hm.
from: http://xenbits.xen.org/xsa/advisory-108.html
MITIGATION ==========
Running only PV guests will avoid this vulnerability.
Did amazon reboot all of it's VMs? or just the HVM VMs? why was neflix running on HVM VMs?
from: http://xenbits.xen.org/xsa/advisory-108.html
MITIGATION ==========
Running only PV guests will avoid this vulnerability.
Did amazon reboot all of it's VMs? or just the HVM VMs? why was neflix running on HVM VMs?
PV drivers on HVM have been a thing for a while now, so your IO and network go through PV even with an HVM instance. SRIOV/"Enhanced Networking" is even better than PV networking drivers, so HVM has another win there if you have NICs that support it (The larger Amazon instances do)
PV is significantly slower with system calls than HVM on 64bit hardware, as the x86_64 spec removed two of the four CPU protection rings, one of which being where PV lived in 32bit architectures, below the guest, allowing it to 'intercept' these system calls. Now since it shares a ring with the guest, it cannot intercept these and you are left with doubling the amount of context switches that you were previously. Virtualization extensions from Intel and AMD allow HVM to bypass this and skip the context switch. Other hardware advantages like EPT also give HVM an edge when it comes to memory related performance.
About the only area where PV is still better from a performance standpoint is interrupts/timers
Why shouldn't Netflix be running on HVM?
HVM, at least in the past, had a bunch more code that the guest DomU interacts with vs. fully pv guests. This has security implications.
Now, my knowledge of HVM is a few years... or more like half a decade out of date, for example, I don't even know how to force a HVM guest to only use PV drivers (which would solve 90% of the problem.) and i know that more and more of this has moved into hardware, so it's possible that what was true five years ago is not true now, but... yeah, I don't let untrusted users on HVM guests for the same reason I don't let untrusted users use pygrub or load untrusted kernels directly.
http://www.brendangregg.com/blog/2014-05-07/what-color-is-yo...
Forcing an HVM guest to use only PV drivers sounds like PVH, which is coming in Xen 4.4:
PVH is actually PV on top of an HVM container and is a bit different. You can think of it as PV sitting on top of enough HVM bits to take advantage of the hardware extensions Intel and AMD have invested so heavily in while still being majority PV. This gives you the best of both worlds, including the remaining PV performance benefits related to interrupts and timers that PV drivers on HVM can't utilize.
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-...
but on this page, they don't say that specifically, but mention the possibility in the PV on HVM section:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualiz...
Perhaps/presumably it also depends on the AMI you're using.