After eight months of development, the release of the free hypervisor Xen 4.16 has been published. Companies such as Amazon, Arm, Bitdefender, Citrix, and EPAM Systems participated in the development of the new release. Updates for the Xen 4.16 branch will continue until June 2, 2023, and publication of vulnerability fixes will last until December 2, 2024.
Key changes in Xen 4.16:
- In TPM Manager, which supports the operation of virtual chips for storing cryptographic keys (vTPM) implemented based on a shared physical TPM (Trusted Platform Module), fixes have been made for the subsequent implementation of support for TPM 2.0 specifications.
- Increased reliance on the PV Shim layer, used for running unmodified paravirtualized guest systems (PV) in PVH and HVM environments. In the future, the use of 32-bit paravirtualized guest systems will only be possible in PV Shim mode, which will reduce the number of places in the hypervisor where vulnerabilities could potentially exist.
- Added the ability to boot on Intel devices without a Programmable Interval Timer (PIT).
- Cleaned up outdated components, and the default build for 'qemu-xen-traditional' code and PV-Grub has been discontinued (the need for Xen-specific forks has diminished after changes supporting Xen were merged into the main QEMU and Grub codebases).
- Initial support for virtualized performance counters (Performance Monitor Counters) has been implemented for guest systems with ARM architecture.
- Support for dom0less mode has been improved, allowing for operation without deploying a dom0 environment at startup. of virtual machines during the early boot stage of the server. The changes made it possible to support 64-bit ARM systems with EFI firmware.
- Improved support for heterogeneous 64-bit ARM systems based on the big.LITTLE architecture, combining powerful but energy-consuming cores with less powerful but more energy-efficient cores in a single chip.
At the same time, Intel announced the release of Cloud Hypervisor 20.0, built on components from the joint Rust-VMM project, which also includes companies like Alibaba, Amazon, Google, and Red Hat. Rust-VMM is written in Rust and allows for the creation of hypervisors tailored to specific tasks. Cloud Hypervisor is one such hypervisor, providing a high-level virtual machine monitor (VMM) that operates on top of KVM and is optimized for addressing the challenges typical of cloud systems. The project code is available under the Apache 2.0 license.
Cloud Hypervisor focuses on running modern Linux distributions using paravirtualized devices based on virtio. Key goals include high responsiveness, low memory consumption, high performance, simplified configuration, and reducing potential attack vectors. Emulation support is minimized, with an emphasis on paravirtualization. Currently, only x86_64 systems are supported, but plans include support for AArch64. As for guest systems, only 64-bit Linux builds are currently supported. CPU, memory, PCI, and NVDIMM configuration are done at build time. There is an option for migrating virtual machines between servers.
In the new version:
- For x86_64 and aarch64 architectures, the creation of up to 16 PCI segments is now allowed, increasing the total number of permissible PCI devices from 31 to 496.
- Support for binding virtual CPUs to physical CPU cores (CPU pinning) has been implemented. For each vCPU, a limited set of host CPUs can now be defined for execution, which can be useful for direct reflection (1:1) of host and guest system resources or for running a virtual machine on a specific NUMA node.
- Improved support for input/output virtualization. Each VFIO region can now be reflected in memory, reducing the number of exits from the virtual machine and achieving better performance for device passthrough in the virtual machine.
- Work has been done in the Rust code to replace unsafe sections with alternative implementations running in safe mode. For the remaining unsafe sections, detailed comments have been added explaining why the leftover unsafe code can be considered safe.
Source: opennet.ru
