot (20)

LCNA14: Why Use Xen for Large Scale Enterprise Deployments? - Konrad Rzeszute...

Xen Project: Windows PV Drivers

XPDS14: OpenXT - Security and the Properties of a Xen Virtualisation Platform...

XPDS16: libvirt and Tools: What's New and What's Next - James Fehlig, SUSE

XPDS16: A Paravirtualized Interface for Socket Syscalls - Dimitri Stiliadis, ...

XPDDS18: Linux-based Device Model Stubdomains in Qubes OS - Marek Marczykowsk...

Unikernel User Summit 2015: Getting started in unikernels using the rump kernel

XDF18: Heterogeneous Real-Time SoC Software Architecture - Stefano Stabellini...

XPDS14 - Xen on ARM: Status and Performance - Stefano Stabellini, Citrix

Scale 12x Securing Your Cloud with The Xen Hypervisor

CIF16: Unikernels, Meet Docker! Containing Unikernels (Richard Mortier, Anil ...

Xen Project CI for OpenStack Overview

LCC17 - Securing Embedded Systems with the Hypervisor - Lars Kurth, Citrix

Virtualization with KVM (Kernel-based Virtual Machine)

XPDS16: Xen Orchestra: building a Cloud on top of Xen - Olivier Lambert & Jul...

LinuxCon Japan 13 : 10 years of Xen and Beyond

XPDS16: Hypervisor-based Security: Vicarious Learning via Introspektioneerin...

CIF16: Knock, Knock: Unikernels Calling! (Richard Mortier, Cambridge University)

LCC17 - Live Patching, Virtual Machine Introspection and Vulnerability Manag...

XPDS16: The OpenXT Project in 2016 - Christopher Clark, BAE Systems

Similar to XPDDS19: When Unikraft Meets Arm64 - Jia He, Arm

XPDDS18: Unikraft: An easy way of crafting Unikernels on Arm - Kaly Xin, ARM

The Linux Foundation

stackconf 2020 | Replace your Docker based Containers with Cri-o Kata Contain...

NETWAYS

Cloud-computing.ppt

Ajit Mali

Latest (storage IO) patterns for cloud-native applications

OpenEBS

Secure Your Containers: What Network Admins Should Know When Moving Into Prod...

Cynthia Thomas

Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)

Tibo Beijen

Engage 2020 - Kubernetes for HCL Connections Component Pack - Build or Buy?

panagenda

HCL Connections V7 will be based on Kubernetes only! A parallel WebSphere environment won't be necessary any longer. Martin and Christoph collected the basics and differences in building a Kubernetes environment of your choice. They show you a comparison of an on-premises deployment versus a hosted cloud environment (Amazon EKS). After this session you have the basics to size and build a Kubernetes cluster for Component Pack, so you can start learning the new technology to take off with Connections V7 and become a Kubernaut.

Kubernetes for HCL Connections Component Pack - Build or Buy?

Martin Schmidt

Unikernelized Linux

LinuxCon ContainerCon CloudOpen China

Presentation given at the 2017 LinuxCon China Unikernel is a novel software technology that links an application with OS in the form of a library and packages them into a specialized image that facilitates direct deployment on a hypervisor. Comparing to the traditional VM or the recent containers, Unikernels are smaller, more secure and efficient, making them ideal for cloud environments. There are already lots of open source projects like OSv, Rumprun and so on. But why these existing unikernels have yet to gain large popularity broadly? We think Unikernels are facing three major challenges: 1. Compatibility with existing applications; 2. Lack of production support (e.g. monitoring, debugging, logging); 3. Lack of compelling use case. In this presentation, we will review our investigations and exploration of if-how we can convert Linux as Unikernel to eliminate these significant shortcomings, plus some explorations of coordinating and cooperating with hypervisor.

Unikernels: Rise of the Library Hypervisor

Anil Madhavapeddy

Android and Hard Real TimeAkshar Desai

OSCON: Unikernels and Docker: From revolution to evolution

Docker, Inc.

with Richard Mortier and Anil Madhavapeddy Unikernels are a growing technology that augment existing virtual machine and container deployments with compact, single-purpose appliances. Two main flavors exist: clean-slate unikernels, which are often language specific, such as MirageOS (OCaml) and HaLVM (Haskell), and more evolutionary unikernels that leverage existing OS technology recreated in library form, notably Rump Kernel used to build Rumprun unikernels.

