Author Archives: zkeaton

Xen Project Community Spotlight: DornerWorks

The Xen Project is comprised of a diverse set of member companies and contributors that are committed to the growth and success of the Xen Project Hypervisor. The Xen Project Hypervisor is a staple technology for server and cloud vendors, and is gaining traction in the embedded, security and automotive space. This blog series highlights the companies contributing to the changes and growth being made to the Xen Project, and how the Xen Project technology bolsters their business.

contemporary-1850469_1920

Name: Robert VanVossen
Title: Embedded Engineer
Company: DornerWorks

When did you join the Xen Project and why/how is your organizations involved?DornerWorks has been involved with Xen Project since 2011 when we submitted the ARINC653 scheduler to the mainline. Through a Small Business Innovation Research (SBIR) contract from the US NAVY, we worked to develop some ARINC653 extensions to the Xen Project Hypervisor. This led to DornerWorks gaining expertise in the Xen Project Hypervisor and we combined this expertise with our knowledge of the embedded world to help our customers design the embedded virtualization solutions they need. This formed the basis for our Virtuosity product (a hypervisor distribution based on the Xen Project) and design services around embedded hypervisors.

DornerWorks still tries to propagate changes and bug fixes to the Xen Project Mainline whenever we can as we take great pride in being a part of this community. We want to help improve both the technology and the community through our work.

How does your involvement benefit your company?
A hypervisor is a complex piece of technology and DornerWorks is a small company.  By colloborating with the larger Xen community, DornerWorks is able to provide a competitive embedded virtualization solution without needing to become an expert at all the technology areas encapsulated in Xen Project technologies.

As a primarily services based company, the Xen Project community also provides us with an indirect marketing platform. The opportunity to publicly showcase our contributions and present on technical topics at Xen Project conferences allows us to share our expertise with the community while getting our name in front of potential customers.

The Xen Project community has also been instrumental in encouraging Xen’s use in embedded platforms, which while different from Xen’s original cloud based goals, is an area poised for growth in virtualization implementations.

How does the Xen Project’s technology help your business?
Xen Project technologies provide a basis for services that we provide to our customers. Through the DornerWorks Virtuosity distribution (http://dornerworks.com/xen/virtuosity), we give customers the means to get started quickly prototyping with Xen on embedded systems. From there, we provide services to refine their solution or develop new components around Xen that they may need, such as new guest OS, new PV drivers, etc. We also provide a Quick Start Package (http://dornerworks.com/xen/xen-quick-start) to help train others on Xen, virtualization, and specific platforms. This is a good option for both those that are just getting their feet wet and those that want to know all the nitty-gritty details.

What are some of the major changes you see with virtualization?
We see virtualization becoming more and more of a necessity in the embedded world. As the complexity of processors increases, the difficulty of utilizing them increases. Processors, like the Zynq UltraScale+ MPSoC, that have a Quad-Core ARM Cortex-A53, a Dual-Core ARM Cortex-R5, and an FPGA in a single chip, can be difficult to manage. Virtualization provides a means to isolate out various pieces in a more manageable and effective way. Not only does the Xen Project Hypervisor help manage complexity, but it also can reduce size, weight, and power (SWaP), provide redundancy, address obsolescence of legacy systems, and more.

However, while the temptation is to use virtualization to create a single integrated platform for all computation, this approach could create a single point of failure unless it is mitigated by system wide redundancies. In these applications, Xen Project technologies can be used to provide an embedded “cloud,” which provides the reliability required by the application with a large measure of integration. This approach is both familiar and different in embedded applications, which frequently use both hardware and software to provide both isolation and redundancy, but have traditionally leaned more on hardware based solutions.

What advice would you give someone considering joining the Xen Project?
Just jump in and get involved. Go to the conferences, meet people, submit patches, review patches, ask questions, and enjoy yourself. It is a great community that is friendly, open, and has a lot of people with similar goals. They want to help each other and improve the technologies we are all utilizing. I have personally had a blast at the Developer’s Summit and look forward to going to more.

What excites you most about the future of Xen?
I am excited to see hardware become more virtualization friendly. When Xen can utilize these features, the overhead added to the system can be decreased even further than it already has been. This will help make the Xen Project Hypervisor an even more attractive solution in the embedded space.

Embedded hypervisors have been around for a long time, but with the increasingly complex SoCs being produced by chip vendors and the industry drive towards system integration, the number of deployed hypervisor based embedded systems continues to increase. While it has taken longer than we thought when we first joined the Xen Project community, we can see the fruits of these efforts starting to pay off.  We are excited to be a part of the many Xen Project contributors putting Xen in systems quite different from the cloud, utilizing the same underlying technologies in order to provide the security and reliability we have become accustomed to in cloud applications to embedded ones.

