4 ms·

Amazon rebooted lots of PV guests. Presumably they collocate HVM and PV guests on the same box. If there were any HVM guests on the box, then there could be the

Amazon rebooted lots of PV guests. Presumably they collocate HVM and PV guests on the same box. If there were any HVM guests on the box, then there could be the possibility of an attack. (I guess they could forcibly kick off the HVM guests, but that wouldn't be very nice.) Why shouldn't Netflix be running on HVM?

lsc 12y ago
>Why shouldn't Netflix be running on HVM? HVM, at least in the past, had a bunch more code that the guest DomU interacts with vs. fully pv guests. This has security implications. Now, my knowledge of HVM is a few years... or more like half a decade out of date, for example, I don't even know how to force a HVM guest to only use PV drivers (which would solve 90% of the problem.) and i know that more and more of this has moved into hardware, so it's possible that what was true five years ago is not true now, but... yeah, I don't let untrusted users on HVM guests for the same reason I don't let untrusted users use pygrub or load untrusted kernels directly.
- timoth 12y ago
  For network and storage at least, Amazon says that their HVM guests use PV drivers according to this page: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-... but on this page, they don't say that specifically, but mention the possibility in the PV on HVM section: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualiz... Perhaps/presumably it also depends on the AMI you're using.
- grosskur 12y ago
  Most people agree HVM is the way to go on EC2: http://www.brendangregg.com/blog/2014-05-07/what-color-is-your-xen.html http://www.brendangregg.com/blog/2014-05-07/what-color-is-yo... Forcing an HVM guest to use only PV drivers sounds like PVH, which is coming in Xen 4.4: https://blog.xenproject.org/2014/01/31/linux-3-14-and-pvh/ https://blog.xenproject.org/2014/01/31/linux-3-14-and-pvh/
  - lsc 12y ago
    hm. thanks. Yeah. I need to spend more time on this as I update my stuff.
  - cthalupa 12y ago
    HVM guests at Amazon will default to using PV drivers for IO and networking. (Unless using SRIOV/"Enhanced Networking", which will not use the PV drivers) PVH is actually PV on top of an HVM container and is a bit different. You can think of it as PV sitting on top of enough HVM bits to take advantage of the hardware extensions Intel and AMD have invested so heavily in while still being majority PV. This gives you the best of both worlds, including the remaining PV performance benefits related to interrupts and timers that PV drivers on HVM can't utilize.

lsc 12y ago

>Why shouldn't Netflix be running on HVM? HVM, at least in the past, had a bunch more code that the guest DomU interacts with vs. fully pv guests. This has security implications. Now, my knowledge of HVM is a few years... or more like half a decade out of date, for example, I don't even know how to force a HVM guest to only use PV drivers (which would solve 90% of the problem.) and i know that more and more of this has moved into hardware, so it's possible that what was true five years ago is not true now, but... yeah, I don't let untrusted users on HVM guests for the same reason I don't let untrusted users use pygrub or load untrusted kernels directly.

timoth 12y ago
For network and storage at least, Amazon says that their HVM guests use PV drivers according to this page: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-... but on this page, they don't say that specifically, but mention the possibility in the PV on HVM section: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualiz... Perhaps/presumably it also depends on the AMI you're using.
grosskur 12y ago
Most people agree HVM is the way to go on EC2: http://www.brendangregg.com/blog/2014-05-07/what-color-is-your-xen.html http://www.brendangregg.com/blog/2014-05-07/what-color-is-yo... Forcing an HVM guest to use only PV drivers sounds like PVH, which is coming in Xen 4.4: https://blog.xenproject.org/2014/01/31/linux-3-14-and-pvh/ https://blog.xenproject.org/2014/01/31/linux-3-14-and-pvh/
- lsc 12y ago
  hm. thanks. Yeah. I need to spend more time on this as I update my stuff.
- cthalupa 12y ago
  HVM guests at Amazon will default to using PV drivers for IO and networking. (Unless using SRIOV/"Enhanced Networking", which will not use the PV drivers) PVH is actually PV on top of an HVM container and is a bit different. You can think of it as PV sitting on top of enough HVM bits to take advantage of the hardware extensions Intel and AMD have invested so heavily in while still being majority PV. This gives you the best of both worlds, including the remaining PV performance benefits related to interrupts and timers that PV drivers on HVM can't utilize.