Continuous Delivery the Hard Way with Kubernetes

Weaveworks

Xen Safety Embedded OSS Summit April 2024 v4.pdf

Stefano Stabellini

MIPI DevCon 2016: Accelerating Software Development for MIPI CSI-2 Cameras

MIPI Alliance

MIPI CSI-2-compliant cameras are popular in mobile and mobile-influenced devices because of the specification’s ability to handle high image resolution over fast links with low-power consumption. SoC designers can accelerate their design process by integrating the software drivers to make initial development easier and directly control boot-up sequences. This presentation by Licinio Sousa of Synopsys describes how to use the existing host-side V4L2 API and V4L2 subdevice interfaces to ease the integration of a CSI-2-compliant camera with an existing system. This approach allows designers to easily change their camera without having to make any changes to the CSI-2 host driver.

Continuous Delivery the hard way with Kubernetes

Luke Marsden

Large Scale Computing Infrastructure - Nautilus

Gabriele Di Bernardo

Unikernels: the rise of the library hypervisor in MirageOS

Docker, Inc.

IITCC15: The Bare-Metal Hypervisor as a Platform for Innovation

The Linux Foundation

Climb Technical Overview

Arif Ali

Similar to XPDDS19: When Unikraft Meets Arm64 - Jia He, Arm (20)

XPDDS18: Unikraft: An easy way of crafting Unikernels on Arm - Kaly Xin, ARM

stackconf 2020 | Replace your Docker based Containers with Cri-o Kata Contain...

Cloud-computing.ppt

Latest (storage IO) patterns for cloud-native applications

Secure Your Containers: What Network Admins Should Know When Moving Into Prod...

Kubernetes at NU.nl (Kubernetes meetup 2019-09-05)

Engage 2020 - Kubernetes for HCL Connections Component Pack - Build or Buy?

Kubernetes for HCL Connections Component Pack - Build or Buy?

Unikernelized Linux

Unikernels: Rise of the Library Hypervisor

Android and Hard Real Time

OSCON: Unikernels and Docker: From revolution to evolution

Continuous Delivery the Hard Way with Kubernetes

Xen Safety Embedded OSS Summit April 2024 v4.pdf

MIPI DevCon 2016: Accelerating Software Development for MIPI CSI-2 Cameras

Continuous Delivery the hard way with Kubernetes

Large Scale Computing Infrastructure - Nautilus

Unikernels: the rise of the library hypervisor in MirageOS

IITCC15: The Bare-Metal Hypervisor as a Platform for Innovation

Climb Technical Overview

More from The Linux Foundation

ELC2019: Static Partitioning Made Simple

The Linux Foundation

Static partitioning is used to split an embedded system into multiple domains, each of them having access only to a portion of the hardware on the SoC. It is key to enable mixed-criticality scenarios, where a critical application, often based on a small RTOS, runs alongside a larger non-critical app, typically based on Linux. The two domains cannot interfere with each other. This talk will explain how to use Xen for static partitioning. It will introduce dom0-less, a new Xen feature written for the purpose. Dom0-less allows multiple VMs to start at boot time directly from the Xen hypervisor, decreasing boot times drastically. It makes it very easy to partition the system without virtualization overhead. Dom0 becomes unnecessary. This presentation will go into details on how to setup a Xen dom0-less system. It will show configuration examples and explain device assignment. The talk will discuss its implications for latency-sensitive and safety-critical environments.

XPDDS19: How TrenchBoot is Enabling Measured Launch for Open-Source Platform ...

The Linux Foundation

TrenchBoot is a cross-community OSS integration project for hardware-rooted, late launch integrity of open and proprietary systems. It provides a general purpose, open-source DRTM kernel for measured system launch and attestation of device integrity to trust-centric access infrastructure. TrenchBoot closes the UEFI Measurement Gap and reduces the need to trust system firmware. This talk will introduce TrenchBoot architecture and a recent collaboration with Oracle to launch the Linux kernel directly with Intel TXT or AMD SVM Secure Launch. It will propose mechanisms for integrating the Xen hypervisor into a TrenchBoot system launch. DRTM-enabled capabilities for client, server and embedded platforms will be presented for consideration by the Xen community.

XPDDS19 Keynote: Xen in Automotive - Artem Mygaiev, Director, Technology Solu...

The Linux Foundation

Artem will briefly cover what has been done since the first talk on Xen in Automotive domain back in 2013, what is going on now and what is still missing for broad adaptation of Xen in vehicles. The following topics will be covered: Embedded/automotive features of Xen Collaboration with AGL and GENIVI organizations for standardization Efforts on Functional Safety compliance Artem will also go over typical automotive use scenarios for Xen which may not be the same as generic computing use of hypervisor.