Additionally when we first started working with the Xen Project there was not much talk about the safety certification of Xen, but with the increasing interest of the automotive industry in hypervisors, we are seeing a lot of discussion and progress on this front. There is still a long way to go, but at least the will is currently there.

*If you want to stay in the know around embedded virtualization and Xen, sign up for DornerWork’s weekly newsletter here

Xen Project Contributor Spotlight: Kevin Tian

The Xen Project is comprised of a diverse set of member companies and contributors that are committed to the growth and success of the Xen Project Hypervisor. The Xen Project Hypervisor is a staple technology for server and cloud vendors, and is gaining traction in the embedded, security and automotive space. This blog series highlights the companies contributing to the changes and growth being made to the Xen Project and how the Xen Project technology bolsters their business.

contemporary-1850469_1920

Name: Kevin Tian
Title: Principal Engineer of Open Source Technology Center
Company: Intel

When did you join the Xen Project and why/how is your organizations involved?
My journey with Xen Project has been ~13 years now (since 2005), with a focus on hardware-assisted virtualization using Intel® Virtualization Technology (Intel® VT). I’m acting as the maintainer for VT-x/VT-d sub-system in the Xen Project community. The Xen Project is the first open source virtualization project embracing Intel® VT and is a leading community in demonstrating new hardware virtualization features.

How does your involvement benefit your company?
Working with open source communities can definitely bring great value to the whole ecosystem around new technologies, which Intel debuts every year. For example, being the pioneer on Intel® VT, the success in the Xen Project accelerated the market transition from software-based virtualization (binary translation, para-virtualization, etc.) to hardware-assisted virtualization (HVM, PVH, etc.). Hardware-assisted virtualization helps with reduced maintenance overhead, full guest OS compatibility, and better performance.

How does the Xen Project’s technology help your business?
The ecosystem built around the Xen Project is definitely helpful in generating demand of Intel servers (with Intel® VT).

What are some of the major changes you see with virtualization and the transition to cloud native computing?
While virtualization technology has become the fundamental building block in the Cloud, there is still a major gap regarding I/O capabilities when comparing virtualized environment to bare metal. Although network and storage virtualization has been in place for years, efficient virtualization and sharing of new booming accelerators (GPU, NVMe, FPGA, QAT, etc.) are still not widely available. The ceiling of what cloud-native computing can achieve could be severely limited, if disconnected from powerful accelerators existing in the physical server.

What advice would you give someone considering joining the Xen Project?
The Xen Project is possibly one of the most successful open source virtualization projects in the world. The mature community and rich features accumulated in the decade plus the project has been in existence has provided a strong foundation to save you time either in developing a value-add business or exploiting new virtualization research.

What excites you most about the future of Xen?
I’m excited by the fact that the Xen Project keeps embracing new innovations, e.g. PVH, XenGT, etc., and penetrating new markets.

Xen Project Member Spotlight: Bitdefender

The Xen Project is comprised of a diverse set of member companies and contributors that are committed to the growth and success of the Xen Project Hypervisor. The Xen Project Hypervisor is a staple technology for server and cloud vendors, and is gaining traction in the embedded, security and automotive space. This blog series highlights the companies contributing to the changes and growth being made to the Xen Project, and how the Xen Project technology bolsters their business.

contemporary-1850469_1920

Name: Shaun Donaldson
Title: Director of Strategic Alliances
Company: Bitdefender

When did you join the Xen Project and why/how is your organizations involved?
Bitdefender has been collaborating with Linux Foundation for the past three years, and active within the Xen Project community, especially around Virtual Machine Introspection, for about the same time. We officially joined the Xen Project toward the end of 2017. We are focused on security, which is core to the philosophy of the Xen Project.

How does your involvement benefit your company?
A key benefit has been working with the open source community where security is top-of-mind. Rather than developing ideas and approaches in a vacuum, the Bitdefender team of researchers and developers have been able to validate ideas and benefit from the feedback of the talented Xen Project community. There is a deep pool of knowledge around the history of what has worked, along with a wide variety of perspectives. This is why the Xen Project hypervisor is so flexible.

How does the Xen Project’s technology help your business?
Bitdefender is a security company with customers and partners across the globe. The team works on many fronts across the security landscape and our alliance with the Xen Project enables us to be a part of the open source community dedicated to Virtual Machine Introspection (VMI).

