Hi, I work at AWS and before that on KVM since it was a thing. Restricting /dev/kvm these days doesn't make much sense. The interface is designed to be safe for any user. The fact that we started as a character device…
Sorry for that. The timeout behavior on earlier kernels is a bit of a pain. There's a lot to love about NVMe and timeouts are not actually part of the NVMe specification itself but rather a Linux driver construct.…
Yes, all customer PV instances in EC2 are running in an HVM container and are protected against the guest-to-guest Meltdown vulnerability. As with all virtual and physical machines, patches are necessary to protect…
We're still working the details out upstream but the TL;DR is that the way to address Meltdown with Xen PV is to use nested virtualization so that the outer guest is an HVM or PVH guest.
I tried to cover this in my re:Invent session and walked through how we have been evolving the Nitro System over the last 5 years. Videos and slides will be posted eventually.
Thanks! Would love to hear more about the counters that your interested in. We've exposed more in C5 than in previous instance types and we are trying to make more available over time in a safe way.
It's exactly the same as with the i3.16xlarge instance type. There are eight 1900 GB drives. In an i3.16xlarge, those eight drives are passed through to the instance with PCIe passthrough but for the i3.metal instance,…
There is more coming at re:Invent. We have more talks queued up tomorrow on this too.
You can provision these servers just like any other instance. They work just like any other Amazon EC2 instance (same Nitro System platform as C5). Disclaimer: I work at AWS on the team responsible for the Nitro System…
> Hopefully Amazon will disclose more details. We will have some more details on how this all works at re:Invent in a couple weeks.
You claim it's objectively bad then only cite subjective things like function, structure, and variable names. That word doesn't mean what you think it means :-)
Technically that was breaking out of QEMU. It was not KVM specific. If you break into QEMU, you should be a non-privileged user. If you are using libvirt, you are in a cgroup based jail (basically a container) with…
IBM uses a test called IPAT for hiring. It's more of an IQ test than personality.
Maybe if you work down town but a lot of tech companies are in north Austin where housing is very cheap.
Michael Hines has done a fantastic job getting this series merged. It's a rather invasive change and I am amazed at how quickly it was merged.
I don't think you understand the problem. The problem is that the PRNG has a weak default entropy source. The same problem existed in the kernel for ages. See http://www.factorable.net The real advice here ought to be…
This analysis of steal time is not entirely correct. Steal time exists to fix a problem. When a hypervisor needs to pre-empt a running guest, without steal time, when the hypervisor eventually resumes that guest, as far…
> Workload Manager (WLM) [1] has been a part of IBM z/OS since before it was even called z/OS. WLM implemented something like cgroups scheduling, in that existing utilization samples feed into future scheduling to…
Hi David, > Mature containers have been around since the the days of mainframes. Citation needed. I'd go as far as to say that there is no such thing as a mature container technology. The fundamental problem of…
This is not about privacy, it's about self incrimination which is far, far more important. You can be compelled to testify under oath for many reasons none of which involve doing anything wrong. When you testify under…
http://www.slideshare.net/openstackindia/openstack-at-paypal... Has more details. Looks like it's KVM.
There's a feminist belief that all forms of "pornography" are inherently discriminatory toward women with pornography being a very broad concept--basically any form of sexuality not associated with love. See…
This is ultimately about scalability. To achieve this kind of IOP rate, you need to be able to scale very large guests very well. KVM has always been exceptionally good at this and QEMU was really the bottle neck. We've…
"Again, I hadn't lived there or worked there since 2003, but I did own part of a business that was headquartered in MA, and the state was using this fact to harass me for income tax money." If you own a business…
Yes, you can over-subscribe RAM either through ballooning or just by over-subscribing the host. Both KVM and Xen use QEMU for their device models so the machine they emulate is very similar (at least in HVM mode). Xen…
Hi, I work at AWS and before that on KVM since it was a thing. Restricting /dev/kvm these days doesn't make much sense. The interface is designed to be safe for any user. The fact that we started as a character device…
Sorry for that. The timeout behavior on earlier kernels is a bit of a pain. There's a lot to love about NVMe and timeouts are not actually part of the NVMe specification itself but rather a Linux driver construct.…
Yes, all customer PV instances in EC2 are running in an HVM container and are protected against the guest-to-guest Meltdown vulnerability. As with all virtual and physical machines, patches are necessary to protect…
We're still working the details out upstream but the TL;DR is that the way to address Meltdown with Xen PV is to use nested virtualization so that the outer guest is an HVM or PVH guest.
I tried to cover this in my re:Invent session and walked through how we have been evolving the Nitro System over the last 5 years. Videos and slides will be posted eventually.
Thanks! Would love to hear more about the counters that your interested in. We've exposed more in C5 than in previous instance types and we are trying to make more available over time in a safe way.
It's exactly the same as with the i3.16xlarge instance type. There are eight 1900 GB drives. In an i3.16xlarge, those eight drives are passed through to the instance with PCIe passthrough but for the i3.metal instance,…
There is more coming at re:Invent. We have more talks queued up tomorrow on this too.
You can provision these servers just like any other instance. They work just like any other Amazon EC2 instance (same Nitro System platform as C5). Disclaimer: I work at AWS on the team responsible for the Nitro System…
> Hopefully Amazon will disclose more details. We will have some more details on how this all works at re:Invent in a couple weeks.
You claim it's objectively bad then only cite subjective things like function, structure, and variable names. That word doesn't mean what you think it means :-)
Technically that was breaking out of QEMU. It was not KVM specific. If you break into QEMU, you should be a non-privileged user. If you are using libvirt, you are in a cgroup based jail (basically a container) with…
IBM uses a test called IPAT for hiring. It's more of an IQ test than personality.
Maybe if you work down town but a lot of tech companies are in north Austin where housing is very cheap.
Michael Hines has done a fantastic job getting this series merged. It's a rather invasive change and I am amazed at how quickly it was merged.
I don't think you understand the problem. The problem is that the PRNG has a weak default entropy source. The same problem existed in the kernel for ages. See http://www.factorable.net The real advice here ought to be…
This analysis of steal time is not entirely correct. Steal time exists to fix a problem. When a hypervisor needs to pre-empt a running guest, without steal time, when the hypervisor eventually resumes that guest, as far…
> Workload Manager (WLM) [1] has been a part of IBM z/OS since before it was even called z/OS. WLM implemented something like cgroups scheduling, in that existing utilization samples feed into future scheduling to…
Hi David, > Mature containers have been around since the the days of mainframes. Citation needed. I'd go as far as to say that there is no such thing as a mature container technology. The fundamental problem of…
This is not about privacy, it's about self incrimination which is far, far more important. You can be compelled to testify under oath for many reasons none of which involve doing anything wrong. When you testify under…
http://www.slideshare.net/openstackindia/openstack-at-paypal... Has more details. Looks like it's KVM.
There's a feminist belief that all forms of "pornography" are inherently discriminatory toward women with pornography being a very broad concept--basically any form of sexuality not associated with love. See…
This is ultimately about scalability. To achieve this kind of IOP rate, you need to be able to scale very large guests very well. KVM has always been exceptionally good at this and QEMU was really the bottle neck. We've…
"Again, I hadn't lived there or worked there since 2003, but I did own part of a business that was headquartered in MA, and the state was using this fact to harass me for income tax money." If you own a business…
Yes, you can over-subscribe RAM either through ballooning or just by over-subscribing the host. Both KVM and Xen use QEMU for their device models so the machine they emulate is very similar (at least in HVM mode). Xen…