XPDDS19 Keynote: Xen Project Weather Report 2019 - Lars Kurth, Director of Op...

The Linux Foundation

XPDDS19 Keynote: Unikraft Weather Report

The Linux Foundation

In recent years unikernels have shown immense performance potential (e.g., boot times of only a few ms, image sizes of only hundreds of KBs).The fundamental drawback of unikernels is that they require that applications be manually ported to the underlying minimalistic OS, needing both expert work and often considerable amount of time. The Unikraft project provides a unikernel code base and build system that significantly simplifies the building of unikernels. In addition to support for a number CPU architectures, languages and frameworks, Unikraft provides debugging and tracing features that are generally sorely missing from unikernel projects. In this talk we will talk about these features, show a set of preliminary performance numbers, and provide a roadmap for the project's future.

XPDDS19 Keynote: Secret-free Hypervisor: Now and Future - Wei Liu, Software E...

The Linux Foundation

XPDDS19 Keynote: Xen Dom0-less - Stefano Stabellini, Principal Engineer, Xilinx

The Linux Foundation

This talk will introduce Dom0-less: a new way of using Xen to build mixed-criticality solutions. Dom0-less is a Xen feature that adds a novel approach to static partitioning based on virtualization. It allows multiple domains to start at boot time directly from the Xen hypervisor, decreasing boot times dramatically. Xen userspace tools, such as xl and libvirt, become optional. Dom0-less extends the existing device tree based Xen boot protocol to cover information required by additional domains. Binaries, such as kernels and ramdisks, are loaded by the bootloader (u-boot) and advertised to Xen via new device tree bindings. The audience will learn how to use Dom0-less to partition the system. Uboot and device tree configuration details will be explained to enable the audience to get the most out of this feature. The talk will include a status update and details on future plans.

XPDDS19 Keynote: Patch Review for Non-maintainers - George Dunlap, Citrix Sys...

The Linux Foundation

As the number of contributions grow, reviewer bandwidth becomes a bottleneck; and maintainers are always asking for more help. However, ultimately maintainers must at least Ack every patch that goes in; so if you're not a maintainer, how can you contribute? Why should anyone care about your opinion? This talk will try to lay out some advice and guidelines for non-maintainers, for how they can do code review in a way which will effectively reduce the load on maintainers when they do come to review a patch.

XPDDS19: Memories of a VM Funk - Mihai Donțu, Bitdefender

The Linux Foundation

This talk is a follow-up to our Summit 2017 presentation in which we covered our plans for Intel VMFUNC and #VE, as well as related use-cases. This year, we will provide a report on what we have accomplished in Xen 4.12, and what remains to be addressed. We will also give a brief status update of VMI on AMD hardware. The session will end with some real-world numbers of the Hypervisor Introspection solution running on Citrix Hypervisor 8.0 with #VE enabled.

OSSJP/ALS19: The Road to Safety Certification: Overcoming Community Challeng...

The Linux Foundation

Safety certification is one of the essential requirements for software to be used in highly regulated industries. Besides technical and compliance issues (such as ISO 26262 vs IEC 611508) transitioning an existing project to become more easily safety certifiable requires significant changes to development practices within an open source project. In this session, we will lay out some challenges of making safety certification achievable in open source and the Xen Project. We will outline the process the Xen Project has followed thus far and highlight lessons learned along the way. The talk will primarily focus on necessary process, tooling changes and community challenges that can prevent progress. We will be offering an in-depth review of how Xen Project is approaching this challenging goal and try to derive lessons for other projects and contributors.

OSSJP/ALS19: The Road to Safety Certification: How the Xen Project is Making...

The Linux Foundation

Safety certification is one of the essential requirements for software to be used in highly regulated industries. The Xen Project, a secure and stable hypervisor that is used in many different markets, has been exploring the feasibility of building safety certified products on top of Xen for a year, looking at key aspects of its code base and development practices. In this session, we will lay out the motivation and challenges of making safety certification achievable in open source and the Xen Project. We will outline the process the project has followed thus far and highlight lessons learned along the way. The talk will cover technical enablers, necessary process and tooling changes and community challenges offering an in-depth review of how Xen Project is approaching this exciting and and challenging goal.