VMI is an example of a leap-forward that required creativity, experimentation, and coding by talented people to be realized beyond the academic sphere. Supporting and extending this process, as well as translating the capabilities for commercial offerings benefits everyone, including Bitdefender. To date, Bitdefender is the only commercial security vendor leveraging VMI; and the Xen Project hypervisor VMI capability has been adopted by Citrix within XenServer as Direct Inspect APIs.

The location in the stack where a security solution can gain insight, has shifted from being within the VM to the hypervisor. This fundamentally changes how workloads can be secured, which is a game-changer. VMI provides context, while keeping the security mechanism isolated. It is a best of both worlds scenario: context with isolation.

What are some of the major changes you see with virtualization and the transition to cloud native computing?
The security implications of moving workloads from traditional virtualized environments to cloud native environments, is something organizations challenge us with every day. The concept of oud-native provokes ideas about the myriad of implications of building workloads from the outside-in. This means there is a shift from service-oriented outcomes back to the way a service, whether IaaS, PaaS, or SaaS, is built and, ultimately delivered.

The Bitdefender team works with organizations that are trying to understand how they can avoid grafting traditional security onto new methods of delivering services. A hypervisor which takes full advantage of hardware capabilities, and makes the result of those capabilities consumable, applicable, and actionable to higher-level services, is extremely important.

At the same time, the fundamental elements remain: processes run on supervisors/operating systems, hypervisors run on the underlying hardware, and so-on. In this, there are opportunities to apply security from the root of the stack.

What advice would you give someone considering joining the Xen Project?
If your organization wants to be on the forefront of cloud computing, you must be part of the groups dedicated to advancing the underlying technology, or risk being left behind. Organizations open to participating in groups like the Xen Project, may discover new and unanticipated ways of solving problems.

The Xen Project has over a decade of development and has benefited from thousands of contributions from individuals, users, and organizations. The collective knowledge and passion to move cloud computing forward ensures the best information sharing and access to a community focused on advancing virtualization. This enables organizations to have the advantage of lessons-learned as well as a mature structure to best continue conversations on where the Xen Project hypervisor can continue to evolve.

What excites you most about the future of Xen?
At Bitdefender, we are excited to see the ways and places the Xen Project hypervisor will be used and how it will continue to expand. From the services we consume, to the cars we drive, there is a rich future for Xen, along with the parallel need to secure it, ensuring a long and fruitful alliance with Xen.

You can read more about Bitdefender joining the Xen Project here.

Xen Project Contributor Spotlight: Irby Thompson

The Xen Project is comprised of a diverse set of member companies and contributors that are committed to the growth and success of the Xen Project Hypervisor. The Xen Project Hypervisor is a staple technology for server and cloud vendors, and is gaining traction in the embedded, security and automotive space. This blog series highlights the companies contributing to the changes and growth being made to the Xen Project and how the Xen Project technology bolsters their business.

contemporary-1850469_1920

Name: Irby Thompson
Title: Founder & CEO
Company: Star Lab Corp.

When did you start contributing to the Xen Project?
The Star Lab team started contributing to the Xen Project in 2015. At that time, our team had completed an extensive trade study of existing open-source and proprietary hypervisors, and determined that the Xen Project codebase and community offered the best security, stability, features, and performance available in the virtualization marketplace.

How does contributing to the Xen Project benefit your company?
Our contributions to the Xen Project help make the ecosystem stronger, while also enabling the entire community to adopt and benefit from our patches. For example, our team upstreamed kconfig support into Xen in 2016 in order to make the core hypervisor codebase more modular, and thus more adaptable across a wide range of industries. Likewise, Star Lab directly benefits from the many Xen Project developers who add new features, review source code, perform security and performance testing, and share lessons learned.

How does the Xen Project’s technology help your business?
The Xen Project hypervisor provides a robust foundation upon which industry-specific solutions can be built. Star Lab is primarily in the business of developing and deploying Crucible, a Xen-based secure embedded virtualization platform for security-critical operational environments, including aerospace & defense, industrial, transportation, and telecommunications. By leveraging Xen as the foundation for Crucible, our team has been able to focus attention on addressing customer-specific needs.

What are some of the major changes you see with virtualization and the transition to cloud native computing?
Virtualization is quickly displacing both hardware (below) and operating systems (above) as the framework upon which modern systems are built. The smart abstractions made possible by virtualization reduce dependencies and make software applications easier to deploy, secure, and maintain. The future will see a merger of traditional virtualization with DevOps-style containerization to get the best qualities of both worlds and enable run-anywhere computing.

