Earlier quoted context omitted.
If you want to check, I have a small (and not very good tbh) benchmarking chapter in my thesis where I detail the steps I have followed to get fairly low scheduler tick times of my software - for simple graphs the best I could do was to go to less than 100 microseconds with ~20 microseconds of jitter (p.187) for a tick: https://tel.archives-ouvertes.fr/tel-01947309/document ; also see the intro of section 10.4 with a…
What audio hardware are you using that allows 16 samples per buffer? Must be something ancient, I think?
Unikernels: The Next Stage of Linux’s Dominance (2019)
161–170 of 187 posts
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#162Earlier quoted context omitted.
At the moment you must go through glibc. For example issuing SYSENTER or INT 80h will not work. We have only run C applications so far, so I'm unsure how it will all work for servers written in other programming languages. I think applications which rely on complex multi-process middleware (like Java JBoss, etc) will be hard or even impossible to port.
You can always "unikernelize" the JVM. OSv had a kernel-optimized JVM for example.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#163Unikernels are typically statically linked. Using copyleft code means the whole resulting binary is subject to copyleft. Free software is great, but not everyone is in the position where they can release all of their code all the time. For a unikernel to be viable it can't have copyleft code in it.
No. That's formally wrong, and it doesn't imply what you think it implies.
Using copyleft code means that if you distribute the resulting binary, you also have to distribute the corresponding source code. If you can't do that, you can't distribute the binary.
Is that a problem? No. You distribute object files and libraries, accompany the copylefted libraries with their source code, and let the end user link them together statically. Problem solved. Arguably, that's how all software installation on Unix should work; it solves so many other problems, too.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#164Earlier quoted context omitted.
Debugging a single-executable container is quite unpleasant. I assume debugging unikernels or thin VMs (with a kernel and a single program) would be a similar experience.
Yep dev tooling matters. Containers are already annoying, but Unikernels are a different universe, and it is not going to be pleasant.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#165Earlier quoted context omitted.
Unikernels could also be the next phase of cloud orchestration technologies. They would be truly lightweight VMs, and obviate the need for containers (collapse the VM orchestration and container orchestration layers into a single orchestration layer). This would offer better security and better performance without impacting developer/operator friendliness. And a side note about improved performance, in the cloud spac…
Debugging a single-executable container is quite unpleasant. I assume debugging unikernels or thin VMs (with a kernel and a single program) would be a similar experience.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#166Earlier quoted context omitted.
As the program and kernel run in a single address space, yes there is no separation from your application corrupting parts of the kernel. I'm not very convinced about the security story around unikernels, but for balance the other side of the argument is that there's much less code around in a unikernel - no shell, no command line tools at all, no compilers or interpreters, just the code required to run the program a…
Wouldn’t directly linking system calls make every address space more unique and thus make it harder to write (generic) exploits for?
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#167Earlier quoted context omitted.
isn't it hard to develop/debug/monitor an application with this approach? I mean you can't just run a debugger as another process and attach to the thing, you can't run tcpdump or strace, nothing of that sort. Also every bad pointer access will require a reboot, wouldn't it? I mean how do you develop an application with this approach?
All good questions without a clear answer at the moment. Bad pointers in the application can overwrite kernel data structures because everything runs in a single address space.
Because of that, I think “without a clear answer at the moment” is worrisome. Are there partial answers to these questions?
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#168Earlier quoted context omitted.
So, a niche technology for a handful of HFT firms, betting platforms and hyper-scale cloud vendors. Those already use non-mainstream tech (eg LMAX disruptor) to achieve max performance. This is all nice and good, but the Unikernel guys claim since 20 years its the next big revolutionary thing. In the real world, the evolutionary approach using containers has turned out to solve the problems most people care about. Do…
Unikernels could also be the next phase of cloud orchestration technologies. They would be truly lightweight VMs, and obviate the need for containers (collapse the VM orchestration and container orchestration layers into a single orchestration layer). This would offer better security and better performance without impacting developer/operator friendliness. And a side note about improved performance, in the cloud spac…
That is actually a good point. Though this is also achievable with WebAssembly (see CloudFlare), but Unikernels could do it more generally I suppose.
On the other hand, AWS Lambda has yet to drive classic EC2 to extinction.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#169Earlier quoted context omitted.