XPDDS19: Speculative Sidechannels and Mitigations - Andrew Cooper, Citrix

The Linux Foundation

2018 saw fundamental shifts in security boundaries which were previously taken for granted. A lot of work has been done in the past 2 years, and largely in secret under embargo, but there is plenty more work to be done to strengthen the existing mitigations and to try to recover some performance without reopening security holes. This talk will look at speculative execution sidechannels, the work which has already been done to mitigate the security holes, and future work which hopes to bring some improvements.

XPDDS19: Keeping Coherency on Arm: Reborn - Julien Grall, Arm ltd

The Linux Foundation

The Arm architecture provides a set of guidelines that any software should abide by when accessing the memory with MMU off and update page-tables. Failing to do so may result in getting TLB conflicts or breaking coherency. In a previous talk ("Keeping coherency on Arm"), we focused on updating safely the stage-2 (aka P2M) page-tables. This talk will focus on the boot code and Xen memory management. During this session, we will introduce some of the guidelines and when they should be used. We will also discuss how Xen boot sequence needs to be reworked to avoid breaking the guidelines.

XPDDS19: QEMU PV Backend 'qdevification'... What Does it Mean? - Paul Durrant...

The Linux Foundation

For many years the QEMU codebase has contained PV backends for Xen guests, giving them paravirtual access to storage, network, keyboard, mouse, etc. however these backends have not been configurable as QEMU devices as their implementation did not fully adhere to the QEMU Object Model (QOM). Particularly the PV storage backend not using proper QOM devices, or qdevs, meant that the QEMU block layer needed to maintain legacy code that was cluttering up the source. This was causing push-back from the maintainers who did not want to accept any patches relating to that Xen backend until it was 'qdevified'. In this talk, I'll explain the modifications I made to QEMU to achieve 'qdevification' of the PV storage backend, how compatibility with the libxl toolstack was maintained, and what the next steps in both QEMU and libxl development should be.

XPDDS19: Status of PCI Emulation in Xen - Roger Pau Monné, Citrix Systems R&D

The Linux Foundation

PCI is a local computer bus for attaching hardware devices in a computer, and is the main peripheral bus on modern x86 systems. As such, having a proper way to emulate it is crucial for Xen to be able to expose both fully emulated devices or passthrough devices to guests. This talk will focus on the current status of PCI emulation in Xen, how and where it is used, what are its main limitations and future plans to improve it in order to be more robust and modular.

XPDDS19: [ARM] OP-TEE Mediator in Xen - Volodymyr Babchuk, EPAM Systems

The Linux Foundation

XPDDS19: Bringing Xen to the Masses: The Story of Building a Community-driven...

The Linux Foundation

Xen is a very powerful hypervisor with a talented and diverse developers community. Despite the fact it's almost everywhere (from the Cloud to the embedded world), it can be difficult to set up and manage as a system administrator. General purpose distros have Xen packages, but that's just a start in your Xen journey: you need some tooling and knowledge to have a working and scalable platform. XCP-ng was built to overcome those issues: by bringing Xen to the masses with a fully turnkey distro with Xen as its core. It's the logical sequel to the XCP project, with a community focus from the start. We'll see how it happened, what we did, and what's next. Finally, we'll see the impact of XCP-ng on the Xen Project.

XPDDS19: Will Robots Automate Your Job Away? Streamlining Xen Project Contrib...

The Linux Foundation

XPDDS19: Client Virtualization Toolstack in Go - Nick Rosbrook & Brendan Kerr...

The Linux Foundation

High level toolstacks for server and cloud virtualization are very mature with large communities using and supporting them. Client virtualization is a much more niche community with unique requirements when compared to those found in the server space. In this talk, we’ll introduce a client virtualization toolstack for Xen (redctl) that we are using in Redfield, a new open-source client virtualization distribution that builds upon the work done by the greater virtualization and Linux communities. We will present a case for maturing libxl’s Go bindings and discuss what advantages Go has to offer for high level toolstacks, including in the server space.

XPDDS19: Core Scheduling in Xen - Jürgen Groß, SUSE

The Linux Foundation

Today Xen is scheduling guest virtual cpus on all available physical cpus independently from each other. Recent security issues on modern processors (e.g. L1TF) require to turn off hyperthreading for best security in order to avoid leaking information from one hyperthread to the other. One way to avoid having to turn off hyperthreading is to only ever schedule virtual cpus of the same guest on one physical core at the same time. This is called core scheduling. This presentation shows results from the effort to implement core scheduling in the Xen hypervisor. The basic modifications in Xen are presented and performance numbers with core scheduling active are shown.

More from The Linux Foundation (20)