What advice would you give someone considering contributing to the Xen Project?
The ecosystem around Xen Project is full of interesting subprojects like MirageOS / unikernels, disaggregation / subdomains, tooling, and Arm support, all places where more development help is needed. Many volunteers make light work, so jump in and get involved!

What excites you most about the future of Xen?
The Xen Project continues to evolve from traditional server virtualization into other markets such as the embedded / IoT space, where the benefits of virtualization are just beginning to be realized. For example, Xen Project has the potential to be viable in safety-critical environments where a type-1 hypervisor can provide strong isolation and independence guarantees. Xen-based virtualization drives innovation in these industries and leads to significant cost savings over legacy architectures. At Star Lab, we are excited to be involved in driving the future of Xen Project!

Xen Project Contributor Spotlight: Mike Latimer

The Xen Project is comprised of a diverse set of member companies and contributors that are committed to the growth and success of the Xen Project Hypervisor. The Xen Project Hypervisor is a staple technology for server and cloud vendors, and is gaining traction in the embedded, security and automotive space. This blog series highlights the companies contributing to the changes and growth being made to the Xen Project and how the Xen Project technology bolsters their business.

contemporary-1850469_1920

Name: Mike Latimer
Title: Senior Engineering Manager, Virtualization Team
Company: SUSE

When did you start contributing to the Xen Project?
I first started working with the Xen Project in 2006 as a backline support engineer for SUSE. That role required working closely with SUSE’s virtualization development team to identify, debug and resolve Xen related issues our customers encountered. At that time, I was a silent contributor to the project as I leveraged the various Xen Project community mailing lists to increase my understanding of the project and contributed back through my engagements with our internal Xen developers. Some years later, I moved to engineering and worked directly with the Xen Project and related tooling. I now manage SUSE’s Virtualization Team and contribute through my own coding and QA related efforts, and also by ensuring our engineers have the resources they need to be active in the Xen Project.

How does contributing to the Xen Project benefit your company?
The Xen Project is an example of a very complex project which is successful due to a thriving and diverse community. Our membership in this community provides engineers an incredible opportunity to increase their own skills through peer review of their code, and directly observing how other engineers approach and resolve problems. This interaction between highly skilled engineers results in better engineers and better engineered products. In other words, it’s a win all around. SUSE benefits both by having a quality product we can offer to our customers and by the continual improvement our engineers experience.

How does the Xen Project’s technology help your business?
Internally, SUSE (and our parent company Micro Focus) relies on all forms of virtualization to provide many critical infrastructure components. Key services such as dns/dhcp servers, web servers, and various applications servers are commonly ran in Xen VMs. Additionally, Xen is an important part of the tooling used to build our distributions. For example, the well known Open Build Service infrastructure (which performs automated building of RPMs) uses Xen VMs for a portion of the builds.

SUSE prides itself on providing quality products that our customers need to resolve real-world challenges. Xen was doing this when we first included it in SUSE Linux Enterprise 10 (in 2006), and continues to do this today as Xen will be included in SUSE Linux Enterprise 15 (to be released in 2018). Xen has been an important differentiating factor with our distribution, and customer feedback has verified the value that they see in this offering.

What are some of the major changes you see with virtualization and the transition to cloud native computing?
In my opinion, the death of the hypervisor has been greatly exaggerated. While it is true that cloud computing has taken users one step away from the hypervisor, the role of the hypervisor has never been more important. As more and more applications move to cloud-based services, the underlying hypervisor will be expected to “just work” with everything required by those applications. This means that advanced functionality like device-passthrough, NUMA optimizations, and support for the latest CPU instructions will be expected to be available in cloud environments.

Of course, security is of paramount importance, and performance can’t be sacrificed either. Meeting these expectations, while continuing to provide core functionality (such as live migration, save/restore, snapshots, etc.) will be challenging, but the architecture of the Xen Project provides the stable foundation for today’s requirements, and the flexibility to adapt to new requirements as the cloud world continues to evolve.

What advice would you give someone considering contributing to the Xen Project?
I would encourage anyone working with the Xen Project to become an _active_ member of the community. Start by following the mailing lists and joining in the conversation. It may seem intimidating to begin working with such a technically complex project, but the community is accepting and interested in what anyone has to say. Even if your contribution are simply ACK’ing patches, or providing test reports, all input is appreciated.

If you are considering submitting code to the project, my advice is to submit early and submit often! Engage with the community early in the development process to allow time for the community to feel joint ownership for the success of your code. Don’t be afraid of criticism, and don’t be afraid of standing up for your point of view. The Xen Project thrives with these discussions, and the outcome should never be viewed as a win/lose proposition. Everyone benefits when the most correct solution wins.