What do you make of the highly critical Assessing Unikernel Security paper [0]? Have things changed since its publication? [0] https://www.nccgroup.trust/globalassets/our-research/us/whit... , from https://news.ycombinator.com/item?id=19738905
You might enjoy reading my response to that: https://nanovms.com/dev/tutorials/assessing-unikernel-securi...
It makes good sense to compare unikernels against conventional GNU/Linux. It's the standard configuration, and it sets the bar. Describing this as a pyschological hump isn't a sensible response.
I don't know what advances to things like the networking stack is meant to refer to. The article should be clear and explicit about what part of the paper this is responding to. As it stands it looks like a straw-man.
The response to unikernels are un-debuggable makes little sense. Someone can work on a debugger while claiming the current state of debugging is poor. No contradiction there.
Downplaying the significance of Data Execution Prevention isn't a convincing defence. Downplaying the significance of ASLR isn't a convincing defence. These are valuable security measures.
This excerpt from the conclusion seems to indicate a reluctance to take security concerns seriously at all, as if a security analysis is an emotional attack: there's a thousand little kids out there wanting to crap on anything they can. Security bugs are bugs at the end of the day and all one has to do is look at any random popular github to understand how many bugs we as humans create.
Re: Unikernels: The Next Stage of Linux’s Dominance (2019)
#170Earlier quoted context omitted.
The complexity of solving such problems generally is actually what drives me to start from scratch: rather than solve an intractable general problem, instead limit the scope of where the project must run and what it must do. My perception is that I am not capable of reliably tuning a general purpose OS for a total system latency of under 10 msec. I can't give the total system a hard number and believe that it will ob…
You still won't be safe against several/most of the causes outlined in the page from the Ardour manual that I linked to. SMIs, random hardware that locks the bus for too long ... out of the kernel's control. If you really want 10msec finger->ear (a goal that I would say is reasonable, though given many live performer's and mixing engineer's normal physical setups, probably excessive) and you want to guarantee it, it'…
Thank you very much — for your ongoing work in Open Source audio, for being willing to engage at length in this thread, and for being straightforward about what the system can deliver.
> If you really want 10msec finger->ear (a goal that I would say is reasonable, though given many live performer's and mixing engineer's normal physical setups, probably excessive)
I worked in a recording studio for 6 years, including two years as a mastering engineer. Most of the sonic adjustments I would make during mastering and mixing fell below the threshold of perception — but when added together they would produce something well above the threshold of perception.
There's nothing magic about this. I don't have "golden ears" (although because I've trained I can more quickly identify certain patterns than people who haven't trained).
The point is simply that an aggregation of imperceptible changes can sum to a perceptible result. It's akin to why you perform intermediate processing in both video and audio at a higher resolution than the final delivery medium: otherwise an accumulation of small, possibly imperceptable degradations will cause perceivable degradation of the finished product.
And so, I dispute the idea that just because there are other sources of latency, we should resign ourselves and accept substantial contributors to latency which fall below perceptual threshold. The only number that matters is the final sum of all latencies.
> You cannot guarantee the required scheduling on general purpose (intel/amd) motherboards unless you take great care with the selection, and even then ... I've heard that financial services/investment firms are the main reason you can still buy mobos without SMIs, because their "latency" requirements would be broken by these interrupts.
With this in mind, I will set aside one possibity I'd considered: writing for general purpose CPUs (e.g. multicore x86_64) outside of mainstream operating systems.
Instead, while I'll continue prototyping the project on mainstream operating systems, I'll probably look more deeply into dedicated outboard DSP boards.
> *On the other hand, the "not-guaranteed" case with a reasonable mobo, sensible bus connected devices, an RT kernel and properly written user space software is going to work almost all of the time. Just no guarantees.
I appreciate how hard you've worked to achieve that.
My question, then, is how can I be confident that I'm actually meeting these "almost-all-of-time-time" latency requirements?
In my experience, most systems recommended that you lower the latency until you hear clicks and pops. That convention leaves me... dissatisfied. A dropout is a detectable event, and the monitoring system should surface it.
Just as boggling when you have exacting standards is when the system falls back and delivers something subtly degraded without telling you, like changing the latency without warning because the system would otherwise go down. I understand why systems are designed to prefer degradation over failure, but for my purposes I need to know when it happens. Expecting me to monitor continuously for an effect which is at the threshold of perception, such as subtly increased latency, is draining — and ultimately unreasonable.
We have meters for noise floors and red lights indicating that clipping occurred. What facilities exist to help me understand when the latency behaviors of my rig are not meeting my requirements?