X
Xen Project Blog
blog.xen.org · Company blog · on HN since 2009
The official blog of the Xen hypervisor project, covering releases, security issues, and projects built on Xen.
What HN saysHN commenters cite it for the Intel SYSRET privilege escalation write-up and the Xen4CentOS project, in discussions of Xen versus KVM.
26HN people shared it
10linked it in comments
20stories submitted
388story points
12 years agolast shared
2009people per year2026
Most-shared posts
- 1Intel SYSRET privilege escalation6 people · 7 points · first shared 2012 · discussion on HN
- 2Mirage OS: unikernel OS written in OCaml2 people · 5 points · first shared 2013 · discussion on HN
- 3Xen4CentOS6 Project First Release2 people · 3 points · first shared 2013 · discussion on HN
- 4Baremetal vs xen vs kvm redux2 people · first shared 2012
- 5Xen has been fully integrated into Linux kernel 3.01 people · 151 points · first shared 2011 · 35 comments on HN
- 6XenServer open sourced1 people · 123 points · first shared 2013 · 14 comments on HN
- 7Xen and Docker: Made for Each Other1 people · 77 points · first shared 2014 · 27 comments on HN
- 8Xen 4.3.0 released1 people · 4 points · first shared 2013 · discussion on HN
- 9Improved Xen support in FreeBSD 101 people · 3 points · first shared 2014 · discussion on HN
- 10Why CloudStack joining Apache is good news1 people · 2 points · first shared 2012 · discussion on HN
- 11Xen 4.1 releases1 people · 2 points · first shared 2011 · discussion on HN
- 12Schrödinger’s Cat in a (Xen) Virtualzed ‘Box’1 people · 2 points · first shared 2013 · discussion on HN
- 1310 years of Xen : Transforming a Dinosaur into a Bird (or winged Panda)1 people · 2 points · first shared 2013 · discussion on HN
- 14OpenNebula on Xen on ARM coming1 people · 2 points · first shared 2013 · discussion on HN
- 15Xen as kernel module (like KVM)1 people · 1 points · first shared 2009 · 1 comments on HN
What HN people wrote when they linked it
sciurus · 2014-09-08
Paravirtualization bad, hardware virtualization good, is not an accurate view. You actually want a hybrid model to get the best performance. That's why KVM developers have put so much effort into the paravirtualized virtio drivers, for example. Xen has put lots of work into taking advantage of new hardware virtualization technology where it makes sense and continuing paravirtualization where it makes sense. See the two links below for great details.
http://blog.xen.org/index.php/2012/10/23/the-paravirtualization-spectr…
http://blog.xen.org/index.php/2012/10/31/the-paravirtualization-spectr…
lsc · 2014-01-10
I wonder what this is going to do to the Centos-Xen[1] project?
[1]http://blog.xen.org/index.php/2013/06/20/welcome-to-the-xen4centos6-pr…
res0nat0r · 2014-01-03
Here is a pretty big one from 2012 that was discovered by Rafal Wojtczuk: http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret…
It didn't get a huge press release and media coverage but it was a pretty big deal. Probably because there weren't any 0day exploits floating around at the time so this flew under the radar of the mainstream.
http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-es…
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0217
http://invisiblethingslab.com/itl/About.html
socillion · 2013-06-26
This one?
http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-es…
http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret…
Exploits are developed to break VMs, just like everything else, and are promptly patched once revealed. Apart from general intrusion detection tools, I think you would be hard pressed to find anything to guard against them.
Maybe run a VM inside another VM ;)
j_s · 2012-07-02
Per http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-es…
"Linux actually fixed the bug in 2006, with CVE-2006-0744. [ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0744 ] But the description says “Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs…”, which makes it sound like something Linux-specific. It’s therefore not surprising that it attracted little notice from other operating systems."
asharp · 2012-02-12
You are correct in that you need performance parity for two items to be comparable.
You are incorrect in saying that you take an order of magnitude performance hit when Virtualization, especially for CPU bound tasks [1].
In terms of disk you are slightly more correct, you can lose substantial performance, however it's still not an order of magnitude.
[1] http://blog.xen.org/index.php/2011/11/29/baremetal-vs-xen-vs-kvm-redux… (A series of benchmarks showing a disparity of ~1% off bare metal on CPU bound tasks.)
mrud · 2012-01-17
JFTR there seem to be some issues with the Phoronix benchmark (mostly missing patches). Have a look at http://blog.xen.org/index.php/2011/11/29/baremetal-vs-xen-vs-kvm-redux… for an updated benchmark within a PVHVM environment
sharms · 2010-03-23
Xen actually does support overcommit: http://blog.xen.org/index.php/2008/08/27/xen-33-feature-memory-overcom…
walterbell · 2014-09-08
> will there be a future where all I/O paths in AWS EC2 access PCI passthrough
That's a business, not technology question. Possible today if I/O is priced for exclusivity to one workload, same as a dedicated server. Most AWS customers want shared workload (low) pricing.
> Debugability
In general, hypervisors provide more debug options than a single OS, since the host OS can introspect into the guest OS, even to record/replay guest OS execution, e.g. http://www.slideshare.net/mobile/xen_com_mgr/xentt-deterministic-syste…
Real-time hypervisor scheduling is an ongoing research area, e.g. here is an automotive use case, http://blog.xen.org/index.php/2013/11/27/rt-xen-real-time-virtualizati… & http://www.cse.wustl.edu/~lu/papers/emsoft11.pdf
> for very large sites with thousands of instances
Yes, containers work well for Google who doesn't need to worry about isolation. Most businesses are not Google nor are they running a real-time workload. With containers, SE Linux provides a necessary layer of defense, http://opensource.com/business/14/7/docker-security-selinux & http://blog.docker.com/2014/07/new-dockercon-video-docker-security-ren…