What excites you most about the future of Xen?
I’m most interested in seeing Xen continue to differentiate itself from other hypervisor offerings. The Xen architecture is ideal for environments which require high security and performance, so I’m particularly interested in advances in this area. The convergence of PV

and HVM guest models (into PVH and PVHVM) has been an exciting recent change, and there should be further advances which ensure both guest models are as performant as possible. I’m also looking forward to increases in fault tolerance through such things as a restartable dom0, and better support for driver stub domains. By continuing to improve in these areas, Xen will remain a strong choice in the ever changing field of virtualization.

 

Unikraft: Unleashing the Power of Unikernels

This blog post was written by Dr. Felipe Huici, Chief Researcher, Systems and Machine Learning Group, at NEC Laboratories Europe

The team at NEC Laboratories Europe spent quite a bit of time over the last few years developing unikernels, a specialized virtual machine images targeting specific applications. This technology is fascinating to us because of its fantastic performance benefits: tiny memory footprints (hundreds of KBs or a few MBs), boot times compared to those of processes or throughput in the range of 10-40 Gb/s, among many other attributes. Specific metrics can be found in these articles: My VM is Lighter (and Safer) than your ContainerUnikernels Everywhere: The Case for Elastic CDNs, ClickOS and the Art of Network Function Virtualization

The potential of unikernels is great (as you can see from the work above), but there hasn’t been a massive adoption of unikernels. Why? Development time. For example, developing Minipython, a MicroPython unikernel, took the better part of three months to put together and test. ClickOS, a unikernel for NFV, was the result of a couple of years of work.

What’s particularly bad about this development model, besides the considerable time spent, is each unikernel is basically a throwaway. Every time we want to create a new unikernel targeting a different application, developers have to start from scratch. Essentially, there is a lack of shared research and development when it comes to building unikernels.

We (at NEC) wanted to change this, so we started to re-use the work and created a separate repo consisting of a tool stack that would contain functionality useful to multiple unikernels — mostly platform-independent versions of newlib and lwip (a C library and network stack intended for embedded systems).

This got us thinking that we should take our work to a much bigger level. We asked the question: Wouldn’t it be great to be able to very quickly choose, perhaps from a menu, the bits of functionality that we want for an unikernel, and to have a system automatically build all of these pieces together into a working image? It would also be great if we could choose multiple platforms (e.g., Xen, KVM, bare metal) without having to do additional work for each of them.

The result of that thought process is Unikraft. Unikraft decomposes operating systems into elementary pieces called libraries (e.g., schedulers, memory allocators, drivers, filesystems, network stacks, etc.) that users can then pick and choose from, using a menu to quickly build images tailored to the needs of specific applications. In greater detail, Unikraft consists of two basic components (see Figure 1):

  • Library pools contain libraries that the user of Unikraft can select from to create the unikernel. From the bottom up, library pools are organized into (1) the architecture library tool, containing libraries specific to a computer architecture (e.g., x86_64, ARM32 or MIPS); (2) the platform tool, where target platforms can be Xen, KVM, bare metal (i.e. no virtualization), user-space Linux and potentially even containers; and (3) the main library pool, containing a rich set of functionality to build the unikernel. This last library includes drivers (both virtual such as netback/netfront and physical such as ixgbe), filesystems, memory allocators, schedulers, network stacks, standard libs (e.g. libc, openssl, etc.), and runtimes (e.g. a Python interpreter and debugging and profiling tools). These pools of libraries constitute a codebase for creating unikernels. As shown, a library can be relatively large (e.g libc) or quite small (a scheduler), which allows for customization for the unikernel.
  • The Unikraft build tool is in charge of compiling the application and the selected libraries together to create a binary for a specific platform and architecture (e.g., Xen on x86_64). The tool is currently inspired by Linux’s KCONFIG system and consists of a set of Makefiles. It allows users to select libraries, to configure them, and to warn them when library dependencies are not met. In addition, the tool can also simultaneously generate binaries for multiple platforms.

unikraft

Figure 1. Unikraft architecture.

Getting Involved
We are very excited about the recent open source release of Unikraft as a Xen Project Foundation incubator project. The Xen Project is a part of the Linux Foundation umbrella. We welcome developers willing to help improve Unikraft. Whether you’re interested in particular applications, programming languages, platforms, architectures or OS primitive. We are more than happy to build and receive contributions from the community. To get you started, here are a number of available resources:

Please don’t be shy about getting in touch with us, we would be more than happy to answer any questions you may have. You can reach the core Unikraft development team at sysml@listserv.neclab